130 lines
4.2 KiB
YAML
130 lines
4.2 KiB
YAML
---
|
|
- name: Create working directory
|
|
file:
|
|
path: "{{ lunasa_client_working_dir }}"
|
|
state: directory
|
|
mode: 0755
|
|
|
|
- name: Download Lunasa client tarball
|
|
get_url:
|
|
url: "{{ lunasa_client_tarball_location }}"
|
|
dest: "{{ lunasa_client_working_dir }}/{{ lunasa_client_tarball_name }}"
|
|
force: no
|
|
|
|
- name: Unpack tarball to working directory # noqa 208
|
|
unarchive:
|
|
src: "{{ lunasa_client_working_dir }}/{{ lunasa_client_tarball_name }}"
|
|
dest: "{{ lunasa_client_working_dir }}"
|
|
creates: "{{ lunasa_client_working_dir }}/{{ lunasa_client_installer_path }}"
|
|
remote_src: yes
|
|
|
|
- name: Run the install.sh script
|
|
shell: |
|
|
set -o pipefail && echo y | {{ lunasa_client_working_dir }}/{{ lunasa_client_installer_path }} \
|
|
-p sa -c sdk
|
|
args:
|
|
creates: /usr/lib/libCryptoki2_64.so
|
|
become: true
|
|
|
|
- name: set client facts for fqdn
|
|
set_fact:
|
|
client_name: "{{ ansible_facts['fqdn'] }}"
|
|
client_reg_opt: "-hostname"
|
|
client_host: "{{ ansible_facts['fqdn'] }}"
|
|
client_cert_cn: "{{ inventory_hostname }}"
|
|
when: lunasa_client_ip is undefined
|
|
|
|
- name: set client facts for IP override
|
|
set_fact:
|
|
client_name: "{{ ansible_facts['fqdn'] }}"
|
|
client_reg_opt: "-ip"
|
|
client_host: "{{ lunasa_client_ip }}"
|
|
client_cert_cn: "{{ lunasa_client_ip }}"
|
|
when: lunasa_client_ip is defined
|
|
|
|
- name: Check for existing client cert
|
|
stat:
|
|
path: "/usr/safenet/lunaclient/cert/client/{{ client_cert_cn }}.pem"
|
|
register: client_cert
|
|
|
|
- name: Generate a new client cert for NTL
|
|
command: /usr/safenet/lunaclient/bin/vtl createCert -n "{{ client_cert_cn }}"
|
|
become: true
|
|
register: created_cert
|
|
when: not client_cert.stat.exists or lunasa_client_rotate_cert
|
|
|
|
- name: Note when a new cert is created
|
|
set_fact:
|
|
client_new_cert: "{{ created_cert.changed }}"
|
|
|
|
- name: register the client on each HSM
|
|
include_tasks: register_client.yaml
|
|
vars:
|
|
hsm_hostname: "{{ item.hostname }}"
|
|
hsm_admin_password: "{{ item.admin_password }}"
|
|
hsm_partition: "{{ item.partition }}"
|
|
loop: "{{ lunasa_hsms }}"
|
|
|
|
- name: verify the NTL connection
|
|
command: /usr/safenet/lunaclient/bin/vtl verify
|
|
become: true
|
|
register: vtl_verify
|
|
|
|
- name: Fail if NTL connection doesn't verify
|
|
fail:
|
|
msg: >
|
|
ERROR: 'vtl verify' failed. This is commonly due to network NAT between
|
|
the client and the HSM. Try disabling client IP checking in the HSM
|
|
when: "'Error: Unable to find any Luna SA slots/partitions' in vtl_verify.stdout"
|
|
|
|
- name: create hsm ha partition
|
|
when: lunasa_hsms | length > 1
|
|
become: true
|
|
block:
|
|
- name: create ha partition
|
|
shell: |
|
|
echo 'copy' | /usr/safenet/lunaclient/bin/lunacm -c hagroup createGroup \
|
|
-label {{ lunasa_ha_label }} \
|
|
-serialNumber {{ lunasa_hsms[0].partition_serial }} \
|
|
-password {{ lunasa_client_pin }}
|
|
register: result
|
|
failed_when:
|
|
- "'Command Result : No Error' not in result.stdout"
|
|
- "'for the new group has already been used' not in result.stdout"
|
|
|
|
- name: add other hsms to the ha group
|
|
shell: |
|
|
echo 'copy' | /usr/safenet/lunaclient/bin/lunacm -c hagroup addMember \
|
|
-group {{ lunasa_ha_label }} \
|
|
-serialNumber {{ item.partition_serial }} \
|
|
-password {{ lunasa_client_pin }}
|
|
loop: "{{ lunasa_hsms }}"
|
|
loop_control:
|
|
extended: yes
|
|
when: not ansible_loop.first
|
|
register: result
|
|
failed_when:
|
|
- "'Command Result : No Error' not in result.stdout"
|
|
- "'The member you specified is already part of an' not in result.stdout"
|
|
|
|
- name: Check the HA group
|
|
expect:
|
|
command: /usr/safenet/lunaclient/bin/lunacm -c hagroup listgroups
|
|
responses:
|
|
password: "\r"
|
|
register: result
|
|
failed_when: "'Command Result : No Error' not in result.stdout"
|
|
|
|
- name: Register the HA Slot ID
|
|
shell: |
|
|
set -o pipefail && echo "{{ result.stdout }}" | grep 'HA Group Slot ID' | awk '{ print $NF }'
|
|
register: slot_result
|
|
|
|
- name: Set HA Slot fact for use by the playbook calling this role
|
|
set_fact:
|
|
lunasa_ha_slot: "{{ slot_result.stdout }}"
|
|
|
|
- name: Log the HA Slot ID used
|
|
debug:
|
|
var: lunasa_ha_slot
|