Skip to content

Commit 5546068

Browse files
aurelienmauryaurelienmaury
committed
snapshot wip
1 parent 6a2870d commit 5546068

File tree

12 files changed

+217
-10
lines changed

12 files changed

+217
-10
lines changed

‎playbooks/vault_snapshot.yml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
- name: "[VAULT] Snapshot"
3+
hosts: "hashistack_masters[0]"
4+
become: false
5+
gather_facts: true
6+
7+
vars:
8+
ansible_ssh_user: "vault-snapshot"
9+
10+
tasks:
11+
- name: "Vault"
12+
include_role:
13+
name: "vault"
14+
tasks_from: "__snapshot.yml"
15+
apply:
16+
tags:
17+
- vault
18+
tags:
19+
- vault
20+

‎roles/infra/templates/scw_one/_group_vars.hashistack.yml.j2

+7
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,13 @@ glxclans_host_service_user_default_key_dir: "group_vars/hashistack/secrets"
4545
glxclans_host_service_user_default_private_key_file: >-
4646
{{ glxclans_host_service_user_default_key_dir }}/default.key
4747

48+
hs_vault_addon_snapshot_authorized_keys:
49+
- >-
50+
{{
51+
lookup('file',
52+
hs_workspace_root + '/' + glxclans_host_service_user_default_private_key_file + '.pub')
53+
}}
54+
4855
hs_vault_service_fqdn: "vault.{{ public_domain }}"
4956
#
5057
# Role configuration: wescale.hashistack.consul

‎roles/stage1_bootstrap/tasks/common/_normalize.yml

+1-2
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,7 @@
44
path: "{{ hs_workspace_root }}/ssh.cfg"
55
regexp: >-
66
^ User *{{ hs_infra_default_user }}$
7-
replace: >-
8-
User {{ glxclans_host_service_user_name }}
7+
replace: " User {{ glxclans_host_service_user_name }}"
98
become: false
109
run_once: true
1110
delegate_to: localhost

‎roles/vault/files/snapshot/main.tf

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
locals {
2+
policy_name = "snapshot"
3+
policy_file_snapshot = "${path.module}/policies/snapshot.hcl"
4+
}
5+
6+
resource "vault_policy" "snapshot" {
7+
name = local.policy_name
8+
policy = file(local.policy_file_snapshot)
9+
}
10+
11+
resource "vault_token" "snapshot" {
12+
policies = [vault_policy.snapshot.name]
13+
no_parent = true
14+
}
15+

‎roles/vault/files/snapshot/output.tf

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
output "snapshot_token" {
2+
sensitive = true
3+
value = vault_token.snapshot.client_token
4+
}
5+
6+

‎roles/vault/files/snapshot/policies/snapshot.hcl

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
path "/sys/storage/raft/snapshot" {
2+
capabilities = ["read"]
3+
}
4+

‎roles/vault/files/snapshot/providers.tf

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_providers {
3+
vault = {
4+
source = "hashicorp/vault"
5+
version = "4.3.0"
6+
}
7+
}
8+
}
9+
10+
provider "vault" {}

‎roles/vault/tasks/__snapshot.yml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
# Implementation of:
3+
# https://developer.hashicorp.com/vault/tutorials/standard-procedures/sop-backup
4+
- name: "Load collection common vars"
5+
import_role:
6+
name: "vault_vars"
7+
tags:
8+
- always
9+
10+
- name: "Snapshot"
11+
shell:
12+
cmd: >-
13+
source {{ __hs_vault_snapshot_home_dir }}/.bash_profile &&
14+
vault operator raft snapshot save vault.{{ ansible_date_time.iso8601_basic_short }}.snapshot
15+
executable: /usr/bin/bash
16+

‎roles/vault/tasks/common/_configure.yml

+8-8
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
---
2-
- name: Common private ssl directory
2+
- name: "Common private ssl directory"
33
file:
44
path: "{{ __hs_vault_tls_dir }}"
55
owner: root
66
group: "{{ __hs_vault_ssl_cert_group }}"
77
state: directory
88
mode: 0750
99

10-
- name: Add vault to ssl-cert group
10+
- name: "Add vault to ssl-cert group"
1111
user:
1212
name: vault
1313
groups: "{{ __hs_vault_ssl_cert_group }}"
1414
append: true
1515

