04_vault-deployment.yml

---
- name: "AT Computing - HashiCorp Demo - Vault"
  hosts: all
  become: true

  vars_files:
    - vars/general/main.yml
    - vars/hashicorp/general.yml
    - vars/hashicorp/consul.yml
    - vars/hashicorp/vault.yml
    - vars/hashicorp/ssl.yml

  tasks:
    - name: "HashiCorp - Vault : Ensure data directory is present."
      ansible.builtin.file:
        path: "{{ vault_data_directory }}"
        state: directory
        mode: "0755"
        owner: "{{ vault_data_directory_user }}"
        group: "{{ vault_data_directory_group }}"
      when: ansible_hostname in groups['servers']

    - name: "HashiCorp - Vault : Ensure log directory is present."
      ansible.builtin.file:
        path: "{{ vault_log_directory }}"
        state: directory
        mode: "0755"
        owner: "{{ vault_log_directory_user }}"
        group: "{{ vault_log_directory_group }}"
      when: ansible_hostname in groups['servers']

    - name: "HashiCorp - Vault : Ensure Vault is excluded from the unattended upgrades."
      ansible.builtin.lineinfile:
        path: "/usr/share/unattended-upgrades/50unattended-upgrades"
        state: present
        line: '    "vault";'
        insertafter: 'Unattended-Upgrade::Package-Blacklist \{\n'
        backup: true

    # PKI
    - name: "HashiCorp - Vault - PKI : Ensure TLS directory is present."
      become: true
      ansible.builtin.file:
        path: "{{ vault_tls_directory }}"
        state: directory
        recurse: true
      when: ansible_hostname in groups['servers']

    ## Server certificate
    - name: "HashiCorp - Vault - PKI : Create PKI infrastructure on first server."
      block:
        - name: "HashiCorp - Vault - PKI : Create private key for server certificate."
          community.crypto.openssl_privatekey:
            path: "{{ vault_ssl_key_dest }}"
            owner: "root"
            group: "vault"
            mode: "0640"

        - name: "HashiCorp - Vault - PKI : Retrieve private key contents."
          ansible.builtin.slurp:
            src: "{{ vault_ssl_key_dest }}"
          register: keyfile

        - name: "HashiCorp - Vault - PKI : Retrieve server IP addresses."
          ansible.builtin.set_fact:
            servers: "{% set comma = joiner(',') %}{% for host in groups['servers'] %}{{ comma() }}IP:{{ hostvars[host]['ansible_host'] }}{% endfor %}"

        - name: "HashiCorp - Vault - PKI : Convert server fact to list."
          ansible.builtin.set_fact:
            servers: "{{ servers.split(',') }}"

        - name: "HashiCorp - Vault - PKI : Append the existing list of SAN attributes."
          ansible.builtin.set_fact:
            vault_ssl_server_subject_alt_names: "{{ vault_ssl_server_subject_alt_names + servers }}"

        - name: "HashiCorp - Vault - PKI : Create certificate signing request (CSR) for server certificate."
          community.crypto.openssl_csr_pipe:
            privatekey_path: "{{ vault_ssl_key_dest }}"
            common_name: "{{ vault_ssl_server_common_name }}"
            subject_alt_name: "{{ vault_ssl_server_subject_alt_names }}"
          register: csr

        - name: "HashiCorp - Vault - PKI : Check whether certificate exists."
          ansible.builtin.stat:
            path: "{{ vault_ssl_cert_dest }}"
          register: certificate_exists

        - name: "HashiCorp - Vault - PKI : Read existing certificate if exists."
          ansible.builtin.slurp:
            src: "{{ vault_ssl_cert_dest }}"
          when: certificate_exists.stat.exists
          register: certificate

