246 lines
7.2 KiB
YAML
246 lines
7.2 KiB
YAML
- name: Install requirements
|
|
ansible.builtin.apt:
|
|
name:
|
|
- "unzip"
|
|
|
|
- name: Create Consul directory
|
|
ansible.builtin.file:
|
|
path: "/usr/local/consul-{{ consul_version }}"
|
|
state: "directory"
|
|
mode: "0755"
|
|
|
|
- name: Install Consul
|
|
ansible.builtin.unarchive:
|
|
src: "https://releases.hashicorp.com/consul/{{ consul_version }}/consul_{{ consul_version }}_linux_amd64.zip"
|
|
dest: "/usr/local/consul-{{ consul_version }}"
|
|
creates: "/usr/local/consul-{{ consul_version }}/consul"
|
|
remote_src: true
|
|
notify:
|
|
- "Restart Consul"
|
|
|
|
- name: Create Consul system group
|
|
ansible.builtin.group:
|
|
name: "consul"
|
|
system: true
|
|
|
|
- name: Create Consul system user
|
|
ansible.builtin.user:
|
|
name: "consul"
|
|
group: "consul"
|
|
groups: ["ssl-cert"]
|
|
password: "!"
|
|
system: true
|
|
home: "/opt/consul"
|
|
|
|
- name: Create Consul config directory
|
|
ansible.builtin.file:
|
|
path: "/etc/consul"
|
|
state: "directory"
|
|
group: "consul"
|
|
mode: "0750"
|
|
|
|
- name: Create Consul log dir
|
|
ansible.builtin.file:
|
|
path: "/var/log/consul"
|
|
state: "directory"
|
|
group: "consul"
|
|
mode: "0770"
|
|
|
|
- name: Generate Consul config
|
|
ansible.builtin.template:
|
|
src: "templates/config.json"
|
|
dest: "/etc/consul/config.json"
|
|
group: "consul"
|
|
mode: "0640"
|
|
notify:
|
|
- "Restart Consul"
|
|
|
|
- name: Deploy Consul service file
|
|
ansible.builtin.template:
|
|
src: "templates/consul.service"
|
|
dest: "/etc/systemd/system/consul.service"
|
|
mode: "0644"
|
|
notify:
|
|
- "Restart Consul"
|
|
|
|
- name: Enable and start Consul
|
|
ansible.builtin.service:
|
|
name: "consul"
|
|
state: "started"
|
|
enabled: true
|
|
daemon_reload: true
|
|
|
|
- name: Generate Consul ACL config
|
|
when: "consul_server"
|
|
ansible.builtin.template:
|
|
src: "templates/acl.json"
|
|
dest: "/etc/consul/acl.json"
|
|
group: "consul"
|
|
mode: "0640"
|
|
notify:
|
|
- "Restart Consul"
|
|
|
|
- name: Running handlers for restarting Consul if required
|
|
ansible.builtin.meta: "flush_handlers"
|
|
|
|
- name: Bootstrap Consul ACL system
|
|
when: "consul_server"
|
|
run_once: true
|
|
community.general.consul_acl_bootstrap:
|
|
bootstrap_secret: "{{ consul_bootstrap_secret }}"
|
|
|
|
- name: Create/retrieve Consul node agent accessor_id
|
|
ansible.builtin.shell:
|
|
executable: "/usr/bin/bash"
|
|
cmd: |
|
|
set -o pipefail
|
|
if test -f /root/.consul_agent_accessor_id; then
|
|
echo OK
|
|
else
|
|
uuidgen > /root/.consul_agent_accessor_id
|
|
echo CHANGED
|
|
fi
|
|
cat /root/.consul_agent_accessor_id
|
|
register: "consul_out_agent_accessor_id"
|
|
changed_when: "consul_out_agent_accessor_id.stdout_lines[0] == 'CHANGED'"
|
|
|
|
- name: Create/retrieve Consul node agent token
|
|
community.general.consul_token:
|
|
token: "{{ consul_bootstrap_secret }}"
|
|
accessor_id: "{{ consul_out_agent_accessor_id.stdout_lines[1] }}"
|
|
description: "Node {{ ansible_fqdn }}"
|
|
node_identities:
|
|
- datacenter: "{{ consul_datacenter }}"
|
|
node_name: "{{ ansible_hostname }}"
|
|
register: "consul_out_agent_token"
|
|
|
|
- name: Create Consul policy for DNS agent
|
|
when: "consul_server"
|
|
run_once: true
|
|
community.general.consul_policy:
|
|
token: "{{ consul_bootstrap_secret }}"
|
|
name: "dns-access"
|
|
rules: |
|
|
node_prefix "" {
|
|
policy = "read"
|
|
}
|
|
{% for service in consul_services %}
|
|
service "{{ service.name }}" {
|
|
policy = "read"
|
|
}
|
|
{% endfor %}
|
|
|
|
- name: Create/retrieve Consul DNS agent accessor_id
|
|
ansible.builtin.shell:
|
|
executable: "/usr/bin/bash"
|
|
cmd: |
|
|
set -o pipefail
|
|
if test -f /root/.consul_dns_accessor_id; then
|
|
echo OK
|
|
