27 lines
1.1 KiB
YAML
27 lines
1.1 KiB
YAML
---
|
|
# Read the shared postgres owner password from Vault; generate and store it if missing.
|
|
# Sets __cloudnativepg_operator_password, consumed by the K8s secret tasks in main.yml.
|
|
|
|
- name: Read cloudnativepg postgres password from Vault
|
|
community.hashi_vault.vault_kv2_get:
|
|
path: "{{ cloudnativepg_operator_vault_path }}"
|
|
engine_mount_point: "{{ cloudnativepg_operator_vault_mount }}"
|
|
register: __cloudnativepg_operator_vault_read
|
|
failed_when: false
|
|
no_log: "{{ cloudnativepg_operator_no_log }}"
|
|
|
|
- name: Resolve postgres password (generate if missing)
|
|
ansible.builtin.set_fact:
|
|
__cloudnativepg_operator_password: >-
|
|
{{ (__cloudnativepg_operator_vault_read.secret | default({})).password
|
|
| default(lookup('community.general.random_string', length=32, special=false)) }}
|
|
no_log: "{{ cloudnativepg_operator_no_log }}"
|
|
|
|
- name: Write postgres password to Vault
|
|
community.hashi_vault.vault_kv2_write:
|
|
path: "{{ cloudnativepg_operator_vault_path }}"
|
|
engine_mount_point: "{{ cloudnativepg_operator_vault_mount }}"
|
|
data:
|
|
password: "{{ __cloudnativepg_operator_password }}"
|
|
no_log: "{{ cloudnativepg_operator_no_log }}"
|