salt/ansible
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Use a well-known vault password file location

Browse Source 
I caved
This commit is contained in:
Salt 2022-07-23 18:04:15 -05:00
parent 448588357f
commit a09cd9dab2
2 changed files with 12 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
.gitlab-ci.yml
View File

@ -17,9 +17,9 @@ before_script:
- mkdir -p ~/.ssh - mkdir -p ~/.ssh
- chmod -R 0700 ~/.ssh - chmod -R 0700 ~/.ssh
# Dump the vault password # Dump the vault password
- touch /vaultpw - touch ~/.vault_pass
- chmod 0600 /vaultpw - chmod 0600 ~/.vault_pass
- echo "$ANSIBLE_VAULT_PASSWORD" > /vaultpw - echo "$ANSIBLE_VAULT_PASSWORD" > ~/.vault_pass
# Fix perms on the playbook root # Fix perms on the playbook root
- chmod -R 0750 . - chmod -R 0750 .
# Join the Zerotier management network # Join the Zerotier management network
@ -61,7 +61,7 @@ Test:
except: except:
- pipelines - pipelines
script: script:
- ansible-playbook --skip-tags no-test,no-auto -C site.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw || error="$?" - ansible-playbook --skip-tags no-test,no-auto -C site.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file ~/.vault_pass || error="$?"
- if [ "$error" -eq 4 ]; then echo "Some hosts were unreachable; masking error"; unset error; fi - if [ "$error" -eq 4 ]; then echo "Some hosts were unreachable; masking error"; unset error; fi
- if [ -n "$error" ]; then echo "Return code $error"; false; fi - if [ -n "$error" ]; then echo "Return code $error"; false; fi
@ -69,29 +69,29 @@ Test:
Local: Local:
stage: play-pre stage: play-pre
script: script:
- ansible-playbook --skip-tags no-auto playbooks/site_local.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw - ansible-playbook --skip-tags no-auto playbooks/site_local.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file ~/.vault_pass
Pre: Pre:
stage: play-pre stage: play-pre
script: script:
- ansible-playbook --skip-tags no-auto playbooks/site_pre.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw - ansible-playbook --skip-tags no-auto playbooks/site_pre.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file ~/.vault_pass
# MAIN CONFIGURATION # MAIN CONFIGURATION
Main: Main:
stage: play-main stage: play-main
script: script:
- ansible-playbook --skip-tags no-auto playbooks/site_main.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw - ansible-playbook --skip-tags no-auto playbooks/site_main.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file ~/.vault_pass
Common: Common:
stage: play-main stage: play-main
script: script:
- ansible-playbook --skip-tags no-auto playbooks/site_common.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw - ansible-playbook --skip-tags no-auto playbooks/site_common.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file ~/.vault_pass
Nagios: Nagios:
stage: play-main stage: play-main
retry: 1 retry: 1
script: script:
- ansible-playbook -l vm-general-1.ashburn.mgmt.desu.ltd playbooks/prod_web.yml --tags nagios --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw - ansible-playbook -l vm-general-1.ashburn.mgmt.desu.ltd playbooks/prod_web.yml --tags nagios --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file ~/.vault_pass
# CLEANUP # CLEANUP
Cleanup: Cleanup:
stage: play-post stage: play-post
script: script:
- ansible-playbook --skip-tags no-auto playbooks/site_post.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw - ansible-playbook --skip-tags no-auto playbooks/site_post.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file ~/.vault_pass

2
ansible.cfg
View File

@ -29,6 +29,8 @@ system_warnings = true
# We set this to avoid circumstances in which we time out waiting for a privesc # We set this to avoid circumstances in which we time out waiting for a privesc
# prompt. Zerotier, as a management network, can be a bit slow at times. # prompt. Zerotier, as a management network, can be a bit slow at times.
timeout = 60 timeout = 60
# Bad
vault_password_file = ~/.vault_pass
[diff] [diff]
always = true always = true