-
Notifications
You must be signed in to change notification settings - Fork 0
/
ssh-client.yml
71 lines (65 loc) · 1.63 KB
/
ssh-client.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
---
- name: Create temp directory
ansible.builtin.tempfile:
state: directory
suffix: ssh
register: tempdir
delegate_to: localhost
become: no
run_once: true
changed_when: false
- name: Generate SSH keys
openssh_keypair:
path: "{{ tempdir.path }}/id_rsa"
type: rsa
state: present
force: no
become: no
delegate_to: localhost
run_once: true
changed_when: false
- name: Read public key
set_fact:
temp_public_key: "{{ lookup('file', tempdir.path + '/id_rsa.pub') }} "
delegate_to: localhost
become: no
run_once: true
- name: Authenticate approle
uri:
url: "{{ app_role_login_url }}"
validate_certs: no
method: POST
body: "{{ lookup('template', 'templates/vault_approle_ids.j2') }}"
body_format: json
return_content: yes
register: approle_auth
become: no
delegate_to: localhost
run_once: true
- name: Sign public key
uri:
url: "{{ ssh_client_signer_url }}"
validate_certs: no
method: POST
headers:
X-Vault-Token: "{{ approle_auth.json.auth.client_token }}"
body: "{{ lookup('template', 'templates/vault_public_key.j2') }}"
body_format: json
return_content: yes
register: clientrole
become: no
delegate_to: localhost
run_once: true
- name: Store public signed key
copy:
content: "{{ clientrole.json.data.signed_key }}"
dest: "{{ tempdir.path }}/signed_key"
mode: '0644'
delegate_to: localhost
become: no
run_once: true
changed_when: false
- set_fact:
tempdir_path: "{{ tempdir.path }}"
ansible_ssh_extra_args: "-i {{ tempdir.path }}/signed_key"
ansible_ssh_private_key_file: "{{ tempdir.path }}/id_rsa"