scs/system-config
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

improve the vault handling stuff

Browse Source
This commit is contained in:
Artem Goncharov 2023-06-29 16:06:41 +02:00
parent 65e4c10460
commit dd769b19d4
3 changed files with 41 additions and 97 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

125
inventory/service/group_vars/vault-controller.yaml
View File

File diff suppressed because it is too large Load Diff

9
playbooks/configure-vault.yaml
View File

@ -1,4 +1,13 @@
--- ---
# Manage Vault configuration (policies, roles, accesses, etc)
#
# vault_instances is a dictionary ({instance_name: config}) containing all the
# required information that is being passed one by one into the configure_vault
# role for the execution with the help of Vault API invocation.
#
# variable `vault_create_auth=true` will force presence of auth methods which
# are otherwise (default) not created
#
- hosts: vault-controller:!disabled - hosts: vault-controller:!disabled
name: "Configure Vault instances" name: "Configure Vault instances"
tasks: tasks:

4
playbooks/roles/configure_vault/tasks/auth.yaml
View File

@ -1,7 +1,8 @@
---
- name: Read Auth {{ auth.type }} at {{ auth.path }} - name: Read Auth {{ auth.type }} at {{ auth.path }}
check_mode: "no" check_mode: "no"
ansible.builtin.uri: ansible.builtin.uri:
url: "{{ vault_addr }}/v1/sys/auth/{{ auth.path }}/tune" url: "{{ vault_addr }}/v1/sys/auth/{{ auth.path }}"
headers: headers:
X-Vault-Token: "{{ vault_token }}" X-Vault-Token: "{{ vault_token }}"
method: "GET" method: "GET"
@ -28,7 +29,6 @@
passthrough_request_headers: "{{ auth.passthrough_request_headers | default(omit) }}" passthrough_request_headers: "{{ auth.passthrough_request_headers | default(omit) }}"
allowed_response_headers: "{{ auth.allowed_response_headers | default(omit) }}" allowed_response_headers: "{{ auth.allowed_response_headers | default(omit) }}"
options: "{{ auth.options | default(omit) }}" options: "{{ auth.options | default(omit) }}"
status_code: [200, 201, 202, 204] status_code: [200, 201, 202, 204]
when: when:
- "current_auth is not defined or current_auth.status != 200" - "current_auth is not defined or current_auth.status != 200"