|
73 | 73 |
|
74 | 74 | - name: Initialize secrets.yaml files from demo templates |
75 | 75 | block: |
76 | | - - name: Discover all chart directories in values_dir for initialization |
| 76 | + - name: Find all demo-secrets.example.yaml files in one pass |
77 | 77 | find: |
78 | 78 | paths: "{{ values_dir }}" |
79 | | - file_type: directory |
80 | | - recurse: no |
81 | | - register: chart_dirs |
| 79 | + patterns: "demo-secrets.example.yaml" |
| 80 | + recurse: yes |
| 81 | + register: demo_secrets_files |
| 82 | + changed_when: false |
82 | 83 |
|
83 | | - - name: Verify demo-secrets.example.yaml template files exist |
84 | | - stat: |
85 | | - path: "{{ item.path }}/demo-secrets.example.yaml" |
86 | | - register: demo_secrets_stat |
87 | | - loop: "{{ chart_dirs.files }}" |
| 84 | + - name: Backup and initialize secrets for all charts |
| 85 | + shell: | |
| 86 | + #!/bin/bash |
| 87 | + set -e |
| 88 | + demo_file="{{ item }}" |
| 89 | + chart_dir="$(dirname "$demo_file")" |
| 90 | + secrets_file="$chart_dir/secrets.yaml" |
| 91 | + |
| 92 | + # Create timestamped backup if secrets.yaml exists |
| 93 | + if [ -f "$secrets_file" ]; then |
| 94 | + backup_file="${secrets_file}.bak.$(date +%Y%m%d_%H%M%S)" |
| 95 | + mv "$secrets_file" "$backup_file" |
| 96 | + echo "Backed up: $backup_file" |
| 97 | + fi |
| 98 | + |
| 99 | + # Copy demo template to secrets.yaml |
| 100 | + cp "$demo_file" "$secrets_file" |
| 101 | + echo "Initialized: $secrets_file" |
| 102 | + args: |
| 103 | + executable: /bin/bash |
| 104 | + register: init_result |
| 105 | + changed_when: "'Initialized:' in init_result.stdout" |
| 106 | + loop: "{{ demo_secrets_files.files | map(attribute='path') | list }}" |
88 | 107 | no_log: true |
89 | 108 |
|
90 | | - - name: Create timestamped backups of existing secrets.yaml files |
91 | | - block: |
92 | | - - name: Check if secrets.yaml file exists before backup |
93 | | - stat: |
94 | | - path: "{{ item.item.path }}/secrets.yaml" |
95 | | - register: secrets_file_stat |
96 | | - loop: "{{ demo_secrets_stat.results }}" |
97 | | - no_log: true |
98 | | - |
99 | | - - name: Create backup with timestamp |
100 | | - shell: | |
101 | | - #!/bin/bash |
102 | | - source_file="{{ item.item.path }}/secrets.yaml" |
103 | | - backup_file="{{ item.item.path }}/secrets.yaml.bak.{{ lookup('pipe', 'date +%Y%m%d_%H%M%S') }}" |
104 | | - if [ -f "$source_file" ]; then |
105 | | - mv "$source_file" "$backup_file" |
106 | | - fi |
107 | | - args: |
108 | | - executable: /bin/bash |
109 | | - when: item.stat.exists |
110 | | - loop: "{{ demo_secrets_stat.results }}" |
111 | | - register: backup_result |
112 | | - no_log: true |
113 | | - |
114 | | - - name: Initialize secrets.yaml from demo template for each chart |
115 | | - copy: |
116 | | - src: "{{ item.item.path }}/demo-secrets.example.yaml" |
117 | | - dest: "{{ item.item.path }}/secrets.yaml" |
118 | | - remote_src: yes |
119 | | - when: item.stat.exists |
120 | | - loop: "{{ demo_secrets_stat.results }}" |
121 | | - no_log: true |
| 109 | + - name: Display backup and initialization summary |
| 110 | + debug: |
| 111 | + msg: "{{ init_result.results | map(attribute='stdout_lines') | flatten | list }}" |
