Use only ansible for fernet key rotation

This would replace the mistral workflow used for rotating the
fernet_keys. It does not replace the existing rotate-keys.yaml
playbook, but imports it in a new playbook.

Change-Id: If3410feda79ccf5087a2ecd894ccdf5e9dba5e68
This commit is contained in:
Rabi Mishra 2020-03-05 16:41:29 +05:30
parent 94c4ca66f7
commit 8d338fe041
3 changed files with 199 additions and 0 deletions

View File

@ -0,0 +1,14 @@
===================================
Module - tripleo_fernet_keys_rotate
===================================
This module provides for the following ansible plugin:
* tripleo_fernet_keys_rotate
.. ansibleautoplugin::
:module: tripleo_ansible/ansible_plugins/modules/tripleo_fernet_keys_rotate.py
:documentation: true
:examples: true

View File

@ -0,0 +1,149 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
# Copyright (c) 2018 OpenStack Foundation
# All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
import yaml
from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.openstack import openstack_full_argument_spec
from ansible.module_utils.openstack import openstack_module_kwargs
from ansible.module_utils.openstack import openstack_cloud_from_module
# NOTE: This is still using the legacy clients. We've not
# changed to using the OpenStackSDK fully because
# tripleo-common expects the legacy clients. Once
# we've updated tripleo-common to use the SDK we
# should revise this.
import swiftclient
from tripleo_common.utils import plan as plan_utils
ANSIBLE_METADATA = {
'metadata_version': '1.1',
'status': ['preview'],
'supported_by': 'community'
}
DOCUMENTATION = '''
---
module: tripleo_fernet_keys_rotate
short_description: Rotate Fernet Keys
version_added: "2.8"
description:
- "Rotate fernet keys."
options:
container:
description:
- Overcloud plan container name
default: overcloud
author:
- Rabi Mishra (@ramishra)
'''
EXAMPLES = '''
- name: Rotate fernet keys and update plan
tripleo_fernet_keys_rotate:
container: overcloud
'''
RETURN = '''
fernet_keys:
description: Rotated fernet keys
returned: always
type: dict
no_log: true
sample: {
"/etc/keystone/fernet-keys/0": {
"content": "kZL9nNvdYim9AvLUfrX4bHAMgwlCIbIkgBLVEoMTi1A="
},
"/etc/keystone/fernet-keys/62": {
"content": "VTwb92H8iysaU0ky7nDV2XFNOscA4Cm_TYBFeI9wuQs="
},
"/etc/keystone/fernet-keys/63": {
"content": "6aiyiVzN5c2qYhuS2mgOLa0zK7Hc6q5-zq6n4tdEUAE="
},
"/etc/keystone/fernet-keys/64": {
"content": "Qq0Ef-wFtxAkwfOxqHHq8zykvozPGkwym4t9ATMrujA="
},
"/etc/keystone/fernet-keys/65": {
"content": "mnbPEIt0AQltAd5bzs9P8nV4cpksaOo7IHvK7eBHp8M="
}
}
'''
def run_module():
result = dict(
success=False,
error="",
fernet_keys={}
)
argument_spec = openstack_full_argument_spec(
**yaml.safe_load(DOCUMENTATION)['options']
)
module = AnsibleModule(
argument_spec,
supports_check_mode=True,
**openstack_module_kwargs()
)
def get_object_client(session):
return swiftclient.Connection(
session=session,
retries=10,
starting_backoff=3,
max_backoff=120)
try:
container = module.params.get('container')
_, conn = openstack_cloud_from_module(module)
session = conn.session
# if the user is working with this module in only check mode we do not
# want to make any changes to the environment, just return the current
# state with no modifications
if module.check_mode:
module.exit_json(**result)
swift = get_object_client(session)
fernet_keys = plan_utils.update_plan_rotate_fernet_keys(swift, container)
result['success'] = True
result['fernet_keys'] = fernet_keys
except Exception as err:
result['error'] = str(err)
result['msg'] = ("Error rotating fernet keys for plan %s: %s" % (
container, err))
module.fail_json(**result)
# in the event of a successful module execution, you will want to
# simple AnsibleModule.exit_json(), passing the key/value results
module.exit_json(**result)
def main():
run_module()
if __name__ == '__main__':
main()

View File

@ -0,0 +1,36 @@
---
# Copyright 2019 Red Hat, Inc.
# All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
- name: Rotate fernet keys
connection: "{{ (tripleo_target_host is defined) | ternary('ssh', 'local') }}"
hosts: "{{ tripleo_target_host | default('undercloud') }}"
remote_user: "{{ tripleo_target_user | default(lookup('env', 'USER')) }}"
gather_facts: "{{ (tripleo_target_host is defined) | ternary(true, false) }}"
any_errors_fatal: true
vars:
container: overcloud
tasks:
- name: Rotate keys and update plan
tripleo_fernet_keys_rotate:
container: "{{ container }}"
register: fernet_keys
- name: Rotate fernet keys on controller nodes
import_playbook: rotate-keys.yaml fernet_keys="{{ hostvars['undercloud']['fernet_keys']['fernet_keys'] }}"
tags:
- rotate-fernet-keys