Skip to content

Commit 5be95c2

Browse files
seunghun1eeAlex-Welsh
seunghun1ee
and
Alex-Welsh
committed
Add playbooks for Vault to OpenBao migration
Co-Authored-by: Alex Welsh <alex@stackhpc.com>
1 parent 26aa14a commit 5be95c2

File tree

5 files changed

+202
-0
lines changed

5 files changed

+202
-0
lines changed

‎etc/kayobe/ansible/secret-store/vault-bao-migration-all.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Using lookup because Kayobe variable ``kayobe_config_path`` is not initialised at this stage
2+
- import_playbook: "{{ lookup('env', 'KAYOBE_CONFIG_PATH') }}/ansible/secret-store/vault-bao-migration-seed.yml"
3+
4+
- import_playbook: "{{ lookup('env', 'KAYOBE_CONFIG_PATH') }}/ansible/secret-store/vault-bao-migration-overcloud.yml"
5+
6+
- import_playbook: "{{ lookup('env', 'KAYOBE_CONFIG_PATH') }}/ansible/secret-store/vault-bao-migration-change-config.yml"

‎etc/kayobe/ansible/secret-store/vault-bao-migration-change-config.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
- name: Change SKC secret store configuration from Vault to OpenBao
3+
hosts: localhost
4+
tasks:
5+
- name: Check if Vault directory exists
6+
ansible.builtin.stat:
7+
path: "{{ kayobe_env_config_path }}/vault"
8+
register: vault_dir
9+
10+
- name: Copy contents in Vault directory to OpenBao directory
11+
ansible.builtin.copy:
12+
src: "{{ kayobe_env_config_path }}/vault/"
13+
dest: "{{ kayobe_env_config_path }}/openbao/"
14+
remote_src: true
15+
mode: '0775'
16+
when:
17+
- vault_dir.stat.exists
18+
- vault_dir.stat.isdir
19+
20+
- name: Check if Vault keys exists under OpenBao directory
21+
ansible.builtin.stat:
22+
path: "{{ kayobe_env_config_path }}/openbao/{{ item }}"
23+
loop:
24+
- seed-vault-keys.json
25+
- overcloud-vault-keys.json
26+
register: vault_keys
27+
28+
- name: Make copy of Vault keys
29+
ansible.builtin.copy:
30+
src: "{{ kayobe_env_config_path }}/openbao/{{ item.src }}"
31+
dest: "{{ kayobe_env_config_path }}/openbao/{{ item.dest }}"
32+
remote_src: true
33+
mode: '0600'
34+
loop:
35+
- { src: seed-vault-keys.json, dest: seed-openbao-keys.json }
36+
- { src: overcloud-vault-keys.json, dest: overcloud-openbao-keys.json }
37+
loop_control:
38+
index_var: key_index
39+
when:
40+
- vault_keys.results[key_index].stat.exists
41+
- vault_keys.results[key_index].stat.isreg
42+
43+
- name: Remove Vault directory
44+
ansible.builtin.file:
45+
path: "{{ kayobe_env_config_path }}/vault"
46+
state: absent
47+
48+
- name: Remove Vault keys
49+
ansible.builtin.file:
50+
path: "{{ kayobe_env_config_path }}/openbao/{{ item }}"
51+
state: absent
52+
loop:
53+
- seed-vault-keys.json
54+
- overcloud-vault-keys.json
55+
56+
- name: Ensure stackhpc.yml exists under environment directory
57+
ansible.builtin.file:
58+
path: "{{ kayobe_env_config_path }}/stackhpc.yml"
59+
state: touch
60+
mode: '0664'
61+
62+
- name: Set stackhpc_ca_secret_store to openbao
63+
ansible.builtin.lineinfile:
64+
path: "{{ kayobe_env_config_path }}/stackhpc.yml"
65+
regexp: "stackhpc_ca_secret_store.+"
66+
line: "stackhpc_ca_secret_store: openbao"

