58 lines
2.0 KiB
Bash
58 lines
2.0 KiB
Bash
#!/bin/bash
|
|
#
|
|
# KraussNet Ansible Playbook Runner Action Entrypoint
|
|
|
|
set -euo pipefail
|
|
|
|
if [ -z "${INPUT_PKI_CA_URL:-}" ] ; then
|
|
echo "Missing required input parameter 'pki_ca_url'"
|
|
exit 1
|
|
fi
|
|
if [ -z "${INPUT_PKI_FINGERPRINT:-}" ] ; then
|
|
echo "Missing required input parameter 'pki_fingerprint'"
|
|
exit 1
|
|
fi
|
|
if [ -z "${INPUT_PKI_PROVISIONER_PASSWORD:-}" ] ; then
|
|
echo "Missing required input parameter 'pki_provisioner_password'"
|
|
exit 1
|
|
fi
|
|
if [ -z "${INPUT_PLAYBOOK:-}" ] ; then
|
|
echo "Missing required input parameter 'playbook'"
|
|
exit 1
|
|
fi
|
|
if [ -z "${INPUT_INVENTORY:-}" ] ; then
|
|
echo "Missing required input parameter 'inventory'"
|
|
exit 1
|
|
fi
|
|
|
|
# Setup Variables
|
|
provisioner_name=${INPUT_PKI_PROVISIONER_NAME:-"ansible"}
|
|
provisioner_password=${INPUT_PKI_PROVISIONER_PASSWORD}
|
|
default_cert_subject="ansible-kraussnet-action-runner@$(hostname -f)"
|
|
user_cert_subject=${INPUT_SUBJECT:-"$default_cert_subject"}
|
|
|
|
# Bootstrap the PKI Certificate Authority
|
|
step ca bootstrap \
|
|
--ca-url "${INPUT_PKI_CA_URL}" \
|
|
--fingerprint "${INPUT_PKI_FINGERPRINT}"
|
|
echo "Bootstrapped PKI at ${INPUT_PKI_CA_URL}"
|
|
|
|
# Obtain the Host Certificate
|
|
[ ! -d ~/.ssh ] && mkdir ~/.ssh
|
|
echo "@cert-authority *.kraussnet.com $(step ssh config --host --roots)" > ~/.ssh/known_hosts
|
|
echo "Obtained SSH Host Certificate Authority"
|
|
|
|
# Obtain a User Certificate for Ansible
|
|
token=$(step ca token "${user_cert_subject}" --ssh --provisioner "${provisioner_name}" --provisioner-password-file <(printf "${provisioner_password}"))
|
|
echo "Obtained User Token from CA"
|
|
echo $token | step crypto jwt inspect --insecure
|
|
|
|
[ ! -f ~/.ssh/id_ecdsa ] && ssh-keygen -t ecdsa -f ~/.ssh/id_ecdsa -N ''
|
|
[ -f ~/.ssh/id_ecdsa-cert.pub ] && rm ~/.ssh/id_ecdsa-cert.pub
|
|
step ssh certificate "${user_cert_subject}" ~/.ssh/id_ecdsa.pub --sign --provisioner "${provisioner_name}" --token $token
|
|
echo "Obtained User Certificate from CA"
|
|
ssh-keygen -L -f ~/.ssh/id_ecdsa-cert.pub
|
|
|
|
# Run a test command (will be replaced with the Ansible command)
|
|
ssh ansible@rpi-ns1.lan.kraussnet.com 'echo "Hello from $(hostname -f)"'
|