jpp/ansible-roles
1
0
Fork 0
mirror of https://git.lapiole.org/dani/ansible-roles.git synced 2025-07-27 00:05:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update to 2022-09-13 17:00

Browse Source
This commit is contained in:
Daniel Berteaud
2022-09-13 17:00:08 +02:00
parent 3d8b59673b
commit a612a2fdcd
18 changed files with 89 additions and 182 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
roles/nomad/templates/agent_bundle.pem.tpl.j2 Normal file
View File

@@ -0,0 +1,11 @@
[[ with pkiCert "{{ nomad_vault_secrets.pki.path }}/issue/{{ nomad_vault_secrets.pki.role }}" "common_name={{ (nomad_conf.server.enabled) | ternary('server', 'client') }}-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ nomad_conf.region | default('global') }}.nomad" "alt_names=localhost,{{ (nomad_conf.server.enabled) | ternary('server', 'client') }}.{{ nomad_conf.region | default('global') }}.nomad{% if nomad_conf.server.enabled and nomad_conf.client.enabled %},client.{{ nomad_conf.region | default('global') }}.nomad{% endif %}{% if consul_conf is defined %},nomad{{ nomad_conf.server.enabled | ternary('', '-client') }}.service.{{ consul_conf.domain | default('consul') }}{% endif %}"{% if nomad_vault_secrets.pki.ttl is defined %} "ttl={{ nomad_vault_secrets.pki.ttl }}"{% endif %} ]]
[[ .CA ]]
[[ .Cert ]]
[[ .Key ]]
[[ .CA | writeToFile "{{ nomad_conf.tls.ca_file }}" "root" "root" "0644" ]]
[[ .Cert | writeToFile "{{ nomad_conf.tls.cert_file }}" "root" "root" "0644" ]]
[[ .Key | writeToFile "{{ nomad_conf.tls.key_file }}" "root" "{{ nomad_user }}" "0640" ]]
[[ end ]]
[[ with secret "{{ nomad_vault_secrets.pki.path }}/cert/ca" ]]
[[ .Data.certificate | writeToFile "{{ nomad_conf.tls.cert_file }}" "" "" "0644" "append,newline" ]]
[[ end ]]

8
roles/nomad/templates/agent_cert.tpl.j2
View File

@@ -1,8 +0,0 @@
[[ with secret "{{ nomad_vault_secrets.pki.path }}/issue/{{ nomad_vault_secrets.pki.role }}" "common_name={{ (nomad_conf.server.enabled) | ternary('server', 'client') }}-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ nomad_conf.region | default('global') }}.nomad" "alt_names=localhost,{{ (nomad_conf.server.enabled) | ternary('server', 'client') }}.{{ nomad_conf.region | default('global') }}.nomad{% if nomad_conf.server.enabled and nomad_conf.client.enabled %},client.{{ nomad_conf.region | default('global') }}.nomad{% endif %}{% if consul_conf is defined %},nomad{{ nomad_conf.server.enabled | ternary('', '-client') }}.service.{{ consul_conf.domain | default('consul') }}{% endif %}"{% if nomad_vault_secrets.pki.ttl is defined %} "ttl={{ nomad_vault_secrets.pki.ttl }}"{% endif %} ]]
[[ .Data.{{ item.what }} ]]
[[ end ]]
{% if item.what == 'certificate' %}
[[ with secret "{{ nomad_vault_secrets.pki.path }}/cert/ca" ]]
[[ .Data.certificate ]]
[[ end ]]
{% endif %}

7
roles/nomad/templates/cli_bundle.pem.tpl.j2 Normal file
View File

@@ -0,0 +1,7 @@
[[ with pkiCert "{{ nomad_vault_secrets.pki.path }}/issue/{{ nomad_vault_secrets.pki.role }}" "common_name=cli-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ nomad_conf.region | default('global') }}.nomad" ]]
[[ .CA ]]
[[ .Cert ]]
[[ .Key ]]
[[ .Cert | writeToFile "{{ nomad_root_dir }}/tls/cli.crt" "root" "root" "0644" ]]
[[ .Key | writeToFile "{{ nomad_root_dir }}/tls/cli.key" "root" "root" "0640" ]]
[[ end ]]

3
roles/nomad/templates/cli_cert.tpl.j2
View File

@@ -1,3 +0,0 @@
[[ with secret "{{ nomad_vault_secrets.pki.path }}/issue/{{ nomad_vault_secrets.pki.role }}" "common_name=cli-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ nomad_conf.region | default('global') }}.nomad" ]]
[[ .Data.{{ item.what }} ]]
[[ end ]]