16-
- name: Upload CA certificate
16+
- name: "Upload CA certificate"
1717
copy:
1818
src: "{{ hs_vault_local_ca_cert }}"
1919
dest: "{{ __hs_vault_ca_certificate }}"
@@ -23,10 +23,10 @@
2323
notify: Update ca trust
2424
when: hs_vault_use_custom_ca
2525

26-
- name: Flush
26+
- name: "Flush"
2727
meta: flush_handlers
2828

29-
- name: Upload self certificate
29+
- name: "Upload self certificate"
3030
copy:
3131
src: "{{ _current_cert_part }}"
3232
dest: "{{ __hs_vault_tls_dir }}/{{ _current_cert_part.split('/')[-1] }}"
@@ -41,7 +41,7 @@
4141
loop_var: _current_cert_part
4242
notify: Restart vault
4343

44-
- name: Upload license file if present
44+
- name: "Upload license file if present"
4545
copy:
4646
src: "{{ hs_vault_local_license_file }}"
4747
dest: "{{ __hs_vault_license_file }}"
@@ -52,7 +52,7 @@
5252
when:
5353
- (hs_vault_local_license_file | length) > 0
5454

55-
- name: Write vault server configuration
55+
- name: "Write vault server configuration"
5656
template:
5757
src: "vault-server.hcl.j2"
5858
dest: "{{ __hs_vault_conf_file }}"
@@ -62,5 +62,5 @@
6262
notify: Restart vault
6363
when: __hs_vault_is_master
6464

65-
- name: Flush
65+
- name: "Flush"
6666
meta: flush_handlers

‎roles/vault/tasks/tf_addons/_snapshot.yml

+110
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
---
2+
- name: "Create vault-snapshot system user"
3+
user:
4+
name: vault-snapshot
5+
system: true
6+
shell: "/usr/bin/bash"
7+
group: vault
8+
createhome: false
9+
home: "{{ __hs_vault_snapshot_home_dir }}"
10+
password: >-
11+
{{ lookup('community.general.random_string', length=32, special=false) }}
12+
13+
14+
- name: "Create vault snapshot user home directory"
15+
file:
16+
path: "{{ __hs_vault_snapshot_home_dir }}"
17+
state: directory
18+
owner: vault-snapshot
19+
group: vault
20+
mode: 0700
21+
22+
- name: "Authorize snapshot user keys"
23+
ansible.posix.authorized_key:
24+
user: vault-snapshot
25+
key: "{{ _current_public_key }}"
26+
exclusive: false
27+
manage_dir: true
28+
loop: "{{ hs_vault_addon_snapshot_authorized_keys }}"
29+
loop_control:
30+
loop_var: _current_public_key
31+
32+
- name: "[LOCAL] Render {{ _current_conf_addon }} addon" # noqa risky-file-permissions name[template]
33+
copy:
34+
src: "{{ role_path }}/files/{{ _current_conf_addon }}/"
35+
dest: "{{ hs_vault_terraform_work_dir }}/vault_addon_{{ _current_conf_addon }}/"
36+
delegate_to: localhost
37+
become: false
38+
when:
39+
- __hs_vault_is_first_master
40+
41+
- name: "[LOCAL] Render backend tf file"
42+
template:
43+
src: "tf_backend_{{ hs_vault_terraform_backend_type }}.tf.j2"
44+
dest: "{{ hs_vault_terraform_work_dir }}/vault_addon_{{ _current_conf_addon }}/backend.tf"
45+
mode: 0644
46+
delegate_to: localhost
47+
become: false
48+
when:
49+
- __hs_vault_is_first_master
50+
- hs_vault_terraform_backend_type is defined
51+
- (hs_vault_terraform_backend_type | length) > 0
52+
- hs_vault_terraform_backend_type in ['s3']
53+
54+
- name: "[LOCAL] Apply {{ _current_conf_addon }} addon" # noqa name[template]
55+
cloud.terraform.terraform:
56+
project_path: "{{ hs_vault_terraform_work_dir }}/vault_addon_{{ _current_conf_addon }}"
57+
state: "present" # noqa args
58+
force_init: true
59+
backend_config: "{{ hs_vault_terraform_backend_config }}"
60+
init_reconfigure: true
61+
provider_upgrade: "{{ hs_tf_provider_upgrade | default(true) }}"
62+
workspace: "{{ hs_vault_cluster_name }}"
63+
environment:
64+
VAULT_ADDR: "{{ hs_vault_external_url }}"
65+
VAULT_TOKEN: "{{ vault_init_content.root_token }}"
66+
VAULT_CACERT: "{{ hs_vault_use_custom_ca | ternary(hs_vault_local_ca_cert, '') }}"
67+
TF_CLI_ARGS: ""
68+
TF_CLI_ARGS_init: ""
69+
TF_CLI_ARGS_plan: ""
70+
TF_CLI_ARGS_apply: ""
71+
TF_CLI_ARGS_destroy: ""
72+
register: tf_result
73+
throttle: 1
74+
delegate_to: localhost
75+
become: false
76+
when:
77+
- __hs_vault_is_first_master
78+
79+
- name: "[LOCAL] Render {{ _current_conf_addon }} addon outputs" # noqa name[template]
80+
copy:
81+
dest: "{{ hs_vault_local_secret_dir }}/vault_addon_{{ _current_conf_addon }}.yml"
82+
content: |-
83+
---
84+
{{
85+
{
86+
'hs_vault_snapshot_token': tf_result.outputs.snapshot_token.value
87+
} | to_nice_yaml(indent=2)
88+
}}
89+
mode: 0600
90+
delegate_to: localhost
91+
become: false
92+
when:
93+
- __hs_vault_is_first_master
94+
95+
- name: "Load secret dir"
96+
include_vars:
97+
dir: "{{ hs_vault_local_secret_dir }}"
98+
ignore_unknown_extensions: true
99+
no_log: true
100+
101+
- name: "Render snapshot user bash profile"
102+
copy:
103+
dest: "{{ __hs_vault_snapshot_home_dir }}/.bash_profile"
104+
content: |-
105+
export PATH="/usr/bin/vault:${PATH}"
106+
export VAULT_ADDR="https://{{ hs_vault_api_address }}:{{ hs_vault_api_port }}"
107+
export VAULT_TOKEN="{{ hs_vault_snapshot_token }}"
108+
mode: 0600
109+
owner: vault-snapshot
110+
group: vault

