mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
evangelostsak
e06a62e19b
Review had these removed across the role once already, and the 11 September pass cleared every file that was flagged. The seal-key pin and the recovery-key work then reintroduced the same pattern in nine new places. Also removes two that predate the review and were never flagged: the healthcheck note in meta/services.yml and the entrypoint note in compose.yml.j2. Both are the same narrative-exception shape. Param docs, file headers and the plain contract notes in the Playwright specs stay: separate categories, none of them objected to. What the deleted comments recorded lives in the role README.
76 lines
3.4 KiB
YAML
76 lines
3.4 KiB
YAML
---
|
|
# Break-glass: mint a root token from the recovery key, then hand to 02_auth.yml
|
|
# to re-pin the AppRole to the inventory values. Reached only when neither the
|
|
# credentials this deploy was handed nor the recorded ones are accepted.
|
|
#
|
|
# Each protocol step runs through the bao CLI and Ansible parses the result: the
|
|
# token comes back XOR-wrapped with a one-time password and the image carries
|
|
# neither python nor jq to unwrap it in-container.
|
|
|
|
- name: "🧹 Cancel any root generation left in progress"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao operator generate-root -cancel
|
|
changed_when: false
|
|
failed_when: false
|
|
delegate_to: "{{ OPENBAO_HOST_NODE }}"
|
|
|
|
- name: "🎲 Generate the one-time password the root token is wrapped with"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao operator generate-root -generate-otp
|
|
register: openbao_root_otp
|
|
changed_when: false
|
|
delegate_to: "{{ OPENBAO_HOST_NODE }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "🚑 Begin root generation"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao operator generate-root -format=json
|
|
-init -otp={{ openbao_root_otp.stdout | trim | quote }}
|
|
register: openbao_root_attempt
|
|
changed_when: true
|
|
delegate_to: "{{ OPENBAO_HOST_NODE }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "🔑 Authorise the attempt with the recovery key"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec -i {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao operator generate-root -format=json
|
|
-nonce={{ (openbao_root_attempt.stdout | from_json).nonce | quote }} -
|
|
args:
|
|
stdin: "{{ OPENBAO_RECOVERY_KEY }}"
|
|
stdin_add_newline: false
|
|
register: openbao_root_update
|
|
changed_when: true
|
|
delegate_to: "{{ OPENBAO_HOST_NODE }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "🛑 Fail when the recovery key did not complete root generation"
|
|
ansible.builtin.fail:
|
|
msg: >-
|
|
The recovery key held for {{ application_id }} was rejected. Neither
|
|
AppRole is accepted either, so this instance has no administrative path
|
|
left and must be rebuilt from its volume backup plus the seal key.
|
|
when: not ((openbao_root_update.stdout | from_json).complete | default(false) | bool)
|
|
|
|
- name: "🔓 Unwrap the generated root token"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
bao operator generate-root
|
|
-decode={{ (openbao_root_update.stdout | from_json).encoded_token | quote }}
|
|
-otp={{ openbao_root_otp.stdout | trim | quote }}
|
|
register: openbao_root_decoded
|
|
changed_when: false
|
|
delegate_to: "{{ OPENBAO_HOST_NODE }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "🔧 Hold the generated root token in memory only"
|
|
ansible.builtin.set_fact:
|
|
openbao_root_token: "{{ openbao_root_decoded.stdout | trim }}"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "🔑 Rebuild the Ansible AppRole from the inventory credentials"
|
|
ansible.builtin.include_tasks: ../02_auth.yml
|