        - name: "HashiCorp - Vault - PKI : Sign certificate with our CA."
          community.crypto.x509_certificate_pipe:
            content: "{{ (certificate.content | b64decode) if certificate_exists.stat.exists else omit }}"
            csr_content: "{{ csr.csr }}"
            provider: ownca
            ownca_path: "{{ ssl_ca_certfile_path }}"
            ownca_privatekey_path: "{{ ssl_ca_keyfile_path }}"
          register: certificate
          delegate_to: "{{ groups['servers'] | first }}"

        - name: "HashiCorp - Vault - PKI : Write certificate file."
          ansible.builtin.copy:
            dest: "{{ vault_ssl_cert_dest }}"
            content: "{{ certificate.certificate }}"
            owner: "root"
            group: "root"
            mode: "0644"
          when: certificate is changed

      when: ansible_hostname in groups['servers']

    # Distribute the CA certificate to the rest of the environment
    - name: "HashiCorp - Vault - PKI : Retrieve Content."
      block:
        - name: "HashiCorp - Vault - PKI : Retrieve CA certificate contents."
          ansible.builtin.slurp:
            src: "{{ ssl_ca_certfile_path }}"
          register: ca_certificate_slurp
        - name: "HashiCorp - Vault - PKI : Retrieve Server certificate contents."
          ansible.builtin.slurp:
            src: "{{ vault_ssl_cert_dest }}"
          register: server_certificate_slurp
        - name: "HashiCorp - Vault - PKI : Retrieve Server key contents."
          ansible.builtin.slurp:
            src: "{{ vault_ssl_key_dest }}"
          register: server_key_slurp
      delegate_to: "{{ groups['servers'] | first }}"
      run_once: true

    - name: "HashiCorp - Vault - PKI : Place CA certificate in default location."
      ansible.builtin.copy:
        dest: "{{ vault_ssl_ca_dest }}"
        content: "{{ ca_certificate_slurp.content | b64decode }}"
        owner: "root"
        group: "root"
        mode: "0644"
      when:
        - ansible_hostname in groups['servers']

    # VAULT CONFIGURATION
    - name: "HashiCorp - Vault : Configuration."
      block:
        - name: "HashiCorp - Vault : Ensure general configuration is present."
          ansible.builtin.template:
            src: "templates/hashicorp/vault/vault.hcl.j2"
            dest: "{{ vault_etc_directory }}/vault.hcl"
            mode: "0644"
            owner: "{{ vault_data_directory_user }}"
            group: "{{ vault_data_directory_group }}"

        - name: "HashiCorp - Vault : Ensure systemd service is present."
          ansible.builtin.template:
            src: "templates/hashicorp/vault/vault.service.j2"
            dest: "{{ vault_systemd_service_file }}"
            mode: "0644"

        - name: "HashiCorp - Vault : Ensure systemd is reloaded."
          ansible.builtin.systemd:
            daemon_reload: true

        - name: "HashiCorp - Vault - ACL : Check if system is already bootstrapped."
          ansible.builtin.stat:
            path: "{{ vault_bootstrapped_true_file }}"
          register: vault_bootstrapped
          when: ansible_hostname in groups['servers']
          delegate_to: "{{ groups['servers'] | first }}"
          run_once: true

        - name: "HashiCorp - Vault - ACL : Check if Consul has ACL mode enabled."
          ansible.builtin.shell: "cat {{ consul_etc_directory }}/consul.hcl | grep -a3 '^acl' | grep enabled | awk '{print $3}'"
          changed_when: false
          ignore_errors: true
          when: ansible_hostname in groups['servers']
          delegate_to: "{{ groups['servers'] | first }}"
          run_once: true
          register: consul_acl_enabled

        # VAULT ACL
        - name: "HashiCorp - Vault - ACL"
          block:
            - name: "HashiCorp - Vault - ACL : Ensure the Vault service policy file is in place."
              ansible.builtin.copy:
                src: "{{ vault_service_policy_file_local }}"
                dest: "{{ vault_service_policy_file_remote }}"
                mode: 0644

