Consul binary (#145)

* first fresh run of new version - wip

* rerun from scratch

* added vault rekey playbook

* suppress community.general.terraform invocations

* fully ported scaleway demo to rocky linux

* consul ported to rocky

* envoy ported to rocky

* envoy port to rocky

docs/source/explanations/ansible_terraform.md

@@ -22,8 +22,7 @@ disponibility.
 * Inject configuration into Vault, Consul and Nomad.
 
 Every piece of Terraform code is intended to be managed by the 
-[community.general.terraform](https://docs.ansible.com/ansible/latest/collections/community/general/terraform_module.html) 
-Ansible module.
+[cloud.terraform.terraform](https://github.com/ansible-collections/cloud.terraform/blob/main/docs/cloud.terraform.terraform_module.rst) Ansible module.
 
 ## Terraform code
 

playbooks/01_infra_aws.yml

@@ -40,7 +40,7 @@
       when: tf_action == 'apply'
 
     - name: COMMON - Do Terraform
-      community.general.terraform:
+      cloud.terraform.terraform:
         project_path: "{{ tf_module_dest }}"
         state: "{{ (tf_action == 'destroy') | ternary('absent', 'present') }}"
         force_init: true

playbooks/13_core_scaleway_dns_delegation.yml

@@ -23,7 +23,7 @@
       when: tf_action == 'apply'
 
     - name: COMMON - Do Terraform
-      community.general.terraform:
+      cloud.terraform.terraform:
         project_path: "{{ tf_module_dest }}"
         state: "{{ (tf_action == 'destroy') | ternary('absent', 'present') }}"
         force_init: true

playbooks/init.yml

@@ -39,6 +39,14 @@
       loop_control:
         loop_var: _current_dir
 
+    - name: "[MONO] Create directory for inventory"
+      file:
+        path: "{{ _output_dir }}/host_vars/{{ hs_workspace }}-{{ hs_archi }}"
+        state: directory
+        recurse: true
+      when:
+        - hs_archi == 'mono'
+
     - name: Create global variables
       copy:
         dest: "{{ _output_dir }}/group_vars/all.yml"
@@ -50,7 +58,9 @@
           {%- raw %}
           public_domain: "{{ hs_workspace }}.{{ hs_parent_domain }}"
           hs_stage0_archi: "{{ hs_archi }}"
-          hs_stage0_instance_type: "DEV1-L"
+          hs_stage0_instance_type: "PLAY2-MICRO"
+          hs_stage0_instance_image: "debian_bookworm"
+          # hs_stage0_instance_image: "rockylinux_9"
           {% endraw -%}
 
     - name: Create inventory files

playbooks/op_flush_vault_masters.yml

@@ -8,6 +8,16 @@
     force_flush: false
 
   tasks:
+    - name: "Load vault role variables"
+      import_role:
+        name: "vault_vars"
+
+    - name: "Load secret dir"
+      include_vars:
+        dir: "{{ hs_vault_local_secret_dir }}"
+        ignore_unknown_extensions: true
+      no_log: true
+
     - name: Stop vault
       systemd:
         name: vault
@@ -28,3 +38,10 @@
         group: vault
         mode: 0750
       when: force_flush
+
+    - name: Flush local root_vault
+      file:
+        path: "{{ hs_vault_local_secret_dir }}/root_vault.yml"
+        state: absent
+      delegate_to: localhost
+      become: false

playbooks/vault_dr_secondary.yml

@@ -138,7 +138,7 @@
       run_once: true
 
     - name: "Do Terraform"
-      community.general.terraform:
+      cloud.terraform.terraform:
         project_path: "{{ hs_vault_terraform_work_dir }}/dr_secondary_activation"
         state: "present"    # noqa args
         force_init: true

