Skip to content

Commit b1bd35b

Browse files
author
Bryan Kendall
committed
add vault values playbook
1 parent 48d8c8a commit b1bd35b

3 files changed

Lines changed: 146 additions & 0 deletions

File tree

‎ansible/gamma-hosts/variables‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,16 @@ aws_access_key_id=AKIAJ3RCYU6FCULAJP2Q
4545
aws_secret_access_key=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
4646
shiva_rollbar_key=0526a90faec845d796e1ef5361a00526
4747

48+
[vault:vars]
49+
vault_auth_token=e22c3ebc-11cf-653b-7df0-79d78a499458
50+
vault_token_01=71d7b4754686013c8b9cfb22bafae79c661849dcd67c483c89efba12c0466aa201
51+
vault_token_02=794d6f7a3459c332a1fd2bbcc9230a7f84f1639806039ee8be547828cd7ab03a02
52+
vault_token_03=2e67faeffe4343c038d0f3210bdb83f3d3a5bc468975cf13e977ce9b5922aefe03
53+
vault_hello_runnable_github_token=88ddc423c2312d02a8bbcaad76dd4c374a30e4af
54+
vault_aws_access_key_id=AKIAJ7R4UIM45KH2WGWQ
55+
vault_aws_secret_key=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
56+
vault_aws_region=us-east-1
57+
4858
[gamma:vars]
4959
ansible_ssh_private_key_file=~/.ssh/gamma.pem
5060
datadog_host_address=10.4.6.251

‎ansible/group_vars/alpha-vault.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,23 @@ container_run_args: >
2020
-log-level=warn
2121
-config=/vault.hcl
2222
> /var/log/vault.log 2>&1
23+
24+
# vault seed data
25+
# pulled 2015/16/12 - Bryan
26+
vault_seed_values:
27+
- key: secret/loggly
28+
data:
29+
token: f673760d-e0b3-4a93-a15e-2862ea074f91
30+
- key: secret/rabbitmq
31+
data:
32+
username: "{{ rabbit_username }}"
33+
password: "{{ rabbit_password }}"
34+
- key: secret/github/hellorunnable
35+
data:
36+
token: "{{ vault_hello_runnable_github_token }}"
37+
- key: secret/swarm
38+
data:
39+
token: "{{ swarm_token }}"
40+
41+
# for the love of all that you find holy, don't change the following unless you _KNOW WHAT YOU ARE DOING_.
42+
vault_seed_policy: "{\\\"Version\\\": \\\"2012-10-17\\\", \\\"Statement\\\": [{\\\"Action\\\": [\\\"ec2:DescribeInstances\\\", \\\"ec2:DescribeTags\\\"], \\\"Resource\\\": [\\\"*\\\"], \\\"Effect\\\": \\\"Allow\\\", \\\"Sid\\\": \\\"Stmt1445655064000\\\"}]}"

‎ansible/vault-values.yml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
---
2+
- hosts: vault
3+
vars_files:
4+
- group_vars/alpha-vault.yml
5+
tasks:
6+
- name: make sure httplib2 is installed
7+
sudo: yes
8+
apt: package=python-httplib2 state=present
9+
10+
- name: get seal status
11+
tags: [unseal]
12+
run_once: true
13+
uri:
14+
method=GET
15+
url=http://{{ ansible_default_ipv4.address }}:8200/v1/sys/seal-status
16+
HEADER_X-Vault-Token="{{ vault_auth_token }}"
17+
return_content=yes
18+
register: seal_status
19+
20+
- name: unseal vault
21+
tags: [unseal]
22+
run_once: true
23+
when: seal_status.json.sealed
24+
uri:
25+
method=PUT
26+
url=http://{{ ansible_default_ipv4.address }}:8200/v1/sys/unseal
27+
HEADER_X-Vault-Token="{{ vault_auth_token }}"
28+
body_format=json
29+
body='{{ item | to_json }}'
30+
with_items:
31+
- key: "{{ vault_token_01 }}"
32+
- key: "{{ vault_token_02 }}"
33+
- key: "{{ vault_token_03 }}"
34+
35+
- name: put values into vault
36+
run_once: true
37+
when: write_values is defined
38+
uri:
39+
method=PUT
40+
url=http://{{ ansible_default_ipv4.address }}:8200/v1/{{ item.key }}
41+
HEADER_X-Vault-Token="{{ vault_auth_token }}"
42+
body_format=json
43+
body='{{ item.data | to_json }}'
44+
status_code=200,204
45+
with_items: "{{ vault_seed_values }}"
46+
47+
- name: check for aws backend in vault
48+
run_once: true
49+
when: write_values is defined
50+
uri:
51+
method=GET
52+
url=http://{{ ansible_default_ipv4.address }}:8200/v1/sys/mounts
53+
HEADER_X-Vault-Token="{{ vault_auth_token }}"
54+
return_content=yes
55+
register: mounts
56+
57+
- name: mount aws backend in vault
58+
run_once: true
59+
when: write_values is defined and mounts.json['aws/'] is not defined
60+
uri:
61+
method=POST
62+
url=http://{{ ansible_default_ipv4.address }}:8200/v1/sys/mounts/aws
63+
HEADER_X-Vault-Token="{{ vault_auth_token }}"
64+
body_format=json
65+
body='{{ item | to_json }}'
66+
status_code=204
67+
with_items:
68+
- type: "aws"
69+
70+
- name: configure aws root credentials
71+
run_once: true
72+
when: (write_values is defined and write_root_creds is defined) or (write_values is defined and mounts.json['aws/'] is not defined)
73+
uri:
74+
method=POST
75+
url=http://{{ ansible_default_ipv4.address }}:8200/v1/aws/config/root
76+
HEADER_X-Vault-Token="{{ vault_auth_token }}"
77+
body_format=json
78+
body='{{ item | to_json }}'
79+
status_code=204
80+
register: creds
81+
with_items:
82+
- access_key: "{{ vault_aws_access_key_id }}"
83+
secret_key: "{{ vault_aws_secret_key }}"
84+
region: "{{ vault_aws_region }}"
85+
86+
- name: check for the dock-init role
87+
run_once: true
88+
when: write_values is defined
89+
uri:
90+
method=GET
91+
url=http://{{ ansible_default_ipv4.address }}:8200/v1/aws/roles/dock-init
92+
HEADER_X-Vault-Token="{{ vault_auth_token }}"
93+
status_code=200,404
94+
register: role
95+
96+
- name: write the dock-init role
97+
run_once: true
98+
when: write_values is defined and role.status == 404
99+
uri:
100+
method=POST
101+
url=http://{{ ansible_default_ipv4.address }}:8200/v1/aws/roles/dock-init
102+
HEADER_X-Vault-Token="{{ vault_auth_token }}"
103+
body_format=json
104+
body='{{ item | to_json | replace("\\\\", "") }}'
105+
status_code=204
106+
register: creds
107+
with_items:
108+
- policy: "{{ vault_seed_policy }}"
109+
110+
- name: seal vault
111+
run_once: true
112+
uri:
113+
method=PUT
114+
url=http://{{ ansible_default_ipv4.address }}:8200/v1/sys/seal
115+
HEADER_X-Vault-Token="{{ vault_auth_token }}"
116+
status_code=204

0 commit comments

Comments
 (0)