            - name: "HashiCorp - Consul - ACL : Retrieve Secret ID from bootstrap output."
              ansible.builtin.shell: "awk '/SecretID/ {print $2}' {{ consul_bootstrap_token_local_path }}"
              changed_when: false
              become: false
              delegate_to: localhost
              register: consul_acl_bootstrap_output

            - name: "HashiCorp - Consul - ACL : Set the Secret ID as a fact."
              ansible.builtin.set_fact:
                consul_acl_bootstrap_secret_id: "{{ consul_acl_bootstrap_output.stdout }}"

            - name: "HashiCorp - Vault - ACL - Consul : Ensure that the ACL is present in Consul."
              ansible.builtin.command: "{{ consul_binary }} acl policy create -name {{ vault_consul_service_name }} -rules @{{ vault_service_policy_file_name }}"
              args:
                chdir: "{{ vault_data_directory }}/"
              environment:
                CONSUL_HTTP_TOKEN: "{{ consul_acl_bootstrap_secret_id }}"
              changed_when: false

            - name: "HashiCorp - Vault - ACL - Consul : Create ACL token using the above policy."
              ansible.builtin.command: "{{ consul_binary }} acl token create -description 'Vault Service Token' -policy-name {{ vault_consul_service_name }}"
              changed_when: false
              environment:
                CONSUL_HTTP_TOKEN: "{{ consul_acl_bootstrap_secret_id }}"
              register: vault_acl_bootstrap_raw

            - name: "HashiCorp - Vault - ACL : Store bootstrap token local for safekeeping."
              ansible.builtin.copy:
                content: "{{ vault_acl_bootstrap_raw.stdout }}"
                dest: "{{ vault_bootstrap_token_local_path }}"
                mode: 0644
              become: false
              delegate_to: localhost

            - name: "HashiCorp - Vault - ACL : Retrieve Secret ID from bootstrap output."
              ansible.builtin.shell: "awk '/SecretID/ {print $2}' {{ vault_bootstrap_token_local_path }}"
              changed_when: false
              become: false
              delegate_to: localhost
              register: vault_acl_bootstrap_output

            - name: "HashiCorp - Vault - ACL : Set the Secret ID as a fact."
              ansible.builtin.set_fact:
                vault_acl_bootstrap_secret_id: "{{ vault_acl_bootstrap_output.stdout }}"

            - name: "HashiCorp - Vault - ACL : Ensure bootstrap check file is in place."
              ansible.builtin.copy:
                dest: "{{ vault_bootstrapped_true_file }}"
                content: "This cluster was bootstrapped on {{ ansible_date_time.date }} {{ ansible_date_time.time }}{{ ansible_date_time.tz }}.\n"
                mode: 0644

            - name: "HashiCorp - Vault - ACL : Cleanup generated files which are not needed anymore."
              ansible.builtin.file:
                path: "{{ item }}"
                state: absent
              with_items:
                - "{{ vault_service_policy_file_remote }}"

          when:
            - ansible_hostname in groups['servers']
            - consul_acl_enabled.stdout == "true"
            - not vault_bootstrapped.stat.exists
          delegate_to: "{{ groups['servers'] | first }}"
          run_once: true

        - name: "HashiCorp - Vault : Ensure Vault Service Token is set in config file."
          ansible.builtin.lineinfile:
            path: "{{ vault_etc_directory }}/vault.hcl"
            regexp: '  # token   = "<VAULT_SERVICE_TOKEN_WILL_BE_FILLED_LATER>"'
            line: '  token   = "{{ vault_acl_bootstrap_secret_id }}"'

        - name: "HashiCorp - Vault : Ensure systemd service is enabled and started."
          ansible.builtin.systemd:
            name: "{{ vault_service_name }}"
            enabled: true
            state: started
        - name: "HashiCorp - Vault : Pause for a few seconds to allow the service to come up."
          ansible.builtin.pause:
            seconds: 10