playbooks/vault_rekey.yml

@@ -0,0 +1,138 @@
+---
+- name: "Rotate the vault root key"
+  hosts: "{{ hs_vault_inventory_masters_group | default('hashistack_masters[0]') }}"
+  become: true
+  gather_facts: true
+  strategy: linear
+
+  pre_tasks:
+    - name: "Load vault role variables"
+      import_role:
+        name: "vault_vars"
+
+    - name: "Load secret dir"
+      include_vars:
+        dir: "{{ hs_vault_local_secret_dir }}"
+        ignore_unknown_extensions: true
+      no_log: true
+
+    - name: Variable cooking
+      set_fact:
+        __vault_rekey_addr: "{{ __hs_vault_conf_api_addr }}"
+        __vault_rekey_shares: "{{ hs_vault_unseal_key_shares }}"
+        __vault_rekey_threshold: "{{ hs_vault_unseal_key_threshold }}"
+        __vault_rekey_old_keys: "{{ vault_init_content['keys'] }}"
+
+    - name: Variable cooking
+      set_fact:
+        __vault_rekey_api_endpoints:
+          rekey: "{{ __vault_rekey_addr }}/v1/sys/rekey/init"
+          rekey_update: "{{ __vault_rekey_addr }}/v1/sys/rekey/update"
+          genroot: "{{ __vault_rekey_addr }}/v1/sys/generate-root/attempt"
+          genroot_update: "{{ __vault_rekey_addr }}/v1/sys/generate-root/update"
+          genroot_decode: "{{ __vault_rekey_addr }}/v1/sys/decode-token"
+
+  tasks:
+    - name: Start vault rekey process
+      uri:
+        url: "{{ __vault_rekey_api_endpoints.rekey }}"
+        method: POST
+        body_format: json
+        body:
+          secret_shares: "{{ __vault_rekey_shares }}"
+          secret_threshold: "{{ __vault_rekey_threshold }}"
+        return_content: true
+      register: _vault_rekey_process
+
+    - name: Rekey steps
+      uri:
+        url: "{{ __vault_rekey_api_endpoints.rekey_update }}"
+        method: POST
+        body_format: json
+        body:
+          key: "{{ _current_key }}"
+          nonce: "{{ _vault_rekey_process.json.nonce }}"
+        return_content: true
+      loop: "{{ __vault_rekey_old_keys[:(__vault_rekey_threshold)] }}"
+      loop_control:
+        loop_var: _current_key
+      register: _vault_rekey_updates
+
+    - name: Variable cooking
+      set_fact:
+        _vault_rekey_new_keys: >-
+          {{ _vault_rekey_updates.results[-1].json['keys'] }}
+        _vault_rekey_new_keys_base64: >-
+          {{ _vault_rekey_updates.results[-1].json['keys_base64'] }}
+
+    - name: Start vault genroot process
+      uri:
+        url: "{{ __vault_rekey_api_endpoints.genroot }}"
+        method: POST
+        body_format: json
+        return_content: true
+      register: _vault_rekey_genroot_process
+
+    - name: "Variable cooking"
+      set_fact:
+        _vault_rekey_genroot_nonce: "{{ _vault_rekey_genroot_process.json.nonce }}"
+        _vault_rekey_genroot_otp: "{{ _vault_rekey_genroot_process.json.otp }}"
+
+    - name: Send current seal shards
+      uri:
+        url: "{{ __vault_rekey_api_endpoints.genroot_update }}"
+        method: POST
+        body_format: json
+        body:
+          key: "{{ _current_key }}"
+          nonce: "{{ _vault_rekey_genroot_nonce }}"
+        return_content: true
+      loop: "{{ _vault_rekey_new_keys[:(__vault_rekey_threshold)] }}"
+      loop_control:
+        loop_var: _current_key
+      register: _vault_rekey_genroot_updates
+
+    - name: "Variable cooking"
+      set_fact:
+        _vault_rekey_genroot_encoded_root_token: >-
+          {{ _vault_rekey_genroot_updates.results[-1].json.encoded_token }}
+
+    - name: Decode
+      uri:
+        url: "{{ __vault_rekey_api_endpoints.genroot_decode }}"
+        method: POST
+        body_format: json
+        body:
+          encoded_token: "{{ _vault_rekey_genroot_encoded_root_token }}"
+          otp: "{{ _vault_rekey_genroot_otp }}"
+        return_content: true
+      register: _vault_rekey_genroot_decoded
+
+    - name: Store vault root secrets
+      copy:
+        dest: "{{ hs_vault_local_unseal_file }}"
+        mode: 0600
+        content: |-
+          ---
+          {{
+            {
+              'vault_init_content': {
+                'keys': _vault_rekey_new_keys,
+                'keys_base64': _vault_rekey_new_keys_base64,
+                'root_token': _vault_rekey_genroot_decoded.json.data.token
+              }
+            } | to_nice_yaml
+          }}
+      register: _hs_vault_store_root
+      become: false
+      delegate_to: localhost
+
+    - name: Encrypt vault init keys if ANSIBLE_VAULT_PASSWORD_FILE is defined
+      command: >-
+        ansible-vault encrypt {{ hs_vault_local_unseal_file }}
+      become: false
+      delegate_to: localhost
+      when:
+        - _hs_vault_store_root is changed
+        - (lookup('env', 'ANSIBLE_VAULT_PASSWORD_FILE') | length) > 0
+

requirements.yml

@@ -19,4 +19,4 @@ collections:
   - name: cloud.terraform
     version: "1.1.1"
   - name: rtnp.galaxie_clans
-    version: "1.15.1"
+    version: "1.15.3"

roles/consul/defaults/main.yml

@@ -5,8 +5,12 @@
 #
 # ## Defaults
 #
-# * Consul version to install (Debian package name referring )
-hs_consul_version: "1.13.7-1"
+# * Version of the consul package to install.
+# * Used to determine which archive to install according to the suffix like
+# [in the official release repository](https://releases.hashicorp.com/consul/). For example,
+# valid values are: '1.16.4', '1.17.0+ent', '1.17.2+ent.fips1402', etc.
+hs_consul_version: "1.17.2"
+#
 # ### Local paths
 #
 # * Path to local directory containing secrets to be uploaded to nodes
@@ -23,20 +27,14 @@ hs_consul_node_cert_fullchain: "{{ hs_consul_local_secrets_dir }}/self.fullchain
 # * Path to local node certificate private key.
 hs_consul_node_cert_private_key: "{{ hs_consul_local_secrets_dir }}/self.cert.key"
 