72
roles/nomad/templates/consul-template.hcl.j2
View File

@@ -4,92 +4,40 @@ vault {
unwrap_token = false
}
# Sleep 10 sec before sending nomad service a reload to prevent it from crashing as
# Sleep 25 sec before sending nomad service a reload to prevent it from crashing as
# Nomad doesn't support getting a reload while it's still initializing
{% if nomad_vault_secrets.pki.enabled %}
template {
source = "{{ nomad_root_dir }}/consul-template/agent.crt.tpl"
source = "{{ nomad_root_dir }}/consul-template/agent_bundle.pem.tpl"
left_delimiter = "[["
right_delimiter = "]]"
destination = "{{ nomad_conf.tls.cert_file }}"
perms = 0644
exec {
command = "sh -c 'sleep 10 && systemctl reload nomad || true'"
}
}
template {
source = "{{ nomad_root_dir }}/consul-template/agent.key.tpl"
left_delimiter = "[["
right_delimiter = "]]"
destination = "{{ nomad_conf.tls.key_file }}"
destination = "{{ nomad_root_dir }}/tls/agent_bundle.pem"
perms = 0640
exec {
command = ["sh", "-c", "chgrp {{ nomad_user }} {{ nomad_conf.tls.key_file }} && sleep 10 && systemctl reload nomad || true"]
}
}
template {
source = "{{ nomad_root_dir }}/consul-template/ca.crt.tpl"
left_delimiter = "[["
right_delimiter = "]]"
destination = "{{ nomad_conf.tls.ca_file }}"
perms = 0644
exec {
command = "sh -c 'sleep 10 && systemctl reload nomad || true'"
command = "sh -c 'sleep 25 && systemctl reload nomad || true'"
}
}
{% if nomad_conf.server.enabled %}
template {
source = "{{ nomad_root_dir }}/consul-template/cli.crt.tpl"
source = "{{ nomad_root_dir }}/consul-template/cli_bundle.pem.tpl"
destination = "{{ nomad_root_dir }}/tls/cli_bundle.pem"
left_delimiter = "[["
right_delimiter = "]]"
destination = "{{ nomad_root_dir }}/tls/cli.crt"
}
template {
source = "{{ nomad_root_dir }}/consul-template/cli.key.tpl"
left_delimiter = "[["
right_delimiter = "]]"
destination = "{{ nomad_root_dir }}/tls/cli.key"
perms = 0640
}
{% endif %}
{% endif %}
{% if nomad_vault_secrets.consul_pki.enabled and nomad_conf.consul.ssl %}
template {
source = "{{ nomad_root_dir }}/consul-template/consul.crt.tpl"
source = "{{ nomad_root_dir }}/consul-template/consul_bundle.pem.tpl"
destination = "{{ nomad_root_dir }}/tlc/consul_bundle.pem"
left_delimiter = "[["
right_delimiter = "]]"
destination = "{{ nomad_conf.consul.cert_file }}"
exec {
command = "sh -c 'sleep 10 && systemctl reload nomad || true'"
}
}
template {
source = "{{ nomad_root_dir }}/consul-template/consul.key.tpl"
left_delimiter = "[["
right_delimiter = "]]"
destination = "{{ nomad_conf.consul.key_file }}"
perms = 0640
exec {
command = "sh -c 'sleep 10 && systemctl reload nomad || true'"
}
}
template {
source = "{{ nomad_root_dir }}/consul-template/consul_ca.crt.tpl"
left_delimiter = "[["
right_delimiter = "]]"
destination = "{{ nomad_conf.consul.ca_file }}"
perms = 0644
exec {
command = "sh -c 'sleep 10 && systemctl reload nomad || true'"
command = "sh -c 'sleep 25 && systemctl reload nomad || true'"
}
}
{% endif %}
{% endif %}

11
roles/nomad/templates/consul_bundle.pem.tpl.j2 Normal file
View File

@@ -0,0 +1,11 @@
[[ with pkiCert "{{ nomad_vault_secrets.consul_pki.path }}/issue/{{ nomad_vault_secrets.consul_pki.role }}" "common_name={{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ (consul_conf is defined and consul_conf.domain is defined) | ternary(consul_conf.domain, 'consul') }}"{% if nomad_vault_secrets.consul_pki.ttl is defined %} "ttl={{ nomad_vault_secrets.consul_pki.ttl }}"{% endif %} ]]
[[ .CA ]]
[[ .Cert ]]
[[ .Key ]]
[[ .CA | writeToFile "{{ nomad_conf.consul.ca_file }}" "root" "root" "0644" ]]
[[ .Cert | writeToFile "{{ nomad_conf.consul.cert_file }}" "root" "root" "0644" ]]
[[ .Key | writeToFile "{{ nomad_conf.consul.key_file }}" "root" "{{ nomad_user }}" "0640" ]]
[[ end ]]
[[ with secret "{{ nomad_vault_secrets.consul_pki.root_path }}/cert/ca" ]]
[[ .Data.certificate | writeToFile "{{ nomad_conf.consul.ca_file }}" "root" "root" "0644" "append,newline" ]]
[[ end ]]

8
roles/nomad/templates/consul_cert.tpl.j2
View File

@@ -1,8 +0,0 @@
[[ with secret "{{ nomad_vault_secrets.consul_pki.path }}/issue/{{ nomad_vault_secrets.consul_pki.role }}" "common_name={{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ (consul_conf is defined and consul_conf.domain is defined) | ternary(consul_conf.domain, 'consul') }}"{% if nomad_vault_secrets.consul_pki.ttl is defined %} "ttl={{ nomad_vault_secrets.consul_pki.ttl }}"{% endif %} ]]
[[ .Data.{{ item.what }} ]]
[[ end ]]
{% if item.what == 'issuing_ca' %}
[[ with secret "{{ nomad_vault_secrets.consul_pki.root_path }}/cert/ca" ]]
[[ .Data.certificate ]]
[[ end ]]
{% endif %}

1
roles/nomad/templates/nomad.service.j2
View File

@@ -18,7 +18,6 @@ User={{ nomad_user }}
Group={{ nomad_user }}
ExecStart={{ nomad_root_dir }}/bin/nomad agent -config={{ nomad_root_dir }}/etc/
ExecReload=/bin/kill --signal HUP $MAINPID
SuccessExitStatus=1
Restart=on-failure
LimitNOFILE=65536
LimitNPROC=infinity