        - name: "HashiCorp - Vault : Check the Vault initialization status."
          ansible.builtin.shell: "{{ vault_binary }} status | grep -i initialized | awk '{print $2}'"
          environment:
            VAULT_ADDR: "{{ vault_address }}"
            VAULT_CACERT: "{{ vault_ssl_ca_dest }}"
            VAULT_SKIP_VERIFY: "true"
          changed_when: false
          register: vault_is_initialized
          when: ansible_hostname in groups['servers']
          delegate_to: "{{ groups['servers'] | first }}"
          run_once: true

        - name: "HashiCorp - Vault : Initialize the Vault."
          ansible.builtin.command: "{{ vault_binary }} operator init"
          environment:
            VAULT_ADDR: "{{ vault_address }}"
            VAULT_CACERT: "{{ vault_ssl_ca_dest }}"
            VAULT_SKIP_VERIFY: "true"
          changed_when: true
          register: vault_init_output
          when:
            - ansible_hostname in groups['servers']
            - vault_is_initialized.stdout == "false"
          delegate_to: "{{ groups['servers'] | first }}"
          run_once: true

        - name: "HashiCorp - Vault - INIT: Store Vault master keys local for safekeeping."
          ansible.builtin.copy:
            content: "{{ vault_init_output.stdout }}"
            dest: "{{ vault_bootstrap_init_local_path }}"
            mode: "0644"
          become: false
          when:
            - vault_is_initialized.stdout == "false"
          delegate_to: localhost
          run_once: true

      when: ansible_hostname in groups['servers']

    - name: "HashiCorp - Vault : Check the Vault sealed status."
      ansible.builtin.shell: "{{ vault_binary }} status | grep -i sealed | awk '{print $2}'"
      environment:
        VAULT_ADDR: "{{ vault_address }}"
        VAULT_CACERT: "{{ vault_ssl_ca_dest }}"
        VAULT_SKIP_VERIFY: "true"
      changed_when: false
      register: vault_is_sealed

    - name: "HashiCorp - Vault - Unseal"
      block:
        - name: "HashiCorp - Vault - Unseal : Retrieve local token file."
          ansible.builtin.set_fact:
            token_file_output: "{{ lookup('file', vault_bootstrap_init_local_path).split('\n') }}"
          delegate_to: localhost
          run_once: true

        - name: "HashiCorp - Vault - Unseal : Retrieve first unseal key from initialization info."
          ansible.builtin.set_fact:
            vault_unseal_key_1: "{{ token_file_output[0].split('Unseal Key 1: ')[1] }}"
          delegate_to: localhost
          run_once: true

        - name: "HashiCorp - Vault - Unseal : Retrieve second unseal key from initialization info."
          ansible.builtin.set_fact:
            vault_unseal_key_2: "{{ token_file_output[1].split('Unseal Key 2: ')[1] }}"
          delegate_to: localhost
          run_once: true

        - name: "HashiCorp - Vault - Unseal : Retrieve third unseal key from initialization info."
          ansible.builtin.set_fact:
            vault_unseal_key_3: "{{ token_file_output[2].split('Unseal Key 3: ')[1] }}"
          delegate_to: localhost
          run_once: true

        - name: "HashiCorp - Vault - Unseal : Ensure first Vault is unsealed."
          ansible.builtin.command: "{{ vault_binary }} operator unseal {{ item }}"
          environment:
            VAULT_ADDR: "{{ vault_address }}"
            VAULT_CACERT: "{{ vault_ssl_ca_dest }}"
            VAULT_SKIP_VERIFY: "true"
          changed_when: true
          no_log: true
          with_items:
            - "{{ vault_unseal_key_1 }}"
            - "{{ vault_unseal_key_2 }}"
            - "{{ vault_unseal_key_3 }}"

      when:
        - vault_is_sealed.stdout == "true"