| 112 | + when: init_result.results | length > 0 |
122 | 113 |
|
123 | 114 | when: not skip_secret_generation |
124 | 115 |
|
|
165 | 156 | set_fact: |
166 | 157 | temp_dir: "{{ zauth_temp_dir.path }}" |
167 | 158 |
|
168 | | - - name: Generate Ed25519 private key in PEM format |
169 | | - openssl_privatekey: |
170 | | - path: "{{ temp_dir }}/key.pem" |
171 | | - type: Ed25519 |
172 | | - force: yes |
173 | | - no_log: true |
| 159 | + - name: Generate Ed25519 private key using openssl |
| 160 | + shell: "openssl genpkey -algorithm ed25519 -out '{{ temp_dir }}/key.pem'" |
| 161 | + changed_when: false |
174 | 162 |
|
175 | 163 | - name: Extract private key in DER format |
176 | 164 | shell: "openssl pkey -in '{{ temp_dir }}/key.pem' -outform DER 2>/dev/null > '{{ temp_dir }}/priv.der'" |
|
193 | 181 | changed_when: false |
194 | 182 |
|
195 | 183 | - name: Encode combined key to base64 (private key) |
196 | | - shell: "base64 -w 0 < '{{ temp_dir }}/combined.bytes'" |
| 184 | + shell: "base64 -w 0 < '{{ temp_dir }}/combined.bytes' | tr -- '+/' '-_'" |
197 | 185 | register: libsodium_priv |
198 | 186 | changed_when: false |
199 | 187 |
|
200 | 188 | - name: Encode public key to base64 |
201 | | - shell: "base64 -w 0 < '{{ temp_dir }}/pub.bytes'" |
| 189 | + shell: "base64 -w 0 < '{{ temp_dir }}/pub.bytes' | tr -- '+/' '-_'" |
202 | 190 | register: libsodium_pub |
203 | 191 | changed_when: false |
204 | 192 |
|
|
230 | 218 | - name: Verify private key is valid base64 |
231 | 219 | assert: |
232 | 220 | that: |
233 | | - - libsodium_priv.stdout is regex('^[A-Za-z0-9+/]+=*$') |
| 221 | + - libsodium_priv.stdout is regex('^[A-Za-z0-9_-]+=*$') |
234 | 222 | fail_msg: "Private key is not valid base64: {{ libsodium_priv.stdout }}" |
235 | 223 | quiet: yes |
236 | 224 |
|
237 | 225 | - name: Verify public key is valid base64 |
238 | 226 | assert: |
239 | 227 | that: |
240 | | - - libsodium_pub.stdout is regex('^[A-Za-z0-9+/]+=*$') |
| 228 | + - libsodium_pub.stdout is regex('^[A-Za-z0-9_-]+=*$') |
241 | 229 | fail_msg: "Public key is not valid base64: {{ libsodium_pub.stdout }}" |
242 | 230 | quiet: yes |
243 | 231 |
|
244 | 232 | - name: Validate decoded key lengths |
245 | 233 | block: |
246 | 234 | - name: Decode and verify private key length (should be 64 bytes) |
247 | | - shell: "echo '{{ libsodium_priv.stdout }}' | base64 -d | wc -c" |
| 235 | + shell: "printf '%s' '{{ libsodium_priv.stdout }}' | tr -- '-_' '+/' | base64 -d | wc -c" |
248 | 236 | register: priv_decoded_len |
249 | 237 | changed_when: false |
250 | 238 |
|
251 | 239 | - name: Decode and verify public key length (should be 32 bytes) |
252 | | - shell: "echo '{{ libsodium_pub.stdout }}' | base64 -d | wc -c" |
| 240 | + shell: "printf '%s' '{{ libsodium_pub.stdout }}' | tr -- '-_' '+/' | base64 -d | wc -c" |
253 | 241 | register: pub_decoded_len |
254 | 242 | changed_when: false |
255 | 243 |
|
| 244 | + - name: debug |
| 245 | + debug: |
| 246 | + msg: " {{libsodium_pub.stdout}} {{libsodium_priv.stdout }}" |
| 247 | + |
256 | 248 | - name: Assert decoded key lengths are correct |
257 | 249 | assert: |
258 | 250 | that: |
|
0 commit comments