112 lines
3.4 KiB
Bash
112 lines
3.4 KiB
Bash
#!/bin/bash
|
|
#
|
|
# KraussNet Ansible Playbook Runner Action Entrypoint
|
|
|
|
set -euo pipefail
|
|
|
|
if [ -z "${INPUT_PKI_CA_URL:-}" ] ; then
|
|
echo "Missing required input parameter 'pki_ca_url'"
|
|
exit 1
|
|
fi
|
|
if [ -z "${INPUT_PKI_FINGERPRINT:-}" ] ; then
|
|
echo "Missing required input parameter 'pki_fingerprint'"
|
|
exit 1
|
|
fi
|
|
if [ -z "${INPUT_PKI_PROVISIONER_PASSWORD:-}" ] ; then
|
|
echo "Missing required input parameter 'pki_provisioner_password'"
|
|
exit 1
|
|
fi
|
|
if [ -z "${INPUT_PLAYBOOK:-}" ] ; then
|
|
echo "Missing required input parameter 'playbook'"
|
|
exit 1
|
|
fi
|
|
if [ -z "${INPUT_INVENTORY:-}" ] ; then
|
|
echo "Missing required input parameter 'inventory'"
|
|
exit 1
|
|
fi
|
|
|
|
# Setup Provisioner Variables
|
|
provisioner_name=${INPUT_PKI_PROVISIONER_NAME:-"ansible"}
|
|
provisioner_password=${INPUT_PKI_PROVISIONER_PASSWORD}
|
|
default_cert_subject="ansible-kraussnet-action-runner@$(hostname -f)"
|
|
user_cert_subject=${INPUT_SUBJECT:-"$default_cert_subject"}
|
|
|
|
# Bootstrap the PKI Certificate Authority
|
|
step ca bootstrap \
|
|
--ca-url "${INPUT_PKI_CA_URL}" \
|
|
--fingerprint "${INPUT_PKI_FINGERPRINT}"
|
|
echo "Bootstrapped PKI at ${INPUT_PKI_CA_URL}"
|
|
|
|
# Obtain the Host Certificate
|
|
[ ! -d ~/.ssh ] && mkdir ~/.ssh
|
|
echo "@cert-authority * $(step ssh config --host --roots)" > ~/.ssh/known_hosts
|
|
echo "Obtained SSH Host Certificate Authority"
|
|
|
|
# Obtain a User Certificate for Ansible
|
|
token=$(step ca token "${user_cert_subject}" --ssh --provisioner "${provisioner_name}" --provisioner-password-file <(printf "${provisioner_password}"))
|
|
echo "Obtained User Token from CA"
|
|
echo $token | step crypto jwt inspect --insecure
|
|
|
|
[ ! -f ~/.ssh/id_ecdsa ] && ssh-keygen -t ecdsa -f ~/.ssh/id_ecdsa -N ''
|
|
[ -f ~/.ssh/id_ecdsa-cert.pub ] && rm ~/.ssh/id_ecdsa-cert.pub
|
|
step ssh certificate "${user_cert_subject}" ~/.ssh/id_ecdsa.pub --sign --provisioner "${provisioner_name}" --token $token
|
|
echo "Obtained User Certificate from CA"
|
|
ssh-keygen -L -f ~/.ssh/id_ecdsa-cert.pub
|
|
|
|
# Process the inventory parameter
|
|
inventory=""
|
|
if [[ "${INPUT_INVENTORY}" =~ $'\n' ]] ; then
|
|
echo "${INPUT_INVENTORY}" > /tmp/inventory
|
|
inventory="/tmp/inventory"
|
|
else
|
|
inventory="${INPUT_INVENTORY}"
|
|
fi
|
|
echo "Using inventory ${inventory}"
|
|
|
|
# Process Ansible Galaxy requirements
|
|
if [ ! -z "${INPUT_REQUIREMENTS:-}" ] ; then
|
|
ansible-galaxy install -r "${INPUT_REQUIREMENTS}"
|
|
echo "Installed Galaxy Dependencies"
|
|
fi
|
|
|
|
# Change the working directory
|
|
if [ ! -z "${INPUT_DIRECTORY:-}" ] ; then
|
|
cd "${INPUT_DIRECTORY}"
|
|
echo "Changed working directory to $(pwd)"
|
|
fi
|
|
|
|
# Process Ansible Configuration
|
|
if [ ! -z "${INPUT_CONFIGURATION:-}" ] ; then
|
|
if [ -f ./ansible.cfg ] ; then
|
|
echo "An existing ansible.cfg file is in the current working directory"
|
|
exit 1
|
|
fi
|
|
|
|
echo "${INPUT_CONFIGURATION}" > ./ansible.cfg
|
|
echo "Created $(pwd)/ansible.cfg"
|
|
fi
|
|
|
|
# Setup and Run Ansible Playbook
|
|
become="${INPUT_BECOME:-false}"
|
|
check_mode="${INPUT_CHECK_MODE:-false}"
|
|
remote_user="${INPUT_REMOTE_USER:-ansible}"
|
|
|
|
cmd="-u ${remote_user}"
|
|
if [ "${become,,}" == "true" ] ; then
|
|
cmd="${cmd} -b"
|
|
fi
|
|
|
|
if [ "${check_mode,,}" == "true" ] ; then
|
|
cmd="${cmd} --check"
|
|
fi
|
|
|
|
if [ ! -z "${INPUT_VAULT_PASSWORD:-}" ] ; then
|
|
echo "${INPUT_VAULT_PASSWORD}" > /tmp/vault_password
|
|
cmd="${cmd} --vault-password-file /tmp/vault_password"
|
|
fi
|
|
|
|
cmd="${cmd} --inventory ${inventory} ${INPUT_PLAYBOOK}"
|
|
echo "Ansible Command: ansible-playbook ${cmd}"
|
|
|
|
ansible-playbook $cmd
|