    - name: Check the Vault sealed status.
      ansible.builtin.shell: "{{ vault_binary }} status | grep -i sealed | awk '{print $2}'"
      environment:
        VAULT_ADDR: "{{ vault_address }}"
        VAULT_CACERT: "{{ vault_ssl_ca_dest }}"
        VAULT_SKIP_VERIFY: "true"
      changed_when: false
      register: vault_is_sealed

    - name: Retrieve Initial Root Token from local file.
      ansible.builtin.shell: "awk '/Initial Root Token/ {print $4}' {{ vault_bootstrap_init_local_path }}"
      register: vault_initial_root_token
      changed_when: false
      delegate_to: localhost
      become: false
      run_once: true

    # VAULT CONTENT CONFIGURATION
    - name: "HashiCorp - Vault : Content creation."
      block:
        - name: "HashiCorp - Vault : Ensure admin-policy is in place."
          ansible.builtin.uri:
            url: "{{ vault_address }}/v1/sys/policy/{{ vault_admin_policy_name }}"
            method: PUT
            headers:
              X-Vault-Token: "{{ vault_initial_root_token.stdout }}"
            body_format: json
            body: '{ "policy": "path \"*\" { capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\", \"sudo\"] }" }'
            status_code:
              - 200
              - 204
            validate_certs: false

        - name: "HashiCorp - Vault : Ensure userpass auth engine is enabled and mounted."
          ansible.builtin.uri:
            url: "{{ vault_address }}/v1/sys/auth/userpass"
            method: POST
            headers:
              X-Vault-Token: "{{ vault_initial_root_token.stdout }}"
            body_format: json
            body: '{ "type": "userpass" }'
            status_code:
              - 200
              - 204
            validate_certs: false

        - name: "HashiCorp - Vault : Create a random password."
          ansible.builtin.set_fact:
            random_password: "{{ lookup('password', '{{ vault_admin_local_path }} chars=ascii_letters,digits length=20') }}"
          become: false

        - name: "HashiCorp - Vault : Ensure admin user is created."
          ansible.builtin.uri:
            url: "{{ vault_address }}/v1/auth/userpass/users/{{ vault_admin_username }}"
            method: POST
            headers:
              X-Vault-Token: "{{ vault_initial_root_token.stdout }}"
            body_format: json
            body: '{ "password": "{{ random_password }}" }'
            status_code:
              - 200
              - 204
            validate_certs: false

        - name: "HashiCorp - Vault : Retrieve userpass mount accessor."
          ansible.builtin.uri:
            url: "{{ vault_address }}/v1/sys/auth"
            method: GET
            headers:
              X-Vault-Token: "{{ vault_initial_root_token.stdout }}"
            body_format: json
            return_content: true
            validate_certs: false
          register: mount_accessor_raw

        - name: "HashiCorp - Vault : Set a fact with the mount accessor."
          ansible.builtin.set_fact:
            mount_accessor: "{{ mount_accessor_raw['json']['data']['userpass/']['accessor'] }}"

        - name: "HashiCorp - Vault : Create the admin-user entity."
          ansible.builtin.uri:
            url: "{{ vault_address }}/v1/identity/entity"
            method: POST
            headers:
              X-Vault-Token: "{{ vault_initial_root_token.stdout }}"
            body_format: json
            body: '{ "name": "{{ vault_admin_username }}-entity" }'
            status_code:
              - 200
              - 204
            return_content: true
            validate_certs: false
          register: entity_raw

        - name: "HashiCorp - Vault : Set a fact with the entity ID."
          ansible.builtin.set_fact:
            entity_id: "{{ entity_raw['json']['data']['id'] }}"

