29 lines
1.1 KiB
YAML
29 lines
1.1 KiB
YAML
---
|
|
# Read the OPA bearer token from Vault; generate and store it if missing.
|
|
# Sets __opa_server_token and __opa_server_token_generated.
|
|
|
|
- name: Read OPA token from Vault
|
|
community.hashi_vault.vault_kv2_get:
|
|
path: "{{ opa_server_vault_path }}"
|
|
engine_mount_point: "{{ opa_server_vault_mount }}"
|
|
register: __opa_server_vault_read
|
|
failed_when: false
|
|
no_log: "{{ opa_server_no_log }}"
|
|
|
|
- name: Resolve OPA token (generate if missing)
|
|
ansible.builtin.set_fact:
|
|
__opa_server_token_generated: "{{ ((__opa_server_vault_read.secret | default({})).token | default('')) | length == 0 }}"
|
|
__opa_server_token: >-
|
|
{{ (__opa_server_vault_read.secret | default({})).token
|
|
| default(lookup('community.general.random_string', length=48, special=false)) }}
|
|
no_log: "{{ opa_server_no_log }}"
|
|
|
|
- name: Write OPA token to Vault
|
|
community.hashi_vault.vault_kv2_write:
|
|
path: "{{ opa_server_vault_path }}"
|
|
engine_mount_point: "{{ opa_server_vault_mount }}"
|
|
data:
|
|
token: "{{ __opa_server_token }}"
|
|
when: __opa_server_token_generated | bool
|
|
no_log: "{{ opa_server_no_log }}"
|