38 lines
1.5 KiB
YAML
38 lines
1.5 KiB
YAML
---
|
|
- name: 读取独立管理凭据元数据
|
|
ansible.builtin.uri:
|
|
url: "{{ pg_bao_url }}/v1/kv/metadata/infra/postgresql/ayatori/{{ pg_ayatori_instance }}"
|
|
headers: {X-Vault-Token: "{{ pg_bao_token }}"}
|
|
status_code: [200, 404]
|
|
register: pg_admin_metadata
|
|
no_log: true
|
|
- name: 只在明确缺失时写入独立的用户名密码
|
|
ansible.builtin.uri:
|
|
url: "{{ pg_bao_url }}/v1/kv/data/infra/postgresql/ayatori/{{ pg_ayatori_instance }}"
|
|
method: POST
|
|
headers: {X-Vault-Token: "{{ pg_bao_token }}"}
|
|
body_format: json
|
|
body:
|
|
options: {cas: 0}
|
|
data:
|
|
username: "{{ pg_loaded_credentials[pg_ayatori_instance].ayatori_username }}"
|
|
password: "{{ pg_loaded_credentials[pg_ayatori_instance].ayatori_password }}"
|
|
status_code: 200
|
|
when: pg_admin_metadata.status == 404
|
|
changed_when: true
|
|
no_log: true
|
|
- name: 回读已有管理凭据
|
|
ansible.builtin.uri:
|
|
url: "{{ pg_bao_url }}/v1/kv/data/infra/postgresql/ayatori/{{ pg_ayatori_instance }}"
|
|
headers: {X-Vault-Token: "{{ pg_bao_token }}"}
|
|
status_code: 200
|
|
register: pg_admin_readback
|
|
no_log: true
|
|
- name: 不隐式覆盖或轮换不一致凭据
|
|
ansible.builtin.assert:
|
|
that:
|
|
- pg_admin_readback.json.data.data.keys() | sort == ['password', 'username']
|
|
- pg_admin_readback.json.data.data.username == pg_loaded_credentials[pg_ayatori_instance].ayatori_username
|
|
- pg_admin_readback.json.data.data.password == pg_loaded_credentials[pg_ayatori_instance].ayatori_password
|
|
no_log: true
|