47 lines
1.9 KiB
YAML
47 lines
1.9 KiB
YAML
---
|
|
- name: 核对秘密元数据（非 404 错误不能视为不存在）
|
|
ansible.builtin.uri:
|
|
url: "{{ pg_bao_url }}/v1/kv/metadata/{{ pg_secret_paths[pg_secret_instance] }}"
|
|
headers:
|
|
X-Vault-Token: "{{ pg_bao_token }}"
|
|
status_code: [200, 404]
|
|
register: pg_secret_metadata
|
|
no_log: true
|
|
- name: 明确不存在时创建一次
|
|
when: pg_secret_metadata.status == 404
|
|
block:
|
|
- name: 拒绝为已有实例重造丢失秘密
|
|
ansible.builtin.assert:
|
|
that: >-
|
|
groups['pg_hosts'] | map('extract', hostvars, 'pg_has_data')
|
|
| select('equalto', true) | list | length == 0
|
|
- name: 随机生成只在本次执行内存存在的值
|
|
ansible.builtin.set_fact:
|
|
pg_new_secret:
|
|
ayatori_username: ayatori
|
|
ayatori_password: "{{ lookup('password', '/dev/null', length=48, chars=['ascii_letters', 'digits']) }}"
|
|
superuser_password: "{{ lookup('password', '/dev/null', length=48, chars=['ascii_letters', 'digits']) }}"
|
|
replication_password: "{{ lookup('password', '/dev/null', length=48, chars=['ascii_letters', 'digits']) }}"
|
|
rest_password: "{{ lookup('password', '/dev/null', length=48, chars=['ascii_letters', 'digits']) }}"
|
|
no_log: true
|
|
- name: 使用 KV v2 CAS=0 防覆盖写入
|
|
ansible.builtin.uri:
|
|
url: "{{ pg_bao_url }}/v1/kv/data/{{ pg_secret_paths[pg_secret_instance] }}"
|
|
method: POST
|
|
headers:
|
|
X-Vault-Token: "{{ pg_bao_token }}"
|
|
body_format: json
|
|
body:
|
|
options: {cas: 0}
|
|
data: "{{ pg_new_secret }}"
|
|
status_code: 200
|
|
changed_when: true
|
|
no_log: true
|
|
- name: 确认已有秘密数据可读，软删除必须失败
|
|
ansible.builtin.uri:
|
|
url: "{{ pg_bao_url }}/v1/kv/data/{{ pg_secret_paths[pg_secret_instance] }}"
|
|
headers:
|
|
X-Vault-Token: "{{ pg_bao_token }}"
|
|
status_code: 200
|
|
no_log: true
|