3153f27c24
I wasn't correctly sourcing the key; it has to come from hostvars as it is in a different play on different hosts. This fixes it. We also need to not have the base roles overwrite the authorized_keys file each time. The key we provision can only run a limited script that wraps "vos release". Unfortunately our gitops falls down a bit here because we don't have full testing for the AFS servers; put this on the todo list :) I have run this manually for testing. Change-Id: I0995434bde7e43082c01daa331c4b8b268d9b4bc
21 lines
608 B
YAML
21 lines
608 B
YAML
- name: Install vos release script
|
|
copy:
|
|
src: vos_release.sh
|
|
dest: '/usr/local/bin/'
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
|
|
- name: Ensure update key
|
|
assert:
|
|
that:
|
|
- hostvars[item]['vos_release_keypair'] is defined
|
|
with_inventory_hostnames: mirror-update
|
|
|
|
- name: Install vos release key
|
|
authorized_key:
|
|
user: 'root'
|
|
state: present
|
|
key: '{{ hostvars[item]["vos_release_keypair"]["public_key"] }}'
|
|
key_options: 'command="/usr/local/bin/vos_release.sh",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty'
|
|
with_inventory_hostnames: mirror-update |