mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-07-30 03:14:42 +00:00
Fix changing the type of an existing Vault.
Current implementation does not allow the change of an existingi Vault
type. To allow it, data is retrieved from the current vault, the vault
is modifiend, and then, data is stored again in the new vault.
Due to changing the process of modifying a vault, this change also
fixes the update of asymmetric vault keys. To change the key used,
the task must provide the old private key, used to retrieve data,
and the new public_key, used to store the data again. A new alias
was added to public_key (new_public_key) and public_key_file
(new_public_key_file) so that the playbook better express the
intention of the tak.
Vault tests have been updated to better test against the new update
process, and a new test file has bee added:
tests/vault/test_vault_change_type.
This commit is contained in:
@@ -3,37 +3,28 @@
|
||||
- name: Ensure environment is clean.
|
||||
import_tasks: env_cleanup.yml
|
||||
|
||||
- name: Create private key file.
|
||||
- name: Create private/public key pair.
|
||||
shell:
|
||||
cmd: openssl genrsa -out private.pem 2048
|
||||
cmd: |
|
||||
openssl genrsa -out "{{ item }}private.pem" 2048
|
||||
openssl rsa -in "{{ item }}private.pem" -outform PEM -pubout -out "{{ item }}public.pem"
|
||||
delegate_to: localhost
|
||||
become: no
|
||||
with_items:
|
||||
- ""
|
||||
- old_
|
||||
|
||||
- name: Create public key file.
|
||||
shell:
|
||||
cmd: openssl rsa -in private.pem -outform PEM -pubout -out public.pem
|
||||
delegate_to: localhost
|
||||
become: no
|
||||
|
||||
- name: Copy password file to target host.
|
||||
- name: Copy files to target host.
|
||||
copy:
|
||||
src: "{{ playbook_dir }}/password.txt"
|
||||
dest: "{{ ansible_env.HOME }}/password.txt"
|
||||
|
||||
- name: Copy public key file to target host.
|
||||
copy:
|
||||
src: "{{ playbook_dir }}/public.pem"
|
||||
dest: "{{ ansible_env.HOME }}/public.pem"
|
||||
|
||||
- name: Copy private key file to target host.
|
||||
copy:
|
||||
src: "{{ playbook_dir }}/private.pem"
|
||||
dest: "{{ ansible_env.HOME }}/private.pem"
|
||||
|
||||
- name: Copy input data file to target host.
|
||||
copy:
|
||||
src: "{{ playbook_dir }}/in.txt"
|
||||
dest: "{{ ansible_env.HOME }}/in.txt"
|
||||
src: "{{ playbook_dir }}/{{ item }}"
|
||||
dest: "{{ ansible_env.HOME }}/{{ item }}"
|
||||
with_items:
|
||||
- private.pem
|
||||
- public.pem
|
||||
- old_private.pem
|
||||
- old_public.pem
|
||||
- password.txt
|
||||
- in.txt
|
||||
|
||||
- name: Ensure vaultgroup exists.
|
||||
ipagroup:
|
||||
|
||||
Reference in New Issue
Block a user