else
|
|
uuidgen > /root/.consul_dns_accessor_id
|
|
echo CHANGED
|
|
fi
|
|
cat /root/.consul_dns_accessor_id
|
|
register: "consul_out_dns_accessor_id"
|
|
changed_when: "consul_out_dns_accessor_id.stdout_lines[0] == 'CHANGED'"
|
|
|
|
- name: Create/retrieve Consul DNS agent token
|
|
when: "consul_server"
|
|
community.general.consul_token:
|
|
token: "{{ consul_bootstrap_secret }}"
|
|
accessor_id: "{{ consul_out_dns_accessor_id.stdout_lines[1] }}"
|
|
description: "DNS {{ ansible_fqdn }}"
|
|
policies:
|
|
- name: "dns-access"
|
|
register: "consul_out_dns_token"
|
|
|
|
- name: Generate Consul agent tokens config
|
|
ansible.builtin.template:
|
|
src: "templates/tokens.json"
|
|
dest: "/etc/consul/tokens.json"
|
|
group: "consul"
|
|
mode: "0640"
|
|
notify:
|
|
- "Restart Consul"
|
|
|
|
- name: Running handlers for restarting Consul if required
|
|
ansible.builtin.meta: "flush_handlers"
|
|
|
|
- name: Create Consul policy for UI
|
|
when: "consul_server and consul_ui_secret_id != None"
|
|
run_once: true
|
|
community.general.consul_policy:
|
|
token: "{{ consul_bootstrap_secret }}"
|
|
name: "ui-access"
|
|
rules: |
|
|
key_prefix "" {
|
|
policy = "write"
|
|
}
|
|
node_prefix "" {
|
|
policy = "read"
|
|
}
|
|
service_prefix "" {
|
|
policy = "read"
|
|
}
|
|
|
|
- name: Create/retrieve Consul UI accessor_id
|
|
when: "consul_server and consul_ui_secret_id != None and consul_servers[0] == ansible_hostname"
|
|
ansible.builtin.shell:
|
|
executable: "/usr/bin/bash"
|
|
cmd: |
|
|
set -o pipefail
|
|
if test -f /root/.consul_ui_accessor_id; then
|
|
echo OK
|
|
else
|
|
uuidgen > /root/.consul_ui_accessor_id
|
|
echo CHANGED
|
|
fi
|
|
cat /root/.consul_ui_accessor_id
|
|
register: "consul_out_ui_accessor_id"
|
|
changed_when: "consul_out_ui_accessor_id.stdout_lines[0] == 'CHANGED'"
|
|
|
|
- name: Create/retrieve Consul UI token
|
|
when: "consul_server and consul_ui_secret_id != None and consul_servers[0] == ansible_hostname"
|
|
community.general.consul_token:
|
|
token: "{{ consul_bootstrap_secret }}"
|
|
accessor_id: "{{ consul_out_ui_accessor_id.stdout_lines[1] }}"
|
|
secret_id: "{{ consul_ui_secret_id }}"
|
|
description: "UI"
|
|
policies:
|
|
- name: "ui-access"
|
|
|
|
- name: Register services to consul
|
|
loop: "{{ consul_services }}"
|
|
community.general.consul_agent_service:
|
|
token: "{{ consul_bootstrap_secret }}"
|
|
name: "{{ item.name }}"
|
|
address: "{{ item.address | default(ansible_default_ipv4.address) }}"
|
|
service_port: "{{ item.port }}"
|
|
tags: "{{ item.tags | default([]) }}"
|
|
# Because community.general.consul_agent_check is not idempotent:
|
|
register: "consul_out_register_services"
|
|
|
|
- name: Register HTTP checks to consul
|
|
loop: "{{ consul_services }}"
|
|
when: "consul_out_register_services.changed and (item.check_http | default(None) != None)"
|
|
community.general.consul_agent_check:
|
|
token: "{{ consul_bootstrap_secret }}"
|
|
name: "{{ item.name }}_check"
|
|
service_id: "{{ item.name }}"
|
|
interval: "{{ item.check_interval | default(consul_default_check_interval) }}"
|
|
timeout: "{{ item.check_timeout | default(consul_default_check_timeout) }}"
|
|
http: "{{ item.check_http }}"
|
|
scheme: "{{ item.check_scheme | default('http') }}"
|
|
|
|
- name: Register TCP checks to consul
|
|
loop: "{{ consul_services }}"
|
|
when: "consul_out_register_services and (item.check_tcp | default(None) != None)"
|
|
community.general.consul_agent_check:
|
|
token: "{{ consul_bootstrap_secret }}"
|
|
name: "{{ item.name }}_check"
|
|
service_id: "{{ item.name }}"
|
|
interval: "{{ item.check_interval | default(consul_default_check_interval) }}"
|
|
timeout: "{{ item.check_timeout | default(consul_default_check_timeout) }}"
|
|
tcp: "{{ item.check_tcp }}"
|