Merge pull request #386 from ministryofjustice/feature/DSOS-2333/ansi…

…ble-secrets-config

DSOS-2333-ansible-secrets-config

ansible/roles/ncr-bip-cmc/defaults/main.yml

@@ -17,3 +17,15 @@ s3:
     sapcar: SAPCAR_1324-80000935.EXE
 
 ssm_parameters_prefix: "bip-cmc"
+
+bip_cmc_secretsmanager_passwords:
+  bip_cmc:
+    account_name: "nomis-combined-reporting-{{ aws_environment }}"
+    secret: "/t1-ncr-bip-cmc/passwords"
+    users:
+      - cms_cluster_key:
+      - cms_admin_password:
+      - cms_db_password:
+      - lcm_password:
+      - product_key:
+      - auditing_db_password:

ansible/roles/ncr-bip-cmc/tasks/get_facts.yml

@@ -1,22 +1,15 @@
 ---
-- name: Set SSM parameters path fact from ec2 ssm-parameters-prefix and Name tag
-  set_fact:
-    ssm_parameters_path: '/{{ ssm_parameters_prefix }}/{{ ec2.tags["Name"] }}'
-
-- name: Set SSM parameters bip cmc path facts
-  set_fact:
-    ssm_parameters_path_bip_cmc_cms_cluster_key: "{{ ssm_parameters_path }}/cms_cluster_key"
-    ssm_parameters_path_bip_cmc_cms_admin_password: "{{ ssm_parameters_path }}/cms_admin_password"
-    ssm_parameters_path_bip_cmc_lcm_password: "{{ ssm_parameters_path }}/lcm_password"
-    ssm_parameters_path_bip_cmc_cms_db_password: "{{ ssm_parameters_path }}/cms_db_password"
-    ssm_parameters_path_bip_cmc_auditing_db_password: "{{ ssm_parameters_path }}/auditing_db_password"
-    ssm_parameters_path_bip_cmc_product_key: "{{ ssm_parameters_path }}/product_key"
+- name: Get BIP secrets
+  import_role:
+    name: secretsmanager-passwords
+  vars:
+    secretsmanager_passwords: "{{ bip_cmc_secretsmanager_passwords }}"
 
-- name: Get SSM parameters
+- name: Set password facts
   set_fact:
-    bip_cmc_cms_cluster_key: "{{ lookup('aws_ssm', ssm_parameters_path_bip_cmc_cms_cluster_key, region=ansible_ec2_placement_region) }}"
-    bip_cmc_cms_admin_password: "{{ lookup('aws_ssm', ssm_parameters_path_bip_cmc_cms_admin_password, region=ansible_ec2_placement_region) }}"
-    bip_cmc_lcm_password: "{{ lookup('aws_ssm', ssm_parameters_path_bip_cmc_lcm_password, region=ansible_ec2_placement_region) }}"
-    bip_cmc_cms_db_password: "{{ lookup('aws_ssm', ssm_parameters_path_bip_cmc_cms_db_password, region=ansible_ec2_placement_region) }}"
-    bip_cmc_auditing_db_password: "{{ lookup('aws_ssm', ssm_parameters_path_bip_cmc_auditing_db_password, region=ansible_ec2_placement_region) }}"
-    bip_cmc_product_key: "{{ lookup('aws_ssm', ssm_parameters_path_bip_cmc_product_key, region=ansible_ec2_placement_region) }}"
+    cms_cluster_key: "{{ secretsmanager_passwords_dict['bip_cmc'].passwords['cms_cluster_key'] }}"
+    cms_admin_password: "{{ secretsmanager_passwords_dict['bip_cmc'].passwords['cms_admin_password'] }}"
+    cms_db_password: "{{ secretsmanager_passwords_dict['bip_cmc'].passwords['cms_db_password'] }}"
+    lcm_password: "{{ secretsmanager_passwords_dict['bip_cmc'].passwords['lcm_password'] }}"
+    product_key: "{{ secretsmanager_passwords_dict['bip_cmc'].passwords['product_key'] }}"
+    auditing_db_password: "{{ secretsmanager_passwords_dict['bip_cmc'].passwords['auditing_db_password'] }}"

ansible/roles/ncr-bip/defaults/main.yml

@@ -17,3 +17,14 @@ s3:
     sapcar: SAPCAR_1324-80000935.EXE
 
 ssm_parameters_prefix: "bip"
+
+bip_secretsmanager_passwords:
+  bip:
+    account_name: "nomis-combined-reporting-{{ aws_environment }}"
+    secret: "/t1-ncr-bip/passwords"
+    users:
+      - cms_cluster_key:
+      - cms_admin_password:
+      - cms_db_password:
+      - lcm_password:
+      - product_key:

ansible/roles/ncr-bip/tasks/get_facts.yml

@@ -1,23 +1,17 @@
 ---
-- name: Set SSM parameters path fact from ec2 ssm-parameters-prefix and Name tag
-  set_fact:
-    ssm_parameters_path: '/{{ ssm_parameters_prefix }}/{{ ec2.tags["Name"] }}'
-
-- name: Set SSM parameters bip path facts
-  set_fact:
-    ssm_parameters_path_bip_cms_cluster_key: "{{ ssm_parameters_path }}/cms_cluster_key"
-    ssm_parameters_path_bip_cms_admin_password: "{{ ssm_parameters_path }}/cms_admin_password"
-    ssm_parameters_path_bip_cms_db_password: "{{ ssm_parameters_path }}/cms_db_password"
-    ssm_parameters_path_bip_lcm_password: "{{ ssm_parameters_path }}/lcm_password"
-    ssm_parameters_path_bip_product_key: "{{ ssm_parameters_path }}/product_key"
+- name: Get BIP secrets
+  import_role:
+    name: secretsmanager-passwords
+  vars:
+    secretsmanager_passwords: "{{ bip_secretsmanager_passwords }}"
 
