awx-operator/roles/restore/tasks/secrets.yml

---

- name: Get secret definition from pvc
  k8s_exec:
    namespace: "{{ backup_pvc_namespace }}"
    pod: "{{ ansible_operator_meta.name }}-db-management"
    command: >-
      bash -c "cat '{{ backup_dir }}/secrets.yml'"
  register: _secrets
  no_log: true

- name: Create Temporary secrets file
  tempfile:
    state: file
    suffix: .json
  register: tmp_secrets

- name: Write vars to file locally
  copy:
    dest: "{{ tmp_secrets.path }}"
    content: "{{ _secrets.stdout }}"
    mode: 0640
  no_log: true

- name: Include secret vars from backup
  include_vars: "{{ tmp_secrets.path }}"
  no_log: true

- name: If deployment is managed, set the database_host in the pg config secret
  block:
    - name: Set new database host
      set_fact:
        database_host: "{{ deployment_name }}-postgres"
      no_log: true

    - name: Set tmp postgres secret dict
      set_fact:
        _pg_secret: "{{ secrets['postgresConfigurationSecret'] }}"
      no_log: true

    - name: Change postgres host value
      set_fact:
        _pg_data: "{{ _pg_secret['data'] | combine({'host': database_host | b64encode }) }}"
      no_log: true

    - name: Create a postgres secret with the new host value
      set_fact:
        _pg_secret: "{{ _pg_secret | combine({'data': _pg_data}) }}"
      no_log: true

    - name: Create a new dict of secrets with the new postgres secret
      set_fact:
        secrets: "{{ secrets | combine({'postgresConfigurationSecret': _pg_secret}) }}"
      no_log: true
  when: secrets['postgresConfigurationSecret']['data']['type'] | b64decode == 'managed'

- name: Apply secret
  k8s:
    state: present
    namespace: "{{ ansible_operator_meta.namespace }}"
    apply: yes
    wait: yes
    definition: "{{ lookup('template', 'secrets.yml.j2') }}"
  no_log: true

- name: Remove ownerReference on restored secrets
  k8s:
    definition:
      apiVersion: v1
      kind: Secret
      metadata:
        name: "{{ item.value.name }}"
        namespace: '{{ ansible_operator_meta.namespace }}'
        ownerReferences: null
  loop: "{{ secrets | dict2items }}"
  no_log: true