Update to 2023-07-08 16:00

roles/vault_agent/templates/nomad/agent_bundle.pem.tpl.j2

@@ -0,0 +1,10 @@
+[[ with pkiCert "{{ vault_agent_nomad.nomad_pki.path }}/issue/{{ vault_agent_nomad.nomad_pki.role }}" "common_name={{ (nomad_conf.server.enabled) | ternary('server', 'client') }}-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ nomad_conf.region | default('global') }}.nomad" "alt_names=localhost,{{ (nomad_conf.server.enabled) | ternary('server', 'client') }}.{{ nomad_conf.region | default('global') }}.nomad{% if nomad_conf.server.enabled and nomad_conf.client.enabled %},client.{{ nomad_conf.region | default('global') }}.nomad{% endif %}{% if consul_conf is defined %},nomad{{ nomad_conf.server.enabled | ternary('', '-client') }}.service.{{ consul_conf.domain | default('consul') }}{% if consul_conf is defined and consul_conf.alt_domain is defined %},nomad{{ nomad_conf.server.enabled | ternary('', '-client') }}.service.{{ consul_conf.alt_domain }}{% endif %}{% endif %}"{% if nomad_vault_secrets.pki.ttl is defined %} "ttl={{ vault_agent_nomad.nomad_pki.ttl }}"{% endif %} ]]
+[[ .CA ]]
+[[ .Cert ]]
+[[ .Key ]]
+[[ .Cert | writeToFile "{{ nomad_conf.tls.cert_file }}" "{{ nomad_user }}" "{{ nomad_user }}" "0644" ]]
+[[ .Key | writeToFile "{{ nomad_conf.tls.key_file }}" "{{ nomad_user }}" "{{ nomad_user }}" "0640" ]]
+[[ end ]]
+[[ with secret "{{ vault_agent_nomad.nomad_pki.path }}/cert/ca_chain" ]]
+[[ .Data.certificate | writeToFile "{{ nomad_conf.tls.ca_file }}" "{{ nomad_user }}" "{{ nomad_user }}" "0644" ]]
+[[ end ]]

roles/vault_agent/templates/nomad/cli_bundle.pem.tpl.j2

@@ -0,0 +1,6 @@
+[[ with pkiCert "{{ vault_agent_nomad.nomad_pki.path }}/issue/{{ vault_agent_nomad.nomad_pki.role }}" "common_name=cli-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ nomad_conf.region | default('global') }}.nomad" ]]
+[[ .Cert ]]
+[[ .Key ]]
+[[ .Cert | writeToFile "{{ nomad_root_dir }}/tls/cli.crt" "{{ nomad_user }}" "{{ nomad_user }}" "0644" ]]
+[[ .Key | writeToFile "{{ nomad_root_dir }}/tls/cli.key" "{{ nomad_user }}" "{{ nomad_user }}" "0640" ]]
+[[ end ]]

roles/vault_agent/templates/nomad/consul.env.tpl.j2

@@ -0,0 +1,3 @@
+[[- with secret "{{ vault_agent_nomad.consul_token.path }}/creds/{{ vault_agent_nomad.consul_token.role }}" -]]
+CONSUL_HTTP_TOKEN=[[ .Data.token ]]
+[[- end -]]

roles/vault_agent/templates/nomad/consul_bundle.pem.tpl.j2

@@ -0,0 +1,10 @@
+[[ with pkiCert "{{ vault_agent_nomad.consul_pki.path }}/issue/{{ vault_agent_nomad.consul_pki.role }}" "common_name={{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ (consul_conf is defined and consul_conf.domain is defined) | ternary(consul_conf.domain, 'consul') }}"{% if vault_agent_nomad.consul_pki.ttl is defined %} "ttl={{ vault_agent_nomad.consul_pki.ttl }}"{% endif %} ]]
+[[ .CA ]]
+[[ .Cert ]]
+[[ .Key ]]
+[[ .Cert | writeToFile "{{ nomad_conf.consul.cert_file }}" "{{ nomad_user }}" "{{ nomad_user }}" "0644" ]]
+[[ .Key | writeToFile "{{ nomad_conf.consul.key_file }}" "{{ nomad_user }}" "{{ nomad_user }}" "0640" ]]
+[[ end ]]
+[[ with secret "{{ vault_agent_nomad.consul_pki.path }}/cert/ca_chain" ]]
+[[ .Data.certificate | writeToFile "{{ nomad_conf.consul.ca_file }}" "{{ nomad_user }}" "{{ nomad_user }}" "0644" ]]
+[[ end ]]