‎roles/vault_vars/defaults/main.yml

+19
Original file line numberDiff line numberDiff line change
@@ -119,11 +119,19 @@ hs_vault_enable_default_policies: true
119119
# See below for specific configuration variables
120120
hs_vault_enabled_addons:
121121
- "telemetry"
122+
- "snapshot"
122123
- "consul_service_mesh_ca"
123124
- "nomad"
124125

125126
# #### auth_ldap
126127

128+
# ```{admonition} Purpose
129+
# :class: note
130+
# Configure Vault instance auth engine backed by a third-party ldap service.
131+
#
132+
# See also: [Vault LDAP auth API](https://developer.hashicorp.com/vault/api-docs/auth/ldap)
133+
# ```
134+
127135
# * Mount point of the auth engine in vault.
128136
hs_vault_addon_auth_ldap_path: 'ldap'
129137

@@ -145,3 +153,14 @@ hs_vault_addon_auth_ldap_group_filter: '' # MUST escape Go template by using
145153
# :class: note
146154
# * [Vault LDAP auth API](https://developer.hashicorp.com/vault/api-docs/auth/ldap)
147155
# ```
156+
157+
# ### snapshot
158+
159+
# ```{admonition} Purpose
160+
# :class: note
161+
# Configure Vault cluster hosts with a `vault-snapshot` user and a least-privilege policy token
162+
# for taking snapshots from this user.
163+
# ```
164+
165+
# * List of public keys values to authorize for the `vault-snapshot` user.
166+
hs_vault_addon_snapshot_authorized_keys: []

‎roles/vault_vars/vars/main.yml

+1
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ __hs_vault_ssl_cert_group: "ssl-cert"
2525

2626
__hs_vault_conf_dir: "/etc/vault.d"
2727
__hs_vault_home_dir: "/opt/vault"
28+
__hs_vault_snapshot_home_dir: "/opt/vault-snapshot"
2829
__hs_vault_data_dir: "{{ __hs_vault_home_dir }}/data"
2930

3031
__hs_vault_conf_file: "{{ __hs_vault_conf_dir }}/vault.hcl"

0 commit comments

Comments
 (0)