Skip to content

Commit 0d71b80

Browse files
jackhodgkissjackhodgkiss
committed
ci: use hashivault_read to get certificate 
1 parent 10841ee commit 0d71b80

File tree

1 file changed

+134
-133
lines changed

1 file changed

+134
-133
lines changed

‎tests/test_vault_raft_migration.yml

Lines changed: 134 additions & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -9,144 +9,144 @@
99
vault_set_keys_fact: true
1010
vault_write_keys_file: true
1111
tasks:
12-
- name: Ensure /etc/vault exists
13-
file:
14-
path: /etc/vault
15-
state: directory
16-
mode: "0700"
17-
become: true
12+
# - name: Ensure /etc/vault exists
13+
# file:
14+
# path: /etc/vault
15+
# state: directory
16+
# mode: "0700"
17+
# become: true
1818

19-
- name: Include vault role
20-
include_role:
21-
name: vault
19+
# - name: Include vault role
20+
# include_role:
21+
# name: vault
2222

23-
- name: Include vault role (idempotence test)
24-
include_role:
25-
name: vault
23+
# - name: Include vault role (idempotence test)
24+
# include_role:
25+
# name: vault
2626

2727
- name: Include Vault keys
2828
ansible.builtin.include_vars:
2929
file: "vault-keys.json"
3030
name: vault_keys
3131

