Skip to content

Commit 0555ac4

Browse files
mnasiadkamnasiadka
authored
Merge pull request #30 from stackhpc/vault_pki
Add vault_pki role
2 parents 8e84bd1 + c537d08 commit 0555ac4

File tree

15 files changed

+334
-9
lines changed

15 files changed

+334
-9
lines changed

‎.github/workflows/pull_request.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ jobs:
6565
else
6666
ansible_package=ansible-core
6767
fi
68-
python3 -m pip install $ansible_package==$ansible_version.* docker ansible-modules-hashivault
68+
python3 -m pip install $ansible_package==$ansible_version.* docker git+https://github.com/stackhpc/ansible-modules-hashivault@stackhpc
6969
ansible-galaxy collection build
7070
ansible-galaxy collection install *.tar.gz
7171

‎roles/vault/defaults/main.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,14 @@ vault_config: >
3333
{% else %}
3434
"tls_disable": "true"
3535
{% endif %}
36+
}{% if vault_bind_address != '127.0.0.1' %},
37+
},
38+
{
39+
"tcp": {
40+
"address": "127.0.0.1:8200",
41+
"tls_disable": "true"
3642
}
43+
{% endif %}
3744
}],
3845
"storage": {
3946
"consul": {

‎roles/vault/tasks/consul.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@
2323
-retry-join "{{ hostvars[host].ansible_facts[consul_bind_interface].ipv4.address }}"
2424
{% endif %}
2525
{% endfor %}
26-
become: True
26+
become: true

‎roles/vault/tasks/main.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
---
2-
- import_tasks: prechecks.yml
3-
- import_tasks: consul.yml
4-
- import_tasks: vault.yml
2+
- name: "Vault Prechecks"
3+
import_tasks: prechecks.yml
4+
5+
- name: "Deploy Consul"
6+
import_tasks: consul.yml
7+
8+
- name: "Deploy Vault"
9+
import_tasks: vault.yml

‎roles/vault/tasks/vault.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
VAULT_LOCAL_CONFIG: "{{ vault_config | to_json }}"
1515
command: >
1616
server
17-
become: True
17+
become: true
1818

1919
- name: Check if vault is initialized
2020
uri:
@@ -25,7 +25,8 @@
2525
run_once: true
2626
until: vault_init_status.status == 200
2727

28-
- block:
28+
- name: "Initialize vault"
29+
block:
2930
- name: Initialize vault
3031
hashivault_init:
3132
url: "{{ vault_api_addr }}"

‎roles/vault_pki/README.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
This role Generates a Root and Intermediate certificate and generates leaf certificates
2+
3+
Requirements
4+
------------
5+
6+
`ansible-modules-hashivault` Python package installed on the Ansible control host
7+
`hvac` Python package installed on the remote hosts
8+
9+
Note that since version `4.6.4`, `ansible-modules-hashivault` requires
10+
`ansible>4`.
11+
12+
There is a fork under https://github.com/stackhpc/ansible-modules-hashivault
13+
that doesn't have this requirement (and is needed for the role to operate
14+
correctly on ansible<4).
15+
16+
Role variables
17+
--------------
18+
19+
* Vault Create Root
20+
* `vault_pki_root_create`: whether to create a RootCA certificate or not (default: `true`)
21+
* Mandatory if `vault_pki_root_create` equals `true`
22+
* `vault_pki_root_ca_name`: The name of the RootCA to create (string)
23+
* `vault_pki_root_ca_common_name`: The common name of the RootCA (default: vault_pki_root_ca_name)
24+
* `vault_pki_write_root_ca_to_file`: whether to write the root CA certificate to a file for importing into a systems trust store (default: `false`)
25+
* `vault_pki_root_default_lease_ttl`: The default time in hours before expiry of the root CA certificate (default: "43830h")
26+
* `vault_pki_root_max_lease_ttl`: The max time in hours that is allowed before expiry of the root CA certificate (default: "43830h")
27+
* `vault_pki_root_ttl`: The time in hours before the root CA certificate expires (default: "43830h")
28+
* `vault_pki_root_key_bits`: The key bits for the root RSA private key (default: "4096")
29+
---
30+
* Vault Create Intermediate
31+
* `vault_pki_intermediate_create`: whether to create an intermediate CA or not (default: `true`)
32+
* `vault_pki_intermediate_import`: whether to import a pre-existing intermediate pem bundle (default: `false`)
33+
* `vault_pki_intermediate_export`: whether to export the generated intermediate pem bundle (default: `false`)
34+
* Mandatory if `vault_pki_intermediate_create` equals `true`
35+
* `vault_pki_intermediate_ca_name`: The name of the Intermediate CA to create
36+
* `vault_pki_intermediate_ca_common_name`: The common name of the RootCA (default: `vault_pki_intermediate_ca_name`)
37+
* Mandatory if `vault_pki_intermediate_import`: equals `true`
38+
* `vault_pki_intermediate_ca_bundle`: Concatenated certificate, intermediate and private key
39+
* `vault_pki_intermediate_default_lease_ttl`: The default time in hours before expiry of the intermediate CA certificate (default: "43830h")
40+
* `vault_pki_intermediate_max_lease_ttl`: The max time in hours that is allowed before expiry of the intermediate CA certificate (default: "43830h")
41+
* `vault_pki_intermediate_ttl`: The time in hours before the intermediate CA certificate expires (default: "43830h")
42+
* `vault_pki_intermediate_key_bits`: The key bits for the intermediate RSA private key (default: "4096")
43+
* `vault_pki_intermediate_roles`: Certificate Roles to create for the intermediate CA. List of Dicts containing `{name: <role_name>, config: { <pki_option>: <value> ...}`
44+
---
45+
* Certificate Output
46+
* `vault_pki_generate_certificates`: whether to generate leaf certificates or not (default: `false`)
47+
* `vault_pki_write_certificates_host:` The host on which certificates will be written to. (default: "localhost")
48+
* `vault_pki_certificates_directory`: directory to output certificate files to.
49+
* `vault_pki_write_certificates`: whether to write generated certificates to a file or not (default: `false`)
50+
* `vault_pki_certificate_subject`: The certificate subject parameters e.g. `ttl` `ip_sans`. List of Dicts containing `{role: <name of Certificate role>, common_name: <common name of certificate>, extra_params: {ttl: <value>, alt_sans: <value>, ip_sans: <value> }}`

