327d80588e
Beside Docker, we also support Podman. Docker will be removed in Train. Change-Id: I9031639f76dc16f3af69c0120234966ca7e2639c
73 lines
2.1 KiB
YAML
73 lines
2.1 KiB
YAML
---
|
|
- hosts: keystone
|
|
tasks:
|
|
- name: Check for containerized keystone fernet repository
|
|
stat:
|
|
path: /var/lib/config-data/puppet-generated/keystone/etc/keystone/fernet-keys/
|
|
register: containerized_keystone_dir
|
|
|
|
- name: populate service facts
|
|
service_facts:
|
|
|
|
- set_fact:
|
|
is_container: containerized_keystone_dir.stat.isdir is defined and containerized_keystone_dir.stat.isdir
|
|
podman_enabled: '"tripleo_keystone.service" in ansible_facts.services'
|
|
|
|
- name: Rotate fernet keys for keystone container
|
|
block:
|
|
- set_fact:
|
|
keystone_base: /var/lib/config-data/puppet-generated/keystone
|
|
|
|
- name: Remove previous fernet keys
|
|
shell: rm -rf /var/lib/config-data/puppet-generated/keystone/etc/keystone/fernet-keys/*
|
|
args:
|
|
warn: false
|
|
|
|
- name: Persist fernet keys to repository
|
|
copy:
|
|
dest: "{{ keystone_base }}{{ item.key }}"
|
|
content: "{{ item.value.content }}"
|
|
mode: 0600
|
|
with_dict: "{{ fernet_keys }}"
|
|
no_log: true
|
|
|
|
- name: Set permissions to match container's user
|
|
shell: chown --reference={{ keystone_base }}/etc/keystone/fernet-keys {{ keystone_base }}{{ item.key }}
|
|
with_dict: "{{ fernet_keys }}"
|
|
no_log: true
|
|
|
|
- name: Restart keystone container with docker
|
|
shell: docker restart keystone
|
|
when: not podman_enabled
|
|
|
|
- name: Restart keystone container
|
|
service:
|
|
name: tripleo_keystone
|
|
state: restarted
|
|
when: podman_enabled
|
|
|
|
when: is_container
|
|
|
|
- name: Rotate fernet keys for keystone (no container)
|
|
block:
|
|
- name: Remove previous fernet keys
|
|
shell: rm -rf /etc/keystone/fernet-keys/*
|
|
args:
|
|
warn: false
|
|
|
|
- name: Persist fernet keys to repository
|
|
copy:
|
|
dest: "{{ item.key }}"
|
|
content: "{{ item.value.content }}"
|
|
mode: 0600
|
|
owner: keystone
|
|
group: keystone
|
|
with_dict: "{{ fernet_keys }}"
|
|
no_log: true
|
|
|
|
- name: Reload apache
|
|
service:
|
|
name: httpd
|
|
state: reloaded
|
|
when: not is_container
|