-hs_consul_ca_certificate_dir: "/usr/local/share/ca-certificates"
-hs_consul_ca_certificate: "/etc/ssl/certs/ca-certificates.crt"
-
 tf_module_name: "consul_config"
 hs_tf_action: apply
 
-hs_consul_datacenter_name: >-
-  {{
-    hs_workspace
-    | default('datacenter1')
-  }}
+hs_consul_datacenter_name: "{{ hs_workspace | default('datacenter1') }}"
 hs_consul_node_name: "{{ inventory_hostname | regex_replace('_', '-') }}"
 hs_consul_connect_token: ~
 
+hs_consul_local_cache_dir: "{{ hs_workspace_root }}"
 hs_consul_prometheus_enabled: true
 hs_consul_connect_root_pki_path: "consul_connect_pki_root"
 hs_consul_connect_intermediate_pki_path: "consul_connect_pki_inter"
@@ -60,6 +58,3 @@ hs_consul_local_ca_cert: "{{ hs_workspace_secrets_dir }}/ca.cert.pem"
 hs_consul_acl_default_policy: deny
 hs_consul_acl_auto_encrypt_token: ~
 
-hs_consul_packages_list:
-  - "consul={{ hs_consul_version }}"
-

roles/consul/handlers/main.yml

@@ -7,7 +7,7 @@
 
 - name: Update ca trust
   command: >-
-    /usr/sbin/update-ca-certificates
+    {{ __hs_consul_update_trust_command }}
 
 - name: "Restart vault-sidecar"
   systemd:

roles/consul/tasks/_tf_configure.yml

@@ -7,7 +7,7 @@
   become: false
   run_once: true
 
-- name: Validate API avalability
+- name: Validate API availability
   uri:
     url: "{{ hs_consul_external_url }}/v1/agent/members"
     headers:
@@ -31,7 +31,7 @@
   run_once: true
 
 - name: "COMMON - Do Terraform (can take up to 30 minutes)"
-  community.general.terraform:
+  cloud.terraform.terraform:
     project_path: "{{ tf_module_dest }}"
     state: "{{ (tf_action == 'destroy') | ternary('absent', 'present') }}"    # noqa args
     force_init: true

roles/consul/tasks/debian/_configure.yml → roles/consul/tasks/common/_configure.yml

@@ -1,43 +1,11 @@
 ---
-- name: Check directories exist
-  file:
-    path: "{{ _current_expected_dir }}"
-    owner: consul
-    group: consul
-    state: directory
-    mode: 0700
-  loop: "{{ __hs_consul_expected_directories }}"
-  loop_control:
-    loop_var: _current_expected_dir
-  tags:
-    - configure
-
-- name: Common private ssl directory
-  file:
-    path: "{{ __hs_consul_tls_dir }}"
-    owner: root
-    group: "{{ __hs_consul_ssl_cert_group }}"
-    state: directory
-    mode: 0750
-  tags:
-    - configure
-
-- name: Add consul user to ssl-cert group
-  user:
-    name: consul
-    groups: "{{ __hs_consul_ssl_cert_group }}"
-    append: true
-  tags:
-    - configure
-
-
-- name: Explicitly load secret dir
+- name: "Explicitly load local secret dir"
   include_vars:
     dir: "{{ hs_consul_local_secrets_dir }}"
     ignore_unknown_extensions: true
   no_log: true
 
-- name: Upload Vault Root CA
+- name: "Add vault ca to truststore"
   copy:
     dest: "{{ __hs_consul_vault_root_ca_certificate }}"
     content: |-
@@ -49,7 +17,7 @@
   tags:
     - configure
 
-- name: Upload CA certificate
+- name: "Add custom-ca to truststore"
   copy:
     src: "{{ hs_consul_local_ca_cert }}"
     dest: "{{ __hs_consul_ca_certificate }}"
@@ -66,7 +34,7 @@
   tags:
     - configure
 
-- name: Upload self certificate
+- name: "Upload cert for consul endpoints"
   copy:
     src: "{{ _current_cert_part }}"
     dest: "{{ __hs_consul_tls_dir }}/{{ _current_cert_part.split('/')[-1] }}"
@@ -84,7 +52,7 @@
   tags:
     - configure
 
-- name: Generate encrypt key
+- name: "[LOCAL] Generate encrypt key"
   copy:
     dest: "{{ __hs_consul_encrypt_key_local_path }}"
     mode: 0600
@@ -100,14 +68,15 @@
   tags:
     - configure
 
-- name: Write consul server configuration
+- name: "Render consul server configuration"
   template:
     src: "consul.hcl.j2"
     dest: "{{ __hs_consul_conf_file }}"
-    owner: consul
+    owner: root
     group: consul
     mode: 0640
   notify: Restart consul
   tags:
     - configure
 
+