‎roles/vault_pki/defaults/main.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
vault_pki_root_create: true
3+
vault_pki_root_ca_name: ""
4+
vault_pki_root_ca_common_name: "{{ vault_pki_root_ca_name }}"
5+
vault_pki_write_root_ca_to_file: false
6+
vault_pki_root_default_lease_ttl: "43830h"
7+
vault_pki_root_max_lease_ttl: "43830h"
8+
vault_pki_root_ttl: "43830h"
9+
vault_pki_root_key_bits: 4096
10+
11+
12+
vault_pki_intermediate_create: true
13+
vault_pki_intermediate_import: false
14+
vault_pki_intermediate_export: false
15+
vault_pki_intermediate_ca_name: ""
16+
vault_pki_intermediate_ca_common_name: "{{ vault_pki_intermediate_ca_name }}"
17+
vault_pki_intermediate_ca_bundle: ""
18+
vault_pki_intermediate_default_lease_ttl: "43830h"
19+
vault_pki_intermediate_max_lease_ttl: "43830h"
20+
vault_pki_intermediate_ttl: "43830h"
21+
vault_pki_intermediate_key_bits: 4096
22+
23+
vault_pki_intermediate_roles: {}
24+
25+
vault_pki_generate_certificates: false
26+
27+
vault_pki_write_certificates_host: "localhost"
28+
vault_pki_write_certificates_directory: ""
29+
vault_pki_write_certificate_files: false
30+
31+
vault_pki_certificate_subject: []

‎roles/vault_pki/tasks/create_cert.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
- name: "Generate Certificate"
3+
hashivault_pki_cert_issue:
4+
url: "{{ vault_api_addr }}"
5+
token: "{{ vault_token }}"
6+
mount_point: "{{ vault_pki_intermediate_ca_name }}"
7+
common_name: "{{ item.common_name }}"
8+
role: "{{ item.role }}"
9+
extra_params: "{{ item.extra_params }}"
10+
loop: "{{ vault_pki_certificate_subject }}"
11+
register: certificate_data
12+
13+
- name: "Write out certificate pem_bundle"
14+
copy:
15+
content: |
16+
{{ item.data.certificate }}
17+
{{ item.data.issuing_ca }}
18+
{{ item.data.private_key }}
19+
dest: "{{ vault_pki_certificates_directory }}/{{ item.item.common_name | replace(' ', '-') }}.pem"
20+
mode: 0600
21+
delegate_to: "{{ vault_pki_certificates_host }}"
22+
loop: "{{ certificate_data.results }}"
23+
when: vault_pki_write_certificate_files | bool