        - name: "HashiCorp - Vault : Create the admin-user-entity alias."
          ansible.builtin.uri:
            url: "{{ vault_address }}/v1/identity/entity-alias"
            method: POST
            headers:
              X-Vault-Token: "{{ vault_initial_root_token.stdout }}"
            body_format: json
            body: '{ "name": "{{ vault_admin_username }}", "canonical_id": "{{ entity_id }}", "mount_accessor": "{{ mount_accessor }}" }'
            status_code:
              - 200
              - 204
            return_content: true
            validate_certs: false
          register: entity_alias_raw

        - name: "HashiCorp - Vault : Ensure admin-group is present."
          ansible.builtin.uri:
            url: "{{ vault_address }}/v1/identity/group"
            method: POST
            headers:
              X-Vault-Token: "{{ vault_initial_root_token.stdout }}"
            body_format: json
            body: '{ "name": "{{ vault_admin_group_name }}", "policies": ["{{ vault_admin_policy_name }}"], "member_entity_ids": ["{{ entity_id }}"] }'
            status_code:
              - 200
              - 204
            validate_certs: false

        - name: "HashiCorp - Vault : Ensure that the KV secret engine is enabled and mounted."
          ansible.builtin.uri:
            url: "{{ vault_address }}/v1/sys/mounts/{{ vault_kv_path }}"
            method: POST
            headers:
              X-Vault-Token: "{{ vault_initial_root_token.stdout }}"
            body_format: json
            body: '{ "type": "kv-v2" }'
            status_code:
              - 200
              - 204
            validate_certs: false

      when: ansible_hostname in groups['servers']
      run_once: true
      tags: content

    - name: "HashiCorp - Vault : Create fact of admin password."
      ansible.builtin.set_fact:
        admin_password: "{{ lookup('file', vault_admin_local_path) }}"
      delegate_to: localhost
      run_once: true

    - name: "HashiCorp - Vault - Revoke root token."
      block:
        - name: "HashiCorp - Vault : Retrieve client token."
          ansible.builtin.uri:
            url: "{{ vault_address }}/v1/auth/userpass/login/{{ vault_admin_username }}"
            method: POST
            body_format: json
            body: '{ "password": "{{ admin_password }}" }'
            status_code:
              - 200
              - 204
            validate_certs: false
          register: vault_admin_login_response

        - name: "HashiCorp - Vault : Set fact of client token."
          ansible.builtin.set_fact:
            admin_token: "{{ vault_admin_login_response.json.auth.client_token }}"

        - name: "HashiCorp - Vault : Revoke root token."
          ansible.builtin.uri:
            url: "{{ vault_address }}/v1/auth/token/revoke"
            method: POST
            headers:
              X-Vault-Token: "{{ admin_token }}"
            body_format: json
            body: '{ "token": "{{ vault_initial_root_token.stdout }}" }'
            status_code:
              - 200
              - 204
            validate_certs: false
          register: vault_revoke_response

      tags: revoke
      delegate_to: "{{ groups['servers'] | first }}"
      run_once: true

    - name: "HashiCorp - Vault - Logging: Ensure logrotate file for Vault is present."
      ansible.builtin.template:
        src: "{{ vault_log_template_local }}"
        dest: "{{ vault_log_rotate_dir }}/{{ vault_log_rotate_filename }}"
        mode: 0644
      when: ansible_hostname in groups['servers']

    - name: "HashiCorp - Vault - Logging : Ensure file auditing is enabled."
      ansible.builtin.command: "{{ vault_binary }} audit enable file file_path={{ vault_log_location }}"
      environment:
        VAULT_ADDR: "{{ vault_address }}"
        VAULT_CACERT: "{{ vault_ssl_ca_dest }}"
        VAULT_SKIP_VERIFY: "true"
        VAULT_TOKEN: "{{ admin_token }}"
      changed_when: false
      when: ansible_hostname in groups['servers']
      delegate_to: "{{ groups['servers'] | first }}"
      run_once: true
      ignore_errors: true

  handlers:
    - name: Restart Vault
      ansible.builtin.service:
        name: "{{ vault_service_name }}"
        state: restarted