jcline/ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

Address review comments

Browse source 
- liberal use of no_log in the kyroptic module
- Switch to using an environment variable for openssl PIN
This commit is contained in:
Jeremy Cline 2026-07-21 15:55:43 -04:00
commit 505a17f2aa
Signed by: jcline
SSH key fingerprint: SHA256:DrYh5Q884KGMpF+86oifUQ7ngt760WMR72bFRnqvrU0
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
roles/siguldry/server/tasks/kryoptic.yml
View file

@ -45,6 +45,7 @@
environment:
KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}"
KRYOPTIC_SO_PIN: "{{ siguldry_kryoptic_so_pin }}"
no_log: true
when: not kryoptic_db.stat.exists
tags:
- config
@ -64,6 +65,7 @@
KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}"
KRYOPTIC_SO_PIN: "{{ siguldry_kryoptic_so_pin }}"
KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}"
no_log: true
when: not kryoptic_db.stat.exists
tags:
- config
@ -82,6 +84,7 @@
environment:
KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}"
KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}"
no_log: true
register: kryoptic_objects
changed_when: false
tags:
@ -105,6 +108,7 @@
environment:
KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}"
KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}"
no_log: true
when: "'siguldry-binding-key' not in kryoptic_objects.stdout"
tags:
- config
@ -117,12 +121,14 @@
openssl req -x509
-provider pkcs11
-subj /CN=siguldry-binding-key
-passin pass:{{ siguldry_kryoptic_user_pin }}
-passin env:KRYOPTIC_USER_PIN
-key pkcs11:token=siguldry-stg-token;type=private
-out /etc/siguldry/kryoptic-binding.crt
creates: /etc/siguldry/kryoptic-binding.crt
environment:
KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}"
KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}"
no_log: true
tags:
- config
- siguldry
@ -144,6 +150,7 @@
environment:
KRYOPTIC_CONF: "{{ siguldry_kryoptic_conf }}"
KRYOPTIC_USER_PIN: "{{ siguldry_kryoptic_user_pin }}"
no_log: true
when: "'siguldry-binding-key' not in kryoptic_objects.stdout"
tags:
- config