‎roles/vault_pki/tasks/intermediate.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
---
2+
- name: "Ensure Vault Intermediate PKI backend exists"
3+
hashivault_secret_engine:
4+
url: "{{ vault_api_addr }}"
5+
token: "{{ vault_token }}"
6+
name: "{{ vault_pki_intermediate_ca_name }}"
7+
description: "{{ vault_pki_intermediate_ca_name }} CA"
8+
backend: "pki"
9+
config:
10+
default_lease_ttl: "{{ vault_pki_intermediate_default_lease_ttl }}"
11+
max_lease_ttl: "{{ vault_pki_intermediate_max_lease_ttl }}"
12+
13+
- name: "Generate Intermediate CA cert, key and sign CSR"
14+
block:
15+
- name: "Generate Vault Intermediate CA cert and key"
16+
hashivault_pki_ca:
17+
url: "{{ vault_api_addr }}"
18+
token: "{{ vault_token }}"
19+
mount_point: "{{ vault_pki_intermediate_ca_name }}"
20+
type: "{% if vault_pki_intermediate_export | bool %}exported{% else %}internal{% endif %}"
21+
common_name: "{{ vault_pki_intermediate_ca_common_name }}"
22+
kind: "intermediate"
23+
config:
24+
ttl: "{{ vault_pki_intermediate_ttl }}"
25+
key_bits: "{{ vault_pki_intermediate_key_bits }}"
26+
register: intermediate_ca_csr
27+
28+
- name: "Sign Intermediate CSR"
29+
hashivault_pki_cert_sign:
30+
url: "{{ vault_api_addr }}"
31+
token: "{{ vault_token }}"
32+
mount_point: "{{ vault_pki_root_ca_name }}"
33+
csr: "{{ intermediate_ca_csr.data.csr }}"
34+
common_name: "{{ vault_pki_intermediate_ca_common_name }}"
35+
type: intermediate
36+
register: intermediate_ca_csr_signed
37+
38+
- name: "Set Intermediate as signed"
39+
hashivault_pki_set_signed:
40+
url: "{{ vault_api_addr }}"
41+
token: "{{ vault_token }}"
42+
mount_point: "{{ vault_pki_intermediate_ca_name }}"
43+
certificate: |
44+
{{ intermediate_ca_csr_signed.data.certificate }}
45+
{{ intermediate_ca_csr_signed.data.issuing_ca }}
46+
when:
47+
- not vault_pki_intermediate_export | bool
48+
49+
- name: "Set Exported Intermediate as signed"
50+
hashivault_pki_ca_set:
51+
url: "{{ vault_api_addr }}"
52+
token: "{{ vault_token }}"
53+
mount_point: "{{ vault_pki_intermediate_ca_name }}"
54+
pem_bundle: |
55+
{{ intermediate_ca_csr_signed.data.certificate }}
56+
{{ intermediate_ca_csr_signed.data.issuing_ca }}
57+
{{ intermediate_ca_csr.data.private_key }}
58+
when:
59+
- vault_pki_intermediate_export | bool
60+
61+
- name: "Write out Intermediate Certs and keys to file"
62+
copy:
63+
content: |
64+
{{ intermediate_ca_csr_signed.data.certificate }}
65+
{{ intermediate_ca_csr_signed.data.issuing_ca }}
66+
{{ intermediate_ca_csr.data.private_key }}
67+
dest: "{{ vault_pki_certificates_directory }}/{{ vault_pki_intermediate_ca_name |replace(' ', '-') }}.pem"
68+
mode: 0600
69+
delegate_to: "{{ vault_pki_certificates_host }}"
70+
when:
71+
- vault_pki_intermediate_export | bool
72+
73+
when: not vault_pki_intermediate_import | bool
74+
75+
- name: "Import Intermediate CA cert and key"
76+
block:
77+
- name: "Import Intermediate CA cert and key"
78+
hashivault_pki_ca_set:
79+
url: "{{ vault_api_addr }}"
80+
token: "{{ vault_token }}"
81+
mount_point: "{{ vault_pki_intermediate_ca_name }}"
82+
pem_bundle: "{{ vault_pki_intermediate_ca_bundle }}"
83+
84+
when: vault_pki_intermediate_import | bool

‎roles/vault_pki/tasks/main.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
- name: "Prechecks"
3+
include_tasks: "prechecks.yml"
4+
5+
- name: "Generate Root"
6+
include_tasks: "root.yml"
7+
when: vault_pki_root_create | bool
8+
9+
- name: "Generate Intermediate"
10+
include_tasks: "intermediate.yml"
11+
when: vault_pki_intermediate_create | bool
12+
13+
- name: "Define Roles"
14+
include_tasks: "roles.yml"
15+
when: vault_pki_intermediate_roles | length > 0
16+
17+
- name: "Generate Certificates"
18+
include_tasks: "create_cert.yml"
19+
when:
20+
- vault_pki_generate_certificates | bool
21+
- vault_pki_certificate_subject | length > 0

0 commit comments

Comments
 (0)