60 lines
2.2 KiB
YAML
60 lines
2.2 KiB
YAML
---
|
|
# 只读收敛入口；秘密首次创建、删除或轮换不放进 site.yml。
|
|
- name: 在任何主机变更前读取并校验已有凭据
|
|
hosts: localhost
|
|
connection: local
|
|
gather_facts: false
|
|
tasks:
|
|
- name: 要求有效的显式 Bao 身份
|
|
ansible.builtin.assert:
|
|
that:
|
|
- pg_bao_token | length > 0
|
|
- pg_bao_url is match('^https://')
|
|
no_log: true
|
|
- name: 读取两个实例的管理凭据
|
|
ansible.builtin.uri:
|
|
url: "{{ pg_bao_url }}/v1/kv/data/{{ pg_secret_paths[item] }}"
|
|
headers:
|
|
X-Vault-Token: "{{ pg_bao_token }}"
|
|
status_code: 200
|
|
loop: [prod, dev]
|
|
register: pg_secret_response
|
|
no_log: true
|
|
- name: 整理并验证凭据结构
|
|
ansible.builtin.set_fact:
|
|
pg_loaded_credentials: "{{ pg_loaded_credentials | default({}) | combine({item.item: item.json.data.data}) }}"
|
|
loop: "{{ pg_secret_response.results }}"
|
|
no_log: true
|
|
- name: 拒绝缺失或短密码
|
|
ansible.builtin.assert:
|
|
that:
|
|
- pg_loaded_credentials[item].superuser_password | length >= 32
|
|
- pg_loaded_credentials[item].ayatori_password | length >= 32
|
|
- pg_loaded_credentials[item].ayatori_username == 'ayatori'
|
|
loop: [prod, dev]
|
|
no_log: true
|
|
- name: 校验生产复制与 API 凭据
|
|
ansible.builtin.assert:
|
|
that:
|
|
- pg_loaded_credentials.prod.replication_password | length >= 32
|
|
- pg_loaded_credentials.prod.rest_password | length >= 32
|
|
no_log: true
|
|
- name: 读取已有 etcd 消费者凭据
|
|
ansible.builtin.uri:
|
|
url: "{{ pg_bao_url }}/v1/kv/data/{{ pg_etcd_secret_path }}"
|
|
headers:
|
|
X-Vault-Token: "{{ pg_bao_token }}"
|
|
status_code: 200
|
|
register: pg_etcd_response
|
|
no_log: true
|
|
- name: 校验 etcd prefix 并交付内存引用
|
|
ansible.builtin.assert:
|
|
that:
|
|
- pg_etcd_response.json.data.data.username == 'patroni-pg-prod'
|
|
- pg_etcd_response.json.data.data.prefix == '/homelab/patroni/pg-prod/'
|
|
no_log: true
|
|
- name: 保存短生命周期内存引用
|
|
ansible.builtin.set_fact:
|
|
pg_loaded_etcd: "{{ pg_etcd_response.json.data.data }}"
|
|
no_log: true
|