From 0a894a9786369fad258314c7e66f87b3891cffd1 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Mon, 17 Jul 2023 19:16:31 -0400 Subject: [PATCH] feat: move sops rename/restore to a ansible task Signed-off-by: Devin Buhl --- bootstrap/tasks/addons/csi_driver_nfs.yaml | 36 +++++------------- bootstrap/tasks/addons/grafana.yaml | 36 +++++------------- bootstrap/tasks/addons/hajimari.yaml | 36 +++++------------- .../tasks/addons/kube_prometheus_stack.yaml | 36 +++++------------- .../tasks/addons/kubernetes_dashboard.yaml | 36 +++++------------- .../addons/system_upgrade_controller.yaml | 36 +++++------------- bootstrap/tasks/addons/weave_gitops.yaml | 36 +++++------------- bootstrap/tasks/ansible/main.yaml | 37 +++++-------------- bootstrap/tasks/kubernetes/main.yaml | 37 +++++-------------- bootstrap/tasks/sops/disable.yaml | 12 ++++++ bootstrap/tasks/sops/enable.yaml | 12 ++++++ 11 files changed, 105 insertions(+), 245 deletions(-) create mode 100644 bootstrap/tasks/sops/disable.yaml create mode 100644 bootstrap/tasks/sops/enable.yaml diff --git a/bootstrap/tasks/addons/csi_driver_nfs.yaml b/bootstrap/tasks/addons/csi_driver_nfs.yaml index c98e1df4..7c2fff40 100644 --- a/bootstrap/tasks/addons/csi_driver_nfs.yaml +++ b/bootstrap/tasks/addons/csi_driver_nfs.yaml @@ -23,15 +23,9 @@ # https://github.com/ansible-collections/community.sops/issues/153 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }} block: - - name: Rename Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml" - dest: "{{ repository_path }}/.sops.yaml.orig" - mode: "0644" - - name: Remove Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml" - state: absent + - name: Disable Sops config + ansible.builtin.include_tasks: + file: ../sops/disable.yaml - name: Template encrypted files when: item.state == 'file' and 'sops' in item.path community.sops.sops_encrypt: @@ -42,22 +36,10 @@ mode: "0644" force: true with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml rescue: - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml diff --git a/bootstrap/tasks/addons/grafana.yaml b/bootstrap/tasks/addons/grafana.yaml index e3f88503..c609be05 100644 --- a/bootstrap/tasks/addons/grafana.yaml +++ b/bootstrap/tasks/addons/grafana.yaml @@ -23,15 +23,9 @@ # https://github.com/ansible-collections/community.sops/issues/153 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }} block: - - name: Rename Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml" - dest: "{{ repository_path }}/.sops.yaml.orig" - mode: "0644" - - name: Remove Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml" - state: absent + - name: Disable Sops config + ansible.builtin.include_tasks: + file: ../sops/disable.yaml - name: Template encrypted files when: item.state == 'file' and 'sops' in item.path community.sops.sops_encrypt: @@ -42,22 +36,10 @@ mode: "0644" force: true with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml rescue: - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml diff --git a/bootstrap/tasks/addons/hajimari.yaml b/bootstrap/tasks/addons/hajimari.yaml index 384e2ffe..ae04bfc6 100644 --- a/bootstrap/tasks/addons/hajimari.yaml +++ b/bootstrap/tasks/addons/hajimari.yaml @@ -23,15 +23,9 @@ # https://github.com/ansible-collections/community.sops/issues/153 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }} block: - - name: Rename Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml" - dest: "{{ repository_path }}/.sops.yaml.orig" - mode: "0644" - - name: Remove Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml" - state: absent + - name: Disable Sops config + ansible.builtin.include_tasks: + file: ../sops/disable.yaml - name: Template encrypted files when: item.state == 'file' and 'sops' in item.path community.sops.sops_encrypt: @@ -42,22 +36,10 @@ mode: "0644" force: true with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml rescue: - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml diff --git a/bootstrap/tasks/addons/kube_prometheus_stack.yaml b/bootstrap/tasks/addons/kube_prometheus_stack.yaml index eec7ab6b..ae38d4c9 100644 --- a/bootstrap/tasks/addons/kube_prometheus_stack.yaml +++ b/bootstrap/tasks/addons/kube_prometheus_stack.yaml @@ -23,15 +23,9 @@ # https://github.com/ansible-collections/community.sops/issues/153 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }} block: - - name: Rename Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml" - dest: "{{ repository_path }}/.sops.yaml.orig" - mode: "0644" - - name: Remove Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml" - state: absent + - name: Disable Sops config + ansible.builtin.include_tasks: + file: ../sops/disable.yaml - name: Template encrypted files when: item.state == 'file' and 'sops' in item.path community.sops.sops_encrypt: @@ -42,22 +36,10 @@ mode: "0644" force: true with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml rescue: - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml diff --git a/bootstrap/tasks/addons/kubernetes_dashboard.yaml b/bootstrap/tasks/addons/kubernetes_dashboard.yaml index 1d24c394..95234b30 100644 --- a/bootstrap/tasks/addons/kubernetes_dashboard.yaml +++ b/bootstrap/tasks/addons/kubernetes_dashboard.yaml @@ -23,15 +23,9 @@ # https://github.com/ansible-collections/community.sops/issues/153 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }} block: - - name: Rename Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml" - dest: "{{ repository_path }}/.sops.yaml.orig" - mode: "0644" - - name: Remove Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml" - state: absent + - name: Disable Sops config + ansible.builtin.include_tasks: + file: ../sops/disable.yaml - name: Template encrypted files when: item.state == 'file' and 'sops' in item.path community.sops.sops_encrypt: @@ -42,22 +36,10 @@ mode: "0644" force: true with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml rescue: - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml diff --git a/bootstrap/tasks/addons/system_upgrade_controller.yaml b/bootstrap/tasks/addons/system_upgrade_controller.yaml index b968b529..13b8dd76 100644 --- a/bootstrap/tasks/addons/system_upgrade_controller.yaml +++ b/bootstrap/tasks/addons/system_upgrade_controller.yaml @@ -23,15 +23,9 @@ # https://github.com/ansible-collections/community.sops/issues/153 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }} block: - - name: Rename Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml" - dest: "{{ repository_path }}/.sops.yaml.orig" - mode: "0644" - - name: Remove Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml" - state: absent + - name: Disable Sops config + ansible.builtin.include_tasks: + file: ../sops/disable.yaml - name: Template encrypted files when: item.state == 'file' and 'sops' in item.path community.sops.sops_encrypt: @@ -42,22 +36,10 @@ mode: "0644" force: true with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml rescue: - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml diff --git a/bootstrap/tasks/addons/weave_gitops.yaml b/bootstrap/tasks/addons/weave_gitops.yaml index a62d6b9f..d2119b8e 100644 --- a/bootstrap/tasks/addons/weave_gitops.yaml +++ b/bootstrap/tasks/addons/weave_gitops.yaml @@ -23,15 +23,9 @@ # https://github.com/ansible-collections/community.sops/issues/153 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }} block: - - name: Rename Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml" - dest: "{{ repository_path }}/.sops.yaml.orig" - mode: "0644" - - name: Remove Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml" - state: absent + - name: Disable Sops config + ansible.builtin.include_tasks: + file: ../sops/disable.yaml - name: Template encrypted files when: item.state == 'file' and 'sops' in item.path community.sops.sops_encrypt: @@ -42,22 +36,10 @@ mode: "0644" force: true with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml rescue: - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml diff --git a/bootstrap/tasks/ansible/main.yaml b/bootstrap/tasks/ansible/main.yaml index bd2898dd..e5e01b81 100644 --- a/bootstrap/tasks/ansible/main.yaml +++ b/bootstrap/tasks/ansible/main.yaml @@ -15,18 +15,11 @@ mode: "0644" with_community.general.filetree: ["../templates/ansible/"] -# https://github.com/ansible-collections/community.sops/issues/153 - name: Template Ansible encrypted files block: - - name: Rename Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml" - dest: "{{ repository_path }}/.sops.yaml.orig" - mode: "0644" - - name: Remove Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml" - state: absent + - name: Disable Sops config + ansible.builtin.include_tasks: + file: ../sops/disable.yaml - name: Template Ansible encrypted files when: item.state == 'file' and 'sops' in item.path community.sops.sops_encrypt: @@ -47,22 +40,10 @@ loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}" loop_control: label: "{{ item.address }}" - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml rescue: - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml diff --git a/bootstrap/tasks/kubernetes/main.yaml b/bootstrap/tasks/kubernetes/main.yaml index ab475c63..c42af4a2 100644 --- a/bootstrap/tasks/kubernetes/main.yaml +++ b/bootstrap/tasks/kubernetes/main.yaml @@ -15,18 +15,11 @@ mode: "0644" with_community.general.filetree: ["../templates/kubernetes/"] -# https://github.com/ansible-collections/community.sops/issues/153 - name: Template Kubernetes encrypted files block: - - name: Rename Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml" - dest: "{{ repository_path }}/.sops.yaml.orig" - mode: "0644" - - name: Remove Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml" - state: absent + - name: Disable Sops config + ansible.builtin.include_tasks: + file: ../sops/disable.yaml - name: Template Kubernetes encrypted files when: item.state == 'file' and 'sops' in item.path community.sops.sops_encrypt: @@ -37,22 +30,10 @@ mode: "0644" force: true with_community.general.filetree: ["../templates/kubernetes/"] - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml rescue: - - name: Restore Sops configuration file - ansible.builtin.copy: - src: "{{ repository_path }}/.sops.yaml.orig" - dest: "{{ repository_path }}/.sops.yaml" - mode: "0644" - - name: Remove backed up Sops configuration file - ansible.builtin.file: - path: "{{ repository_path }}/.sops.yaml.orig" - state: absent + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml diff --git a/bootstrap/tasks/sops/disable.yaml b/bootstrap/tasks/sops/disable.yaml new file mode 100644 index 00000000..b531c6bd --- /dev/null +++ b/bootstrap/tasks/sops/disable.yaml @@ -0,0 +1,12 @@ +--- +# https://github.com/ansible-collections/community.sops/issues/153 +- name: Rename Sops configuration file + ansible.builtin.copy: + src: "{{ repository_path }}/.sops.yaml" + dest: "{{ repository_path }}/.sops.yaml.orig" + mode: "0644" + +- name: Remove Sops configuration file + ansible.builtin.file: + path: "{{ repository_path }}/.sops.yaml" + state: absent diff --git a/bootstrap/tasks/sops/enable.yaml b/bootstrap/tasks/sops/enable.yaml new file mode 100644 index 00000000..cb853871 --- /dev/null +++ b/bootstrap/tasks/sops/enable.yaml @@ -0,0 +1,12 @@ +--- +# https://github.com/ansible-collections/community.sops/issues/153 +- name: Restore Sops configuration file + ansible.builtin.copy: + src: "{{ repository_path }}/.sops.yaml.orig" + dest: "{{ repository_path }}/.sops.yaml" + mode: "0644" + +- name: Remove backed up Sops configuration file + ansible.builtin.file: + path: "{{ repository_path }}/.sops.yaml.orig" + state: absent