5.5. Retrieving a service secret for an IdM service using Ansible

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Open your inventory file.

   • Define the hosts onto which you want to retrieve the secret in the webservers section. For example, to instruct Ansible to retrieve the secret to webserver1.idm.example.com, webserver2.idm.example.com, and webserver3.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com
   
   [webservers]
   webserver1.idm.example.com
   webserver2.idm.example.com
   webserver3.idm.example.com

3. Make a copy of the retrieve-data-asymmetric-vault.yml Ansible playbook file from the relevant collections directory. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/vault/retrieve-data-asymmetric-vault.yml retrieve-data-asymmetric-vault-copy.yml

4. Open the retrieve-data-asymmetric-vault-copy.yml file for editing.

5. Modify the file by setting the following variables in the freeipa.ansible_freeipa.ipavault task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the name variable to the name of the vault, for example secret_vault.
   • Set the service variable to the service owner of the vault, for example HTTP/webserver1.idm.example.com.
   • Set the private_key_file variable to the location of the private key used to retrieve the service vault secret.
   • Set the out variable to the location on the IdM server where you want to retrieve the private-key-to-an-externally-signed-certificate.pem secret, for example the current working directory.

   • Set the action variable to member.

     This the modified Ansible playbook file for the current example:

   ---
   - name: Retrieve data from vault
     hosts: ipaserver
     become: no
     gather_facts: false
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Retrieve data from the service vault
       freeipa.ansible_freeipa.ipavault:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: secret_vault
         service: HTTP/webserver1.idm.example.com
         vault_type: asymmetric
         private_key: "{{ lookup('file', 'service-private.pem') | b64encode }}"
         out: private-key-to-an-externally-signed-certificate.pem
         state: retrieved

6. Add a section to the playbook that retrieves the data file from the IdM server to the Ansible controller:

   ---
   - name: Retrieve data from vault
     hosts: ipaserver
     become: no
     gather_facts: false
     tasks:
   [...]
     - name: Retrieve data file
       fetch:
         src: private-key-to-an-externally-signed-certificate.pem
         dest: ./
         flat: true
         mode: 0600

7. Add a section to the playbook that transfers the retrieved private-key-to-an-externally-signed-certificate.pem file from the Ansible controller on to the webservers listed in the webservers section of the inventory file:

   ---
   - name: Send data file to webservers
     become: no
     gather_facts: no
     hosts: webservers
     tasks:
     - name: Send data to webservers
       copy:
         src: private-key-to-an-externally-signed-certificate.pem
         dest: /etc/pki/tls/private/httpd.key
         mode: 0444

8. Save the file.

9. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file retrieve-data-asymmetric-vault-copy.yml