Push kolla-ansible passwords in Hashicorp Vault and replace plaintext password by Vault lookups.
Hashicorp Vault and Kolla Ansible, Part I: Integrate Vault secrets in your playbook
Hashicorp Vault and Kolla Ansible, Part II: integration with Gitlab CI
store_kolla_passwords.go
: push the passwords frompasswords.yml
into Hashicorp Vault. Equivalent ofkolla-writepwd
.replace_kolla_passwords.go
: replace the plaintext passwords by lookups.
kolla-genpwd
export VAULT_TOKEN=$(vault print token)
go mod init kolla-vault
go get github.com/hashicorp/vault/api
go get gopkg.in/yaml.v2
go run store_kolla_passwords.go
go run replace_kolla_passwords.go
go build -o export_kolla_passwords store_kolla_passwords.go
go build -o replace_kolla_passwords replace_kolla_passwords.go
nova_database_password: '{{ lookup('community.general.hashi_vault', 'secret/data/kolla/default/nova_database_password', 'url={{ vault_url }}', token=lookup('env', 'VAULT_TOKEN')) }}'
nova_keystone_password: '{{ lookup('community.general.hashi_vault', 'secret/data/kolla/default/nova_keystone_password', 'url={{ vault_url }}', token=lookup('env', 'VAULT_TOKEN')) }}'
nova_ssh_key: 'map[private_key:{{ lookup('community.general.hashi_vault', 'secret/data/kolla/default/nova_ssh_key/private_key', 'url={{ vault_url }}', token=lookup('env', 'VAULT_TOKEN')) }} public_key:{{ lookup('community.general.hashi_vault', 'secret/data/kolla/default/nova_ssh_key/public_key', 'url={{ vault_url }}', token=lookup('env', 'VAULT_TOKEN')) }}]'
nova_api_database_password: '{{ lookup('community.general.hashi_vault', 'secret/data/kolla/default/nova_api_database_password', 'url={{ vault_url }}', token=lookup('env', 'VAULT_TOKEN')) }}'