---
# Re-pin the AppRole to the credentials this deploy was handed, then record what
# was applied. The AppRole rotates per deploy, so the state file is what lets the
# next one authenticate before it re-pins in turn. The seal key is pinned and
# normally repeats; it is recorded for the deploy after an operator changes it.
- name: "🔑 Re-pin the RoleID to the value this deploy was handed"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
bao write auth/approle/role/{{ OPENBAO_ANSIBLE_APPROLE | quote }}/role-id
role_id={{ OPENBAO_APPROLE_ROLE_ID | quote }}
changed_when: true
delegate_to: "{{ OPENBAO_HOST_NODE }}"
- name: "🔑 Swap the AppRole SecretID for the one this deploy was handed"
when: OPENBAO_SECRET_ID_ROTATING | bool
block:
- name: "🔑 Register the SecretID this deploy was handed"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec -i {{ OPENBAO_LOCAL_CID | quote }}
bao write auth/approle/role/{{ OPENBAO_ANSIBLE_APPROLE | quote }}/custom-secret-id
secret_id=-
args:
stdin: "{{ OPENBAO_APPROLE_SECRET_ID }}"
stdin_add_newline: false
changed_when: true
delegate_to: "{{ OPENBAO_HOST_NODE }}"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "🧹 Destroy the SecretID the previous deploy applied"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec -i {{ OPENBAO_LOCAL_CID | quote }}
bao write auth/approle/role/{{ OPENBAO_ANSIBLE_APPROLE | quote }}/secret-id/destroy
secret_id=-
args:
stdin: "{{ OPENBAO_SECRET_ID_REGISTERED }}"
stdin_add_newline: false
changed_when: true
delegate_to: "{{ OPENBAO_HOST_NODE }}"
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "💾 Record the credentials this deploy applied"
ansible.builtin.copy:
content: "{{ openbao_applied_now | to_nice_json }}\n"
dest: "{{ OPENBAO_APPLIED_STATE_HOST }}"
owner: root
group: root
mode: "0600"
vars:
openbao_applied_now:
seal_key: "{{ OPENBAO_SEAL_KEY }}"
approle_role_id: "{{ OPENBAO_APPROLE_ROLE_ID }}"
approle_secret_id: "{{ OPENBAO_APPROLE_SECRET_ID }}"
delegate_to: "{{ STACK_HOST }}"
run_once: true
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