‎etc/kayobe/ansible/secret-store/vault-bao-migration-overcloud.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
- name: Migrate Overcloud Vault to OpenBao
3+
any_errors_fatal: true
4+
gather_facts: true
5+
hosts: controllers
6+
vars:
7+
secret_store_bind_interface: "{{ internal_net_name | net_interface }}"
8+
secret_store_bind_address: "{{ ansible_facts[secret_store_bind_interface].ipv4.address }}"
9+
secret_store_api_address: "https://{{ secret_store_bind_address }}:8200"
10+
tasks:
11+
- name: Set a fact about the virtualenv on the remote system
12+
ansible.builtin.set_fact:
13+
virtualenv: "{{ ansible_python_interpreter | dirname | dirname }}"
14+
when:
15+
- ansible_python_interpreter is defined
16+
- not ansible_python_interpreter.startswith('/bin/')
17+
- not ansible_python_interpreter.startswith('/usr/bin/')
18+
19+
- name: Ensure Python hvac module is installed
20+
ansible.builtin.pip:
21+
name: hvac
22+
state: latest
23+
extra_args: "{% if pip_upper_constraints_file %}-c {{ pip_upper_constraints_file }}{% endif %}"
24+
virtualenv: "{{ virtualenv is defined | ternary(virtualenv, omit) }}"
25+
become: "{{ virtualenv is not defined }}"
26+
27+
- name: Include secret store keys
28+
ansible.builtin.include_vars:
29+
file: "{{ kayobe_env_config_path }}/{{ stackhpc_ca_secret_store }}/overcloud-{{ stackhpc_ca_secret_store }}-keys.json"
30+
name: secret_store_keys
31+
32+
- name: Migrate Vault to Openbao
33+
import_playbook: stackhpc.hashicorp.vault_bao_migration
34+
vars:
35+
vault_hosts_group: controllers
36+
secret_store_bind_interface: "{{ internal_net_name | net_interface }}"
37+
secret_store_bind_address: "{{ ansible_facts[secret_store_bind_interface].ipv4.address }}"
38+
secret_store_api_address: "https://{{ secret_store_bind_address }}:8200"
39+
migration_consul_docker_image: "{{ seed_consul_docker_image }}"
40+
migration_common_root_token: "{{ secret_store_keys.root_token }}"
41+
migration_common_unseal_keys: "{{ secret_store_keys.keys_base64 }}"
42+
migration_common_bind_addr: "{{ secret_store_bind_address }}"
43+
migration_common_api_addr: "{{ secret_store_api_address }}"
44+
migration_vault_config_dir: /opt/kayobe/vault
45+
migration_common_cluster_name: overcloud
46+
migration_vault_docker_image: "{{ seed_vault_docker_image }}"
47+
migration_vault_docker_tag: "{{ seed_vault_docker_tag }}"
48+
vault_unseal_timeout: 10
49+
migration_openbao_config_dir: /opt/kayobe/openbao
50+
migration_openbao_docker_image: "{{ seed_openbao_docker_image }}"
51+
migration_openbao_docker_tag: "{{ seed_openbao_docker_tag }}"
52+
migration_common_tls_cert: "{% if kolla_internal_fqdn != kolla_internal_vip_address %}{{ kolla_internal_fqdn }}{% else %}overcloud{% endif %}.crt"
53+
migration_common_tls_key: "{% if kolla_internal_fqdn != kolla_internal_vip_address %}{{ kolla_internal_fqdn }}{% else %}overcloud{% endif %}.key"
54+
migration_common_tls_ca: "OS-TLS-INT.crt"
55+
migration_openbao_registry_url: "{{ overcloud_openbao_registry_url }}"
56+
migration_openbao_registry_username: "{{ overcloud_openbao_registry_username }}"
57+
migration_openbao_registry_password: "{{ overcloud_openbao_registry_password }}"

