deploy-all.yaml

- hosts: localhost
  vars:
    hpcs_server_policy: |
      path "auth/jwt/role/*" {
        capabilities = ["sudo","read","create","delete","update"]
      }
      path "sys/policies/acl/*" {
        capabilities = ["sudo","read","create","delete","update"]
      }

  tasks:
    - include_tasks: create-certs.yaml

    - name: Add hashicorp to helm repositories
      kubernetes.core.helm_repository:
        name: stable
        repo_url: "https://helm.releases.hashicorp.com"

    - name: Deploy hashicorp vault
      kubernetes.core.helm:
        release_name: vault
        chart_ref: hashicorp/vault
        release_namespace: hpcs
        create_namespace: true
        chart_version: 0.27.0

    - name: Wait for vault to be created
      shell: "kubectl get --namespace hpcs pod/vault-0 --output=jsonpath='{.status}'"
      register: pod_ready_for_init
      until: (pod_ready_for_init.stdout | from_json)['containerStatuses'] is defined
      retries: 10
      delay: 2

    - name: Initialize vault
      kubernetes.core.k8s_exec:
        namespace: hpcs
        pod: vault-0
        command: vault operator init -n 1 -t 1 -format json
      register: vault_init
      ignore_errors: True

    - name: Showing tokens
      ansible.builtin.debug:
        msg:
        - "Please note the unseal token : {{ (vault_init.stdout | from_json)['unseal_keys_b64'][0] }}"
        - "Please note the root-token : '{{ (vault_init.stdout | from_json)['root_token' ] }}'"
      when: vault_init.rc == 0

    - name: Unseal vault
      kubernetes.core.k8s_exec:
        namespace: hpcs
        pod: vault-0
        command: vault operator unseal {{ (vault_init.stdout | from_json)['unseal_keys_b64'][0] }}
      when: vault_init.rc == 0
      ignore_errors: True

    - name: Enable jwt authentication in vault
      kubernetes.core.k8s_exec:
        namespace: hpcs
        pod: vault-0
        command: sh -c "export VAULT_TOKEN={{ (vault_init.stdout | from_json)['root_token' ] }} ; vault auth enable jwt"
      when: vault_init.rc == 0

    - name: Enable kv secrets in vault
      kubernetes.core.k8s_exec:
        namespace: hpcs
        pod: vault-0
        command: sh -c "export VAULT_TOKEN={{ (vault_init.stdout | from_json)['root_token' ] }} ; vault secrets enable -version=2 kv"
      when: vault_init.rc == 0

    - name: Create hpcs-server vault policy file
      copy:
        content: "{{ hpcs_server_policy }}"
        dest: /tmp/policy
      when: vault_init.rc == 0

    - name: Deploy hpcs-stack
      kubernetes.core.helm:
        release_name: hpcs-stack
        chart_ref: hpcs-stack
        release_namespace: hpcs
        create_namespace: true

    - name: Wait for spire-oidc to be ready
      shell: "kubectl get --namespace hpcs pod/spire-server-0 --output=jsonpath='{.status.containerStatuses[*].ready}'"
      register: pod_spire_oidc
      until: pod_spire_oidc.stdout == "true true true"
      # until: (pod_spire_oidc.stdout | from_json)['containerStatuses'][?name==spire-oidc]['ready']
      retries: 10
      delay: 2

    - name: Copy oidc cert to vault's pod
      kubernetes.core.k8s_cp:
        namespace: hpcs
        pod: vault-0
        remote_path: /tmp/cert
        local_path: hpcs-stack/charts/spire/files/spire-oidc.crt
      when: vault_init.rc == 0

    - name: Write oidc config to vault
      kubernetes.core.k8s_exec:
        namespace: hpcs
        pod: vault-0
        command: sh -c "export VAULT_TOKEN={{ (vault_init.stdout | from_json)['root_token'] }} ; vault write auth/jwt/config oidc_discovery_url=https://spire-oidc oidc_discovery_ca_pem=\"$(cat /tmp/cert)\""
      when: vault_init.rc == 0

    - name: Copy policy file to vault's pod
      kubernetes.core.k8s_cp:
        namespace: hpcs
        pod: vault-0
        remote_path: /tmp/policy
        local_path: /tmp/policy
      when: vault_init.rc == 0

    - name: Write hpcs-server vault policy
      kubernetes.core.k8s_exec:
        namespace: hpcs
        pod: vault-0
        command: sh -c "export VAULT_TOKEN={{ (vault_init.stdout | from_json)['root_token'] }} ; vault policy write hpcs-server /tmp/policy"
      when: vault_init.rc == 0

    - name: Write hpcs-server vault role
      kubernetes.core.k8s_exec:
        namespace: hpcs
        pod: vault-0
        command: sh -c "export VAULT_TOKEN={{ (vault_init.stdout | from_json)['root_token'] }} ; vault write auth/jwt/role/hpcs-server role_type=jwt user_claim=sub bound_audiences=TESTING bound_subject=spiffe://hpcs/hpcs-server/workload token_ttl=24h token_policies=hpcs-server"
      when: vault_init.rc == 0

    - name: Check cgroups version
      kubernetes.core.k8s_exec:
        namespace: hpcs
        pod: vault-0
        command: sh -c "cat /proc/filesystems | grep cgroup2"
      register: cgroups_check

    - name: Register node uid and nodename
      shell: "kubectl get nodes -o json"
      register: kubectl_node_info

    - name: Register hpcs-server identity
      kubernetes.core.k8s_exec:
        namespace: hpcs
        pod: spire-server-0
        container: spire-server
        command: ./bin/spire-server entry create -parentID spiffe://hpcs/spire/agent/k8s_psat/hpcs/{{ (kubectl_node_info.stdout | from_json)['items'][0]['metadata']['uid'] }} -spiffeID spiffe://hpcs/hpcs-server/workload -selector unix:uid:0
      register: cgroups_check
      when: cgroups_check.rc == 0
      ignore_errors: True

    - name: Register hpcs-server identity
      kubernetes.core.k8s_exec:
        namespace: hpcs
        pod: spire-server-0
        container: spire-server
        command: ./bin/spire-server entry create -parentID spiffe://hpcs/spire/agent/k8s_psat/hpcs/{{ (kubectl_node_info.stdout | from_json)['items'][0]['metadata']['uid'] }} -spiffeID spiffe://hpcs/hpcs-server/workload -selector k8s:pod-name:hpcs-server
      register: cgroups_check
      when: cgroups_check.rc == 1
      ignore_errors: True