5.2. Ensuring the presence of an asymmetric service vault in IdM using Ansible

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Obtain the public key of the service instance. For example, using the openssl utility:

   1. Generate the service-private.pem private key.

      $ openssl genrsa -out service-private.pem 2048
      Generating RSA private key, 2048 bit long modulus
      .+++
      ...........................................+++
      e is 65537 (0x10001)

   2. Generate the service-public.pem public key based on the private key.

      $ openssl rsa -in service-private.pem -out service-public.pem -pubout
      writing RSA key

3. Make a copy of the ensure-asymmetric-vault-is-present.yml Ansible playbook file from the relevant collections directory. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/vault/ensure-asymmetric-vault-is-present.yml ensure-asymmetric-service-vault-is-present-copy.yml

4. Open the ensure-asymmetric-vault-is-present-copy.yml file for editing.
5. Add a task that copies the service-public.pem public key from the Ansible controller to the server.idm.example.com server.

6. Modify the rest of the file by setting the following variables in the freeipa.ansible_freeipa.ipavault task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Define the name of the vault using the name variable, for example secret_vault.
   • Set the vault_type variable to asymmetric.
   • Set the service variable to the principal of the service that owns the vault, for example HTTP/webserver1.idm.example.com.

   • Set the public_key_file to the location of your public key.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Tests
     hosts: ipaserver
     gather_facts: false
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Copy public key to ipaserver.
       copy:
         src: /path/to/service-public.pem
         dest: /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/vault/service-public.pem
         mode: 0600
     - name: Add data to vault, from a LOCAL file.
       freeipa.ansible_freeipa.ipavault:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: secret_vault
         vault_type: asymmetric
         service: HTTP/webserver1.idm.example.com
         public_key_file: /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/vault/service-public.pem

7. Save the file.

8. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-asymmetric-service-vault-is-present-copy.yml