k8s-sig-cluster-lifecycleawskubesprayhigh-availabilityansiblekubernetes-clustergcekubernetesbare-metal
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
48 lines
1.8 KiB
48 lines
1.8 KiB
---
|
|
# The JSON inside JSON here is intentional (Vault API wants it)
|
|
- name: create_role | Create a policy for the new role allowing issuing
|
|
uri:
|
|
url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}/v1/sys/policy/{{ create_role_name }}"
|
|
headers: "{{ hostvars[groups.vault|first]['vault_headers'] }}"
|
|
method: PUT
|
|
body_format: json
|
|
body:
|
|
rules: >-
|
|
{%- if create_role_policy_rules|d("default") == "default" -%}
|
|
{{
|
|
{ 'path': {
|
|
create_role_mount_path + '/issue/' + create_role_name: {'policy': 'write'},
|
|
create_role_mount_path + '/roles/' + create_role_name: {'policy': 'read'}
|
|
}} | to_json + '\n'
|
|
}}
|
|
{%- else -%}
|
|
{{ create_role_policy_rules | to_json + '\n' }}
|
|
{%- endif -%}
|
|
status_code: 204
|
|
delegate_to: "{{ groups.vault|first }}"
|
|
run_once: true
|
|
|
|
- name: create_role | Create {{ create_role_name }} role in the {{ create_role_mount_path }} pki mount
|
|
uri:
|
|
url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}/v1/{{ create_role_mount_path }}/roles/{{ create_role_name }}"
|
|
headers: "{{ hostvars[groups.vault|first]['vault_headers'] }}"
|
|
method: POST
|
|
body_format: json
|
|
body: >-
|
|
{%- if create_role_options|d("default") == "default" -%}
|
|
{'allow_any_name': true}
|
|
{%- else -%}
|
|
{{ create_role_options }}
|
|
{%- endif -%}
|
|
status_code: 204
|
|
delegate_to: "{{ groups.vault|first }}"
|
|
run_once: true
|
|
|
|
## Userpass based auth method
|
|
|
|
- include_tasks: gen_userpass.yml
|
|
vars:
|
|
gen_userpass_password: "{{ create_role_password }}"
|
|
gen_userpass_policies: "{{ create_role_name }}"
|
|
gen_userpass_role: "{{ create_role_name }}"
|
|
gen_userpass_username: "{{ create_role_name }}"
|