Compare commits

...

2 commits

Author SHA1 Message Date
dce8d35fe4 Add reloads for new certs in consul 2020-09-30 22:40:16 -04:00
9fa7686534 Add tls to nomad 2020-09-30 22:37:18 -04:00
9 changed files with 136 additions and 0 deletions

View file

@ -3,6 +3,16 @@
systemd: systemd:
daemon_reload: True daemon_reload: True
- name: reload_consul_debian
systemd:
name: consul
state: reloaded
- name: reload_consul_fbsd
service:
name: consul
state: reloaded
- name: restart_consul_debian - name: restart_consul_debian
systemd: systemd:
name: consul name: consul

View file

@ -47,6 +47,7 @@
VAULT_FORMAT: json VAULT_FORMAT: json
register: cert_data register: cert_data
when: exp.rc != 0 when: exp.rc != 0
notify: reload_consul
- name: write cert data to server - name: write cert data to server
copy: copy:

View file

@ -47,6 +47,7 @@
VAULT_FORMAT: json VAULT_FORMAT: json
register: cert_data register: cert_data
when: exp.rc != 0 when: exp.rc != 0
notify: reload_consul
- name: write cert data to server - name: write cert data to server
copy: copy:

View file

@ -3,6 +3,11 @@
systemd: systemd:
daemon_reload: True daemon_reload: True
- name: reload_nomad
systemd:
name: nomad
state: reloaded
- name: restart_nomad - name: restart_nomad
systemd: systemd:
name: nomad name: nomad

View file

@ -85,6 +85,55 @@
group: nomad group: nomad
remote_src: True remote_src: True
- name: ensure nomad config dir
file:
path: /etc/nomad.d/certs/
state: directory
owner: nomad
group: nomad
mode: 0755
- name: check if server cert is expiring in the next 5 days
shell: "openssl x509 -checkend 432000 -noout -in /etc/nomad.d/certs/nomad.pem"
args:
executable: /bin/bash
failed_when: False
check_mode: False
changed_when: False
register: exp
- name: get cert
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=nomad.service.{{ main_dc_name }}.{{ consul_domain }} alt_names=nomad.service.{{ consul_domain }} ttl=43200m"
args:
executable: /bin/bash
environment:
VAULT_ADDR: http://ivyking.minhas.io:8200
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
VAULT_FORMAT: json
register: cert_data
when: exp.rc != 0
notify: reload_nomad
- name: write cert data to server
copy:
content: "{{ item.content }}"
dest: "/etc/nomad.d/certs/{{ item.path }}"
mode: '{{ item.mode }}'
owner: nomad
group: nomad
when: cert_data.changed
loop:
- {
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
path: "nomad.pem",
mode: "0755"
}
- {
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
path: "nomad.key",
mode: "0600"
}
- name: ensure nomad is started and enabled - name: ensure nomad is started and enabled
systemd: systemd:
name: nomad name: nomad

View file

@ -9,6 +9,14 @@ consul {
token = "{{ lookup('hashi_vault', 'secret=kv/data/nomad:data')['consul-acl-client'] }}" token = "{{ lookup('hashi_vault', 'secret=kv/data/nomad:data')['consul-acl-client'] }}"
} }
tls {
http = true
rpc = true
ca_file = "/etc/pki/certs/{{ vault_ca_cert_name }}"
cert_file = "/etc/nomad.d/certs/nomad.pem"
key_file = "/etc/nomad.d/certs/nomad.key"
}
plugin_dir = "/opt/nomad_plugins" plugin_dir = "/opt/nomad_plugins"
plugin "nomad-driver-podman" { plugin "nomad-driver-podman" {

View file

@ -3,6 +3,11 @@
systemd: systemd:
daemon_reload: True daemon_reload: True
- name: reload_nomad
systemd:
name: nomad
state: reloaded
- name: restart_nomad - name: restart_nomad
systemd: systemd:
name: nomad name: nomad

View file

@ -65,6 +65,55 @@
mode: 0755 mode: 0755
notify: restart_nomad notify: restart_nomad
- name: ensure nomad config dir
file:
path: /etc/nomad.d/certs/
state: directory
owner: nomad
group: nomad
mode: 0755
- name: check if server cert is expiring in the next 5 days
shell: "openssl x509 -checkend 432000 -noout -in /etc/nomad.d/certs/nomad.pem"
args:
executable: /bin/bash
failed_when: False
check_mode: False
changed_when: False
register: exp
- name: get cert
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=nomad.service.{{ main_dc_name }}.{{ consul_domain }} alt_names=nomad.service.{{ consul_domain }} ttl=43200m"
args:
executable: /bin/bash
environment:
VAULT_ADDR: http://ivyking.minhas.io:8200
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
VAULT_FORMAT: json
register: cert_data
when: exp.rc != 0
notify: reload_nomad
- name: write cert data to server
copy:
content: "{{ item.content }}"
dest: "/etc/nomad.d/certs/{{ item.path }}"
mode: '{{ item.mode }}'
owner: nomad
group: nomad
when: cert_data.changed
loop:
- {
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
path: "nomad.pem",
mode: "0755"
}
- {
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
path: "nomad.key",
mode: "0600"
}
- name: ensure nomad is started and enabled - name: ensure nomad is started and enabled
systemd: systemd:
name: nomad name: nomad

View file

@ -9,3 +9,11 @@ server {
consul { consul {
token = "{{ lookup('hashi_vault', 'secret=kv/data/nomad:data')['consul-acl-server'] }}" token = "{{ lookup('hashi_vault', 'secret=kv/data/nomad:data')['consul-acl-server'] }}"
} }
tls {
http = true
rpc = true
ca_file = "/etc/pki/certs/{{ vault_ca_cert_name }}"
cert_file = "/etc/nomad.d/certs/nomad.pem"
key_file = "/etc/nomad.d/certs/nomad.key"
}