‎etc/kayobe/ansible/secret-store/vault-bao-migration-seed.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
- name: Migrate Seed Vault to OpenBao
3+
any_errors_fatal: true
4+
gather_facts: true
5+
hosts: seed
6+
vars:
7+
secret_store_bind_interface: lo
8+
secret_store_bind_address: "{{ ansible_facts[secret_store_bind_interface].ipv4.address }}"
9+
secret_store_api_address: "http://{{ secret_store_bind_address }}:8200"
10+
tasks:
11+
- name: Set a fact about the virtualenv on the remote system
12+
ansible.builtin.set_fact:
13+
virtualenv: "{{ ansible_python_interpreter | dirname | dirname }}"
14+
when:
15+
- ansible_python_interpreter is defined
16+
- not ansible_python_interpreter.startswith('/bin/')
17+
- not ansible_python_interpreter.startswith('/usr/bin/')
18+
19+
- name: Ensure Python hvac module is installed
20+
ansible.builtin.pip:
21+
name: hvac
22+
state: latest
23+
extra_args: "{% if pip_upper_constraints_file %}-c {{ pip_upper_constraints_file }}{% endif %}"
24+
virtualenv: "{{ virtualenv is defined | ternary(virtualenv, omit) }}"
25+
become: "{{ virtualenv is not defined }}"
26+
27+
- name: Include secret store keys
28+
ansible.builtin.include_vars:
29+
file: "{{ kayobe_env_config_path }}/{{ stackhpc_ca_secret_store }}/seed-{{ stackhpc_ca_secret_store }}-keys.json"
30+
name: secret_store_keys
31+
32+
- name: Migrate Vault to Openbao
33+
import_playbook: stackhpc.hashicorp.vault_bao_migration
34+
vars:
35+
vault_hosts_group: seed
36+
secret_store_bind_interface: lo
37+
secret_store_bind_address: "{{ ansible_facts[secret_store_bind_interface].ipv4.address }}"
38+
secret_store_api_address: "http://{{ secret_store_bind_address }}:8200"
39+
migration_consul_docker_image: "{{ seed_consul_docker_image }}"
40+
migration_common_root_token: "{{ secret_store_keys.root_token }}"
41+
migration_common_unseal_keys: "{{ secret_store_keys.keys_base64 }}"
42+
migration_common_bind_addr: "{{ secret_store_bind_address }}"
43+
migration_common_api_addr: "{{ secret_store_api_address }}"
44+
migration_vault_config_dir: /opt/kayobe/vault
45+
migration_common_cluster_name: seed
46+
migration_vault_docker_image: "{{ seed_vault_docker_image }}"
47+
migration_vault_docker_tag: "{{ seed_vault_docker_tag }}"
48+
vault_unseal_timeout: 10
49+
migration_openbao_config_dir: /opt/kayobe/openbao
50+
migration_openbao_docker_image: "{{ seed_openbao_docker_image }}"
51+
migration_openbao_docker_tag: "{{ seed_openbao_docker_tag }}"

‎releasenotes/notes/support-vault-openbao-migration-b6f9973cddc1e04c.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
features:
3+
- |
4+
Added four playbooks for migrating secret store from Hashicorp Vault to
5+
OpenBao.
6+
7+
``vault-bao-migration-seed.yml`` does Vault to OpenBao migration on seed
8+
node. This is single node migration, so API calls to seed secret-store can
9+
be disruptive for short period of time.
10+
11+
``vault-bao-migration-overcloud.yml`` does Vault to OpenBao migration on
12+
overcloud. (Default: controller nodes)
13+
This is HA migration, so no downtime is expected.
14+
15+
``vault-bao-migration-change-config.yml`` automatically update SKC to
16+
target OpenBao. It is recommended to use this playbook after all Vault
17+
deployments are migrated to OpenBao.
18+
19+
``vault-bao-migration-all.yml`` runs all other three playbooks in order.
20+
21+
As Hashicorp Vault will no longer be supported from OpenStack 2026.1, it is
22+
strongly recommended to migrate to OpenBao before upgrading.

0 commit comments

Comments
 (0)