mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
c925150848
OpenBao 2.7 removed the builtin LDAP auth engine from the server binary (openbao/openbao GH-3882). `bao auth enable ldap` answered "plugin not found in the catalog: ldap" and the deploy stopped there. The role now builds its own image. A multi-stage Dockerfile copies the openbao-plugin-auth-ldap binary out of the image declared as the `auth-ldap` service entry into /opt/openbao/plugins. A second server config file, plugins.hcl, names that directory and registers the plugin declaratively. It sets plugin_auto_register = true explicitly: the image starts the server with a config directory, and on that path 2.7.1 does not apply the documented default, so without the line the catalog stays empty. The Dockerfile sets the file mode in a helper stage instead of COPY --chmod, which only BuildKit accepts. The mount is enabled with -plugin-version=latest, so it follows whichever plugin version the image ships. A mount created by the former builtin engine is tuned and reloaded onto the plugin, which needs `update` on sys/plugins/reload/backend in the ansible-admin policy. The LDAP tasks move into tasks/addons/auth-ldap.yml and the plugin is declared under meta/addons as a required addon bridged to `ldap`. Its Playwright spec logs in through the mount and asserts that sys/auth reports an external running plugin version. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
39 lines
1.7 KiB
YAML
39 lines
1.7 KiB
YAML
---
|
|
# include-gated: when: OPENBAO_LDAP_ENABLED | bool
|
|
- name: "🧩 Enable the LDAP auth method"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
sh -c 'bao auth list -format=json | grep -q "ldap/" ||
|
|
{ bao auth enable -plugin-version=latest ldap && echo OPENBAO_CHANGED; }'
|
|
register: openbao_ldap_enable
|
|
changed_when: "'OPENBAO_CHANGED' in openbao_ldap_enable.stdout"
|
|
|
|
- name: "🔌 Move an LDAP mount of the removed builtin engine onto the plugin"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
sh -c '[ "$(bao read -field=plugin_version sys/auth/ldap)" = latest ] ||
|
|
{ bao auth tune -plugin-version=latest ldap/ &&
|
|
bao plugin reload -mounts=auth/ldap/ &&
|
|
echo OPENBAO_CHANGED; }'
|
|
register: openbao_ldap_plugin
|
|
changed_when: "'OPENBAO_CHANGED' in openbao_ldap_plugin.stdout"
|
|
|
|
- name: "📇 Point the LDAP method at the directory"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec -i {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao write auth/ldap/config
|
|
url={{ OPENBAO_LDAP_URL | quote }}
|
|
userdn={{ LDAP.DN.OU.USERS | quote }}
|
|
userattr={{ OPENBAO_LDAP_USER_ATTR | quote }}
|
|
groupdn={{ LDAP.DN.OU.ROLES | quote }}
|
|
groupattr=cn
|
|
binddn={{ LDAP.DN.ADMINISTRATOR.DATA | quote }}
|
|
bindpass=-
|
|
insecure_tls=false
|
|
starttls=false
|
|
args:
|
|
stdin: "{{ LDAP.BIND_CREDENTIAL }}"
|
|
stdin_add_newline: false
|
|
changed_when: false
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|