32-
- name: Unseal vault
33-
include_role:
34-
name: vault_unseal
35-
vars:
36-
vault_unseal_keys: "{{ vault_keys.keys_base64 }}"
37-
38-
- name: Configure PKI - create root/intermediate and generate certificates
39-
vars:
40-
vault_pki_certificate_subject:
41-
- role: 'ServerCert'
42-
common_name: "OS-CERT-TEST"
43-
extra_params:
44-
ttl: "8760h"
45-
ip_sans: "127.0.0.1"
46-
alt_names: "example.com"
47-
exclude_cn_from_sans: true
48-
vault_pki_certificates_directory: "/tmp/"
49-
vault_pki_generate_certificates: true
50-
vault_pki_intermediate_ca_name: "OS-TLS-INT"
51-
vault_pki_intermediate_create: true
52-
vault_pki_intermediate_roles:
53-
- name: "ServerCert"
54-
config:
55-
max_ttl: 8760h
56-
ttl: 8760h
57-
allow_any_name: true
58-
allow_ip_sans: true
59-
require_cn: false
60-
server_flag: true
61-
key_type: rsa
62-
key_bits: 4096
63-
country: ["UK"]
64-
locality: ["Bristol"]
65-
organization: ["StackHPC"]
66-
ou: ["HPC"]
67-
vault_pki_root_ca_name: "OS-TLS-ROOT"
68-
vault_pki_root_create: true
69-
vault_pki_write_certificate_files: true
70-
vault_pki_write_int_ca_to_file: true
71-
vault_pki_write_pem_bundle: false
72-
vault_pki_write_root_ca_to_file: true
73-
vault_token: "{{ vault_keys.root_token }}"
74-
block:
75-
- name: Configure PKI - create root/intermediate and generate certificates
76-
include_role:
77-
name: vault_pki
78-
79-
- name: Configure PKI - create root/intermediate and generate certificates (idempotence test)
80-
include_role:
81-
name: vault_pki
82-
83-
- name: Configure PKI - generate certificate pem bundle
84-
vars:
85-
vault_pki_certificate_subject:
86-
- role: 'ServerCert'
87-
common_name: "OS-CERT-TEST2"
88-
extra_params:
89-
ttl: "8760h"
90-
ip_sans: "192.168.38.72"
91-
exclude_cn_from_sans: true
92-
vault_pki_certificates_directory: "/tmp/"
93-
vault_pki_generate_certificates: true
94-
vault_pki_intermediate_ca_name: "OS-TLS-INT"
95-
vault_pki_intermediate_create: false
96-
vault_pki_root_ca_name: "OS-TLS-ROOT"
97-
vault_pki_root_create: false
98-
vault_pki_write_certificate_files: true
99-
vault_pki_write_pem_bundle: true
100-
vault_token: "{{ vault_keys.root_token }}"
101-
block:
102-
- name: Configure PKI - generate certificate pem bundle
103-
include_role:
104-
name: vault_pki
105-
106-
- name: Configure PKI - generate certificate pem bundle (idempotence test)
107-
include_role:
108-
name: vault_pki
109-
110-
- name: Validate if certificates exist
111-
stat:
112-
path: "/tmp/{{ item }}"
113-
register: stat_result
114-
failed_when: not stat_result.stat.exists
115-
loop:
116-
- OS-CERT-TEST.crt
117-
- OS-CERT-TEST2.pem
118-
119-
- name: Concatenate CAs
120-
shell: |
121-
cat /tmp/OS-TLS-ROOT.pem /tmp/OS-TLS-INT.crt > /tmp/CA-CHAIN.pem
122-
args:
123-
executable: /bin/bash
124-
become: true
125-
changed_when: true
126-
127-
- name: Verify certificate chain
128-
command: |
129-
openssl verify -CAfile /tmp/CA-CHAIN.pem
130-
/tmp/{{ item }}
131-
register: verify_result
132-
failed_when: verify_result.rc != 0
133-
loop:
134-
- OS-CERT-TEST.crt
135-
- OS-CERT-TEST2.pem
136-
changed_when: false
137-
138-
- name: Migrate vault to raft
139-
include_role:
140-
name: vault
141-
vars:
142-
vault_storage_type: raft
143-
vault_migrate_consul_to_raft: true
144-
145-
- name: Unseal vault
146-
include_role:
147-
name: vault_unseal
148-
vars:
149-
vault_unseal_keys: "{{ vault_keys.keys_base64 }}"
32+
# - name: Unseal vault
33+
# include_role:
34+
# name: vault_unseal
35+
# vars:
36+
# vault_unseal_keys: "{{ vault_keys.keys_base64 }}"
37+
38+
# - name: Configure PKI - create root/intermediate and generate certificates
39+
# vars:
40+
# vault_pki_certificate_subject:
41+
# - role: 'ServerCert'
42+
# common_name: "OS-CERT-TEST"
43+
# extra_params:
44+
# ttl: "8760h"
45+
# ip_sans: "127.0.0.1"
46+
# alt_names: "example.com"
47+
# exclude_cn_from_sans: true
48+
# vault_pki_certificates_directory: "/tmp/"
49+
# vault_pki_generate_certificates: true
50+
# vault_pki_intermediate_ca_name: "OS-TLS-INT"
51+
# vault_pki_intermediate_create: true
52+
# vault_pki_intermediate_roles:
53+
# - name: "ServerCert"
54+
# config:
55+
# max_ttl: 8760h
56+
# ttl: 8760h
57+
# allow_any_name: true
58+
# allow_ip_sans: true
59+
# require_cn: false
60+
# server_flag: true
61+
# key_type: rsa
62+
# key_bits: 4096
63+
# country: ["UK"]
64+
# locality: ["Bristol"]
65+
# organization: ["StackHPC"]
66+
# ou: ["HPC"]
67+
# vault_pki_root_ca_name: "OS-TLS-ROOT"
68+
# vault_pki_root_create: true
69+
# vault_pki_write_certificate_files: true
70+
# vault_pki_write_int_ca_to_file: true
71+
# vault_pki_write_pem_bundle: false
72+
# vault_pki_write_root_ca_to_file: true
73+
# vault_token: "{{ vault_keys.root_token }}"
74+
# block:
75+
# - name: Configure PKI - create root/intermediate and generate certificates
76+
# include_role:
77+
# name: vault_pki
78+
79+
# - name: Configure PKI - create root/intermediate and generate certificates (idempotence test)
80+
# include_role:
81+
# name: vault_pki
82+
83+
# - name: Configure PKI - generate certificate pem bundle
84+
# vars:
85+
# vault_pki_certificate_subject:
86+
# - role: 'ServerCert'
87+
# common_name: "OS-CERT-TEST2"
88+
# extra_params:
89+
# ttl: "8760h"
90+
# ip_sans: "192.168.38.72"
91+
# exclude_cn_from_sans: true
92+
# vault_pki_certificates_directory: "/tmp/"
93+
# vault_pki_generate_certificates: true
94+
# vault_pki_intermediate_ca_name: "OS-TLS-INT"
95+
# vault_pki_intermediate_create: false
96+
# vault_pki_root_ca_name: "OS-TLS-ROOT"
97+
# vault_pki_root_create: false
98+
# vault_pki_write_certificate_files: true
99+
# vault_pki_write_pem_bundle: true
100+
# vault_token: "{{ vault_keys.root_token }}"
101+
# block:
102+
# - name: Configure PKI - generate certificate pem bundle
103+
# include_role:
104+
# name: vault_pki
105+
106+
# - name: Configure PKI - generate certificate pem bundle (idempotence test)
107+
# include_role:
108+
# name: vault_pki
109+
110+
# - name: Validate if certificates exist
111+
# stat:
112+
# path: "/tmp/{{ item }}"
113+
# register: stat_result
114+
# failed_when: not stat_result.stat.exists
115+
# loop:
116+
# - OS-CERT-TEST.crt
117+
# - OS-CERT-TEST2.pem
118+
119+
# - name: Concatenate CAs
120+
# shell: |
121+
# cat /tmp/OS-TLS-ROOT.pem /tmp/OS-TLS-INT.crt > /tmp/CA-CHAIN.pem
122+
# args:
123+
# executable: /bin/bash
124+
# become: true
125+
# changed_when: true
126+
127+
# - name: Verify certificate chain
128+
# command: |
129+
# openssl verify -CAfile /tmp/CA-CHAIN.pem
130+
# /tmp/{{ item }}
131+
# register: verify_result
132+
# failed_when: verify_result.rc != 0
133+
# loop:
134+
# - OS-CERT-TEST.crt
135+
# - OS-CERT-TEST2.pem
136+
# changed_when: false
137+
138+
# - name: Migrate vault to raft
139+
# include_role:
140+
# name: vault
141+
# vars:
142+
# vault_storage_type: raft
143+
# vault_migrate_consul_to_raft: true
144+
145+
# - name: Unseal vault
146+
# include_role:
147+
# name: vault_unseal
148+
# vars:
149+
# vault_unseal_keys: "{{ vault_keys.keys_base64 }}"
150150

151151
- name: Validate vault is using raft
152152
ansible.builtin.command: >
@@ -163,9 +163,10 @@
163163
success_msg: "Vault is using raft storage backend"
164164

165165
- name: Read CA certificate from vault
166-
community.hashi_vault.vault_read:
166+
hashivault_read:
167167
url: http://127.0.0.1:8200
168-
path: OS-TLS-ROOT/cert/ca
168+
mount_point: OS-TLS-ROOT
169+
secret: cert/ca
169170
token: "{{ vault_keys.root_token }}"
170171
register: vault_ca_cert
171172

@@ -177,6 +178,6 @@
177178
- name: Validate ROOT CA
178179
ansible.builtin.assert:
179180
that:
180-
- vault_ca_cert.data.data.certificate == (ca_chain.content | b64decode).rstrip('\n')
181+
- vault_ca_cert.value.certificate == (ca_chain.content | b64decode).rstrip('\n')
181182
fail_msg: "ROOT CA certificate do not match"
182183
success_msg: "ROOT CA certificate do match"

0 commit comments

Comments
 (0)