154 lines
5.2 KiB
YAML
154 lines
5.2 KiB
YAML
---
|
|
- block:
|
|
- name: Generate privatekey
|
|
openssl_privatekey:
|
|
path: "{{ output_dir }}/ansible_{{ key }}.key"
|
|
size: 2048
|
|
mode: "0666"
|
|
loop:
|
|
- key1
|
|
- key2
|
|
loop_control:
|
|
loop_var: key
|
|
|
|
- name: Generate CSR
|
|
openssl_csr:
|
|
path: "{{ output_dir }}/ansible_{{ key }}.csr"
|
|
privatekey_path: "{{ output_dir }}/ansible_{{ key }}.key"
|
|
basic_constraints:
|
|
- "CA:TRUE"
|
|
key_usage:
|
|
- keyCertSign
|
|
loop:
|
|
- key1
|
|
- key2
|
|
loop_control:
|
|
loop_var: key
|
|
|
|
- name: Generate self-signed certificate
|
|
openssl_certificate:
|
|
path: "{{ output_dir }}/ansible_{{ key }}.pem"
|
|
privatekey_path: "{{ output_dir }}/ansible_{{ key }}.key"
|
|
csr_path: "{{ output_dir }}/ansible_{{ key }}.csr"
|
|
provider: selfsigned
|
|
loop:
|
|
- key1
|
|
- key2
|
|
loop_control:
|
|
loop_var: key
|
|
|
|
###################################################################
|
|
## signing_ca_cert and signing_ca_key #############################
|
|
###################################################################
|
|
- name: signing_ca_cert and signing_ca_key (check mode)
|
|
docker_swarm:
|
|
advertise_addr: "{{ansible_default_ipv4.address | default('127.0.0.1')}}"
|
|
state: present
|
|
signing_ca_cert: "{{ lookup('file', output_dir ~ '/ansible_key1.pem') }}"
|
|
signing_ca_key: "{{ lookup('file', output_dir ~ '/ansible_key1.key') }}"
|
|
timeout: 120
|
|
check_mode: yes
|
|
diff: yes
|
|
register: output_1
|
|
ignore_errors: yes
|
|
|
|
- name: signing_ca_cert and signing_ca_key
|
|
docker_swarm:
|
|
advertise_addr: "{{ansible_default_ipv4.address | default('127.0.0.1')}}"
|
|
state: present
|
|
signing_ca_cert: "{{ lookup('file', output_dir ~ '/ansible_key1.pem') }}"
|
|
signing_ca_key: "{{ lookup('file', output_dir ~ '/ansible_key1.key') }}"
|
|
timeout: 120
|
|
diff: yes
|
|
register: output_2
|
|
ignore_errors: yes
|
|
|
|
- name: Private key
|
|
debug: msg="{{ lookup('file', output_dir ~ '/ansible_key1.key') }}"
|
|
- name: Cert
|
|
debug: msg="{{ lookup('file', output_dir ~ '/ansible_key1.pem') }}"
|
|
- docker_swarm_facts:
|
|
register: output
|
|
ignore_errors: yes
|
|
- debug: var=output
|
|
|
|
# Idempotence for CA cert and key don't work yet! FIXME
|
|
|
|
#- name: signing_ca_cert and signing_ca_key (idempotent)
|
|
# docker_swarm:
|
|
# state: present
|
|
# signing_ca_cert: "{{ lookup('file', output_dir ~ '/ansible_key1.pem') }}"
|
|
# signing_ca_key: "{{ lookup('file', output_dir ~ '/ansible_key1.key') }}"
|
|
# timeout: 120
|
|
# diff: yes
|
|
# register: output_3
|
|
# ignore_errors: yes
|
|
|
|
#- name: signing_ca_cert and signing_ca_key (idempotent, check mode)
|
|
# docker_swarm:
|
|
# state: present
|
|
# signing_ca_cert: "{{ lookup('file', output_dir ~ '/ansible_key1.pem') }}"
|
|
# signing_ca_key: "{{ lookup('file', output_dir ~ '/ansible_key1.key') }}"
|
|
# timeout: 120
|
|
# check_mode: yes
|
|
# diff: yes
|
|
# register: output_4
|
|
# ignore_errors: yes
|
|
|
|
- name: signing_ca_cert and signing_ca_key (change, check mode)
|
|
docker_swarm:
|
|
state: present
|
|
signing_ca_cert: "{{ lookup('file', output_dir ~ '/ansible_key2.pem') }}"
|
|
signing_ca_key: "{{ lookup('file', output_dir ~ '/ansible_key2.key') }}"
|
|
timeout: 120
|
|
check_mode: yes
|
|
diff: yes
|
|
register: output_5
|
|
ignore_errors: yes
|
|
|
|
- name: signing_ca_cert and signing_ca_key (change)
|
|
docker_swarm:
|
|
state: present
|
|
signing_ca_cert: "{{ lookup('file', output_dir ~ '/ansible_key2.pem') }}"
|
|
signing_ca_key: "{{ lookup('file', output_dir ~ '/ansible_key2.key') }}"
|
|
timeout: 120
|
|
diff: yes
|
|
register: output_6
|
|
ignore_errors: yes
|
|
|
|
- name: assert signing_ca_cert and signing_ca_key
|
|
assert:
|
|
that:
|
|
- 'output_1 is changed'
|
|
- 'output_1.actions[0] | regex_search("New Swarm cluster created: ")'
|
|
- 'output_1.diff.before is defined'
|
|
- 'output_1.diff.after is defined'
|
|
- 'output_2 is changed'
|
|
- 'output_2.actions[0] | regex_search("New Swarm cluster created: ")'
|
|
- 'output_2.diff.before is defined'
|
|
- 'output_2.diff.after is defined'
|
|
#- 'output_3 is not changed'
|
|
#- 'output_3.actions[0] == "No modification"'
|
|
#- 'output_3.diff.before is defined'
|
|
#- 'output_3.diff.after is defined'
|
|
#- 'output_4 is not changed'
|
|
#- 'output_4.actions[0] == "No modification"'
|
|
#- 'output_4.diff.before is defined'
|
|
#- 'output_4.diff.after is defined'
|
|
- 'output_5 is changed'
|
|
- 'output_5.actions[0] == "Swarm cluster updated"'
|
|
- 'output_5.diff.before is defined'
|
|
- 'output_5.diff.after is defined'
|
|
- 'output_6 is changed'
|
|
- 'output_6.actions[0] == "Swarm cluster updated"'
|
|
- 'output_6.diff.before is defined'
|
|
- 'output_6.diff.after is defined'
|
|
when: docker_py_version is version('2.6.0', '>=')
|
|
- assert:
|
|
that:
|
|
- output_1 is failed
|
|
- "('version is ' ~ docker_py_version ~'. Minimum version required is 2.6.0') in output_1.msg"
|
|
when: docker_py_version is version('2.6.0', '<')
|
|
|
|
# https://github.com/ansible/ansible/issues/34054: openssl_certificate unusable on RHEL 7
|
|
when: pyopenssl_version.stdout is version('0.15', '>=')
|