roles/vault_agent/templates/nomad/nomad.hcl.j2

@@ -0,0 +1,69 @@
+{% if vault_agent_nomad.vault_token.enabled %}
+template {
+  source          = "{{ vault_agent_root_dir }}/templates/nomad/vault.env.tpl"
+  destination     = "/run/nomad/vault.env"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  perms           = 0640
+  exec {
+    # Wait a few sec before reloading Nomad as it fails if reloaded while not fully initialized yet
+    command = ["chown", ":{{ nomad_user }}", "/run/nomad/vault.env"]
+  }
+}
+{% endif %}
+
+{% if vault_agent_nomad.nomad_pki.enabled %}
+template {
+  source          = "{{ vault_agent_root_dir }}/templates/nomad/agent_bundle.pem.tpl"
+  destination     = "{{ nomad_root_dir }}/tls/agent_bundle.pem"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  perms           = 0640
+  exec {
+    # Wait a few sec before reloading Nomad as it fails if reloaded while not fully initialized yet
+    command = ["sh", "-c", "sleep 15 && systemctl reload nomad || true"]
+  }
+}
+
+{% if nomad_conf.server.enabled %}
+template {
+  source          = "{{ vault_agent_root_dir }}/templates/nomad/cli_bundle.pem.tpl"
+  destination     = "{{ nomad_root_dir }}/tls/cli_bundle.pem"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  perms           = 0640
+{% if vault_agent_nomad.nomad_pki.cli.enabled and vault_agent_nomad.nomad_pki.cli.secret_path is defined %}
+  exec {
+    command = "{{ vault_agent_root_dir }}/bin/update_nomad_cert.sh"
+  }
+{% endif %}
+}
+{% endif %}
+{% endif %}
+
+
+{% if vault_agent_nomad.consul_pki.enabled and nomad_conf.consul.ssl %}
+template {
+  source          = "{{ vault_agent_root_dir }}/templates/nomad/consul_bundle.pem.tpl"
+  destination     = "{{ nomad_root_dir }}/tls/consul_bundle.pem"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  perms           = 0640
+  exec {
+    command = ["sh", "-c", "chown :{{ nomad_user }} && sleep 15 && systemctl reload nomad || true"]
+  }
+}
+{% endif %}
+
+{% if vault_agent_nomad.consul_token.enabled %}
+template {
+  source          = "{{ vault_agent_root_dir }}/templates/nomad/consul.env.tpl"
+  destination     = "/run/nomad/consul.env"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  perms           = 0640
+  exec {
+    command = ["chown", ":{{ nomad_user}}", "/run/nomad/consul.env"]
+  }
+}
+{% endif %}

roles/vault_agent/templates/nomad/update_nomad_cert.sh.j2

@@ -0,0 +1,20 @@
+#!/bin/sh
+  
+set -eo pipefail
+
+VAULT_ADDR={{ vault_agent_vault_address }}
+VAULT_STATUS=$(vault status -format=json)
+
+if [ "$(echo ${VAULT_STATUS} | jq .is_self)" != "true" ]; then
+  echo "We're not the active vault, exiting"
+elif [ "$(echo ${VAULT_STATUS} | jq .sealed)" != "false" ]; then
+  echo "Vault is sealed, exiting"
+elif [ "$(echo ${VAULT_STATUS} | jq .initialized)" != "true" ]; then
+  echo "Vault is not initialized yet, exiting"
+else
+  echo Updating Vault certificate to access Nomad API
+  vault write {{ vault_agent_nomad.nomad_pki.cli.secret_path }}/config/access \
+    ca_cert="$(cat {{ nomad_root_dir }}/tls/ca.crt)" \
+    client_cert="$(cat {{ nomad_root_dir }}/tls/cli.crt)" \
+    client_key="$(cat {{ nomad_root_dir }}/tls/cli.key)"
+fi

roles/vault_agent/templates/nomad/vault.env.tpl.j2

@@ -0,0 +1,3 @@
+[[- with secret "auth/token/create/{{ vault_agent_nomad.vault_token.role }}" "no_parent=true" -]]
+VAULT_TOKEN=[[ .Auth.ClientToken ]]
+[[- end -]]