---
- name: "🔐 Store the bootstrap root token in the container token helper"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec -i {{ OPENBAO_LOCAL_CID | quote }}
bao login -no-print -
args:
stdin: "{{ openbao_root_token }}"
stdin_add_newline: false
changed_when: false
delegate_to: "{{ OPENBAO_HOST_NODE }}"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "🧩 Enable the AppRole auth method"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
sh -c 'bao auth list -format=json | grep -q "approle/" || bao auth enable approle'
register: openbao_approle_enable
changed_when: openbao_approle_enable.rc == 0
delegate_to: "{{ OPENBAO_HOST_NODE }}"
- name: "📜 Write the ansible-admin policy the Ansible AppRole binds to"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
bao policy write ansible-admin {{ OPENBAO_POLICY_DIR_DOCKER }}/ansible-admin.hcl
changed_when: true
delegate_to: "{{ OPENBAO_HOST_NODE }}"
- name: "🧩 Create the Ansible AppRole"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
bao write auth/approle/role/{{ OPENBAO_ANSIBLE_APPROLE | quote }}
token_policies=ansible-admin
token_ttl=30m
token_max_ttl=1h
secret_id_num_uses=0
secret_id_ttl=0
changed_when: true
delegate_to: "{{ OPENBAO_HOST_NODE }}"
- name: "🔑 Pin the RoleID to the inventory value"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
bao write auth/approle/role/{{ OPENBAO_ANSIBLE_APPROLE | quote }}/role-id
role_id={{ OPENBAO_APPROLE_ROLE_ID | quote }}
changed_when: true
delegate_to: "{{ OPENBAO_HOST_NODE }}"
- name: "🔑 Pin the SecretID to the inventory value"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec -i {{ OPENBAO_LOCAL_CID | quote }}
bao write auth/approle/role/{{ OPENBAO_ANSIBLE_APPROLE | quote }}/custom-secret-id
secret_id=-
args:
stdin: "{{ OPENBAO_APPROLE_SECRET_ID }}"
stdin_add_newline: false
changed_when: true
delegate_to: "{{ OPENBAO_HOST_NODE }}"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "🧹 Revoke the bootstrap root token"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
sh -c 'bao token revoke -self && rm -f ~/.bao-token'
changed_when: true
delegate_to: "{{ OPENBAO_HOST_NODE }}"
- name: "🔓 Forget the root token"
ansible.builtin.set_fact:
openbao_root_token: ""