-- name: Get SSM parameters
+- name: Set password facts
   set_fact:
-    bip_cms_cluster_key: "{{ lookup('aws_ssm', ssm_parameters_path_bip_cms_cluster_key, region=ansible_ec2_placement_region) }}"
-    bip_cms_admin_password: "{{ lookup('aws_ssm', ssm_parameters_path_bip_cms_admin_password, region=ansible_ec2_placement_region) }}"
-    bip_cms_db_password: "{{ lookup('aws_ssm', ssm_parameters_path_bip_cms_db_password, region=ansible_ec2_placement_region) }}"
-    bip_lcm_password: "{{ lookup('aws_ssm', ssm_parameters_path_bip_lcm_password, region=ansible_ec2_placement_region) }}"
-    bip_product_key: "{{ lookup('aws_ssm', ssm_parameters_path_bip_product_key, region=ansible_ec2_placement_region) }}"
+    cms_cluster_key: "{{ secretsmanager_passwords_dict['bip'].passwords['cms_cluster_key'] }}"
+    cms_admin_password: "{{ secretsmanager_passwords_dict['bip'].passwords['cms_admin_password'] }}"
+    cms_db_password: "{{ secretsmanager_passwords_dict['bip'].passwords['cms_db_password'] }}"
+    lcm_password: "{{ secretsmanager_passwords_dict['bip'].passwords['lcm_password'] }}"
+    product_key: "{{ secretsmanager_passwords_dict['bip'].passwords['product_key'] }}"
 
 - name: Set node number
   ansible.builtin.shell: "echo $(({{ ansible_ec2_ami_launch_index }}+2))"

ansible/roles/ncr-bip/tasks/install_bip.yml

@@ -31,7 +31,7 @@
       register: prereqs
       failed_when: prereqs is changed
 
-    - name: "sample task in case the String present in the file"
+    - name: "Check prereqs have passed"
       debug: msg="All product pre requesites have passed"
       when: prereqs is not changed
 

ansible/roles/ncr-tomcat/defaults/main.yml

@@ -22,3 +22,14 @@ tomcat_post_install_directories:
   custom_config: /u01/app/bobj/BIP4/sap_bobj/enterprise_xi40/warfiles/webapps/BOE/WEB-INF/config/custom
   biprws_config: /u01/app/bobj/BIP4/sap_bobj/enterprise_xi40/warfiles/webapps/biprws/WEB-INF/config/custom
   webapps_root: /u01/app/bobj/BIP4/sap_bobj/enterprise_xi40/warfiles/webapps/ROOT
+
+tomcat_secretsmanager_passwords:
+  tomcat:
+    account_name: "nomis-combined-reporting-{{ aws_environment }}"
+    secret: "/t1-ncr-bip/passwords"
+    users:
+      - cluster_key:
+      - admin_password:
+      - db_password:
+      - lcm_password:
+      - product_key:

ansible/roles/ncr-tomcat/tasks/get_facts.yml

@@ -1,14 +1,12 @@
 ---
-- name: Set SSM parameters path fact from ec2 ssm-parameters-prefix and Name tag
-  set_fact:
-    ssm_parameters_path: '/{{ ssm_parameters_prefix }}/{{ ec2.tags["Name"] }}'
-
-- name: Set SSM parameters tomcat path facts
-  set_fact:
-    ssm_parameters_path_tomcat_cms_password: "{{ ssm_parameters_path }}/cms_password"
-    ssm_parameters_path_tomcat_product_key: "{{ ssm_parameters_path }}/product_key"
+- name: Get tomcat secrets
+  import_role:
+    name: secretsmanager-passwords
+  vars:
+    secretsmanager_passwords: "{{ tomcat_secretsmanager_passwords }}"
 
-- name: Get SSM parameters
+- name: Set password facts
   set_fact:
-    tomcat_cms_password: "{{ lookup('aws_ssm', ssm_parameters_path_tomcat_cms_password, region=ansible_ec2_placement_region) }}"
-    tomcat_product_key: "{{ lookup('aws_ssm', ssm_parameters_path_tomcat_product_key, region=ansible_ec2_placement_region) }}"
+    cms_name: "{{ secretsmanager_passwords_dict['tomcat'].passwords['cms_name'] }}"
+    cms_admin_password: "{{ secretsmanager_passwords_dict['tomcat'].passwords['cms_admin_password'] }}"
+    product_key: "{{ secretsmanager_passwords_dict['tomcat'].passwords['product_key'] }}"