Use only ansible for fernet key rotation

This would replace the mistral workflow used for rotating the
fernet_keys. It does not replace the existing rotate-keys.yaml
playbook, but imports it in a new playbook.

Change-Id: If3410feda79ccf5087a2ecd894ccdf5e9dba5e68

doc/source/modules/modules-tripleo_fernet_keys_rotate.rst

@@ -0,0 +1,14 @@
+===================================
+Module - tripleo_fernet_keys_rotate
+===================================
+
+
+This module provides for the following ansible plugin:
+
+    * tripleo_fernet_keys_rotate
+
+
+.. ansibleautoplugin::
+   :module: tripleo_ansible/ansible_plugins/modules/tripleo_fernet_keys_rotate.py
+   :documentation: true
+   :examples: true

tripleo_ansible/ansible_plugins/modules/tripleo_fernet_keys_rotate.py

@@ -0,0 +1,149 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+# Copyright (c) 2018 OpenStack Foundation
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import yaml
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.openstack import openstack_full_argument_spec
+from ansible.module_utils.openstack import openstack_module_kwargs
+from ansible.module_utils.openstack import openstack_cloud_from_module
+
+# NOTE: This is still using the legacy clients. We've not
+#       changed to using the OpenStackSDK fully because
+#       tripleo-common expects the legacy clients. Once
+#       we've updated tripleo-common to use the SDK we
+#       should revise this.
+import swiftclient
+from tripleo_common.utils import plan as plan_utils
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.1',
+    'status': ['preview'],
+    'supported_by': 'community'
+}
+
+DOCUMENTATION = '''
+---
+module: tripleo_fernet_keys_rotate
+
+short_description: Rotate Fernet Keys
+
+version_added: "2.8"
+
+description:
+    - "Rotate fernet keys."
+
+options:
+    container:
+        description:
+            - Overcloud plan container name
+        default: overcloud
+author:
+    - Rabi Mishra (@ramishra)
+'''
+
+EXAMPLES = '''
+- name: Rotate fernet keys and update plan
+  tripleo_fernet_keys_rotate:
+      container: overcloud
+'''
+
+RETURN = '''
+fernet_keys:
+    description: Rotated fernet keys
+    returned: always
+    type: dict
+    no_log: true
+    sample: {
+        "/etc/keystone/fernet-keys/0": {
+            "content": "kZL9nNvdYim9AvLUfrX4bHAMgwlCIbIkgBLVEoMTi1A="
+        },
+        "/etc/keystone/fernet-keys/62": {
+            "content": "VTwb92H8iysaU0ky7nDV2XFNOscA4Cm_TYBFeI9wuQs="
+        },
+        "/etc/keystone/fernet-keys/63": {
+            "content": "6aiyiVzN5c2qYhuS2mgOLa0zK7Hc6q5-zq6n4tdEUAE="
+        },
+        "/etc/keystone/fernet-keys/64": {
+            "content": "Qq0Ef-wFtxAkwfOxqHHq8zykvozPGkwym4t9ATMrujA="
+        },
+        "/etc/keystone/fernet-keys/65": {
+            "content": "mnbPEIt0AQltAd5bzs9P8nV4cpksaOo7IHvK7eBHp8M="
+        }
+    }
+'''
+
+
+def run_module():
+    result = dict(
+        success=False,
+        error="",
+        fernet_keys={}
+    )
+
+    argument_spec = openstack_full_argument_spec(
+        **yaml.safe_load(DOCUMENTATION)['options']
+    )
+
+    module = AnsibleModule(
+        argument_spec,
+        supports_check_mode=True,
+        **openstack_module_kwargs()
+    )
+
+    def get_object_client(session):
+        return swiftclient.Connection(
+            session=session,
+            retries=10,
+            starting_backoff=3,
+            max_backoff=120)
+
+    try:
+        container = module.params.get('container')
+        _, conn = openstack_cloud_from_module(module)
+        session = conn.session
+
+        # if the user is working with this module in only check mode we do not
+        # want to make any changes to the environment, just return the current
+        # state with no modifications
+        if module.check_mode:
+            module.exit_json(**result)
+        swift = get_object_client(session)
+        fernet_keys = plan_utils.update_plan_rotate_fernet_keys(swift, container)
+        result['success'] = True
+        result['fernet_keys'] = fernet_keys
+    except Exception as err:
+        result['error'] = str(err)
+        result['msg'] = ("Error rotating fernet keys for plan %s: %s" % (
+            container, err))
+        module.fail_json(**result)
+
+    # in the event of a successful module execution, you will want to
+    # simple AnsibleModule.exit_json(), passing the key/value results
+    module.exit_json(**result)
+
+
+def main():
+    run_module()
+
+
+if __name__ == '__main__':
+    main()

tripleo_ansible/playbooks/rotate-fernet-keys.yaml

@@ -0,0 +1,36 @@
+---
+# Copyright 2019 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+- name: Rotate fernet keys
+  connection: "{{ (tripleo_target_host is defined) | ternary('ssh', 'local') }}"
+  hosts: "{{ tripleo_target_host | default('undercloud') }}"
+  remote_user: "{{ tripleo_target_user | default(lookup('env', 'USER')) }}"
+  gather_facts: "{{ (tripleo_target_host is defined) | ternary(true, false) }}"
+  any_errors_fatal: true
+  vars:
+    container: overcloud
+
+  tasks:
+    - name: Rotate keys and update plan
+      tripleo_fernet_keys_rotate:
+        container: "{{ container }}"
+      register: fernet_keys
+
+- name: Rotate fernet keys on controller nodes
+  import_playbook: rotate-keys.yaml fernet_keys="{{ hostvars['undercloud']['fernet_keys']['fernet_keys'] }}"
+
+  tags:
+    - rotate-fernet-keys