Skip to content

Commit

Permalink
Make vault init more idempotent
Browse files Browse the repository at this point in the history
Currently if you cleanup docker volume for vault and bring docker-compose development back up with vault enabled we will not initialize vault because the secret files still exist.

This change will attempt to initialize vault reguardless and update the secret file if vault is initialized
  • Loading branch information
TheRealHaoLiu committed Nov 15, 2023
1 parent 873b1fb commit 3a01ccf
Showing 1 changed file with 9 additions and 7 deletions.
16 changes: 9 additions & 7 deletions tools/docker-compose/ansible/roles/vault/tasks/initialize.yml
Original file line number Diff line number Diff line change
@@ -1,15 +1,16 @@
---
- name: See if vault has been initialized
ansible.builtin.stat:
path: "{{ vault_file }}"
register: vault_secret_file_info

- block:
- name: Start the vault
community.docker.docker_compose:
state: present
services: vault
project_src: "{{ sources_dest }}"
register: vault_start

- name: See if vault has been initialized
ansible.builtin.stat:
path: "{{ vault_file }}"
register: vault_secret_file_info

- name: Run the initialization
community.docker.docker_container_exec:
Expand All @@ -18,6 +19,7 @@
env:
VAULT_ADDR: "http://127.0.0.1:1234"
register: vault_initialization
ignore_errors: true

- name: Write out initialization file
copy:
Expand All @@ -30,6 +32,7 @@
{{ vault_initialization.stdout_lines[4] | regex_replace('Unseal Key ', 'Unseal_Key_') }}
{{ vault_initialization.stdout_lines[6] | regex_replace('Initial Root Token', 'Initial_Root_Token') }}
dest: "{{ vault_file }}"
when: (vault_initialization.stdout_lines | length) > 0

- name: Unlock the vault
include_role:
Expand Down Expand Up @@ -58,5 +61,4 @@
community.docker.docker_compose:
state: absent
project_src: "{{ sources_dest }}"

when: not vault_secret_file_info.stat.exists
when: vault_start is defined and vault_start.changed

0 comments on commit 3a01ccf

Please sign in to comment.