mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-07-19 11:20:22 -07:00
[PR #9383/482a90e8 backport][stable-10] add support for systemd creds encrypt/decrypt (#9468)
add support for systemd creds encrypt/decrypt (#9383)
* add support for systemd creds encrypt/decrypt
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* add __metaclass__
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* Python 2.7 issues
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* update version_added and ci test aliases
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* switch to container
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* run tests in docker as well
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* move tasks into tasks/
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* no need to call echo
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* lint and add become:
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* dont append a newline
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* don't clean newlines
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* only use module name
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* clean
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* change msg to value
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* add return values
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* update attributes and description
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* Update plugins/modules/systemd_creds_decrypt.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* set newline default
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* Update plugins/modules/systemd_creds_encrypt.py
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
* Update plugins/modules/systemd_creds_encrypt.py
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
* Update plugins/modules/systemd_creds_encrypt.py
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
* update required and spelling
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* use single backslash
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---------
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
(cherry picked from commit 482a90e8b4)
Co-authored-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
This commit is contained in:
patchback[bot]
GitHub
parent
6b02eaa795
commit
4614047132
7 changed files with 445 additions and 0 deletions
149
plugins/modules/systemd_creds_encrypt.py
Normal file
149
plugins/modules/systemd_creds_encrypt.py
Normal file
|
|
@ -0,0 +1,149 @@
|
|||
#!/usr/bin/python
|
||||
|
||||
# Copyright (c) 2024, Ansible Project
|
||||
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
# SPDX-License-Identifier: GPL-3.0-or-later
|
||||
|
||||
from __future__ import absolute_import, division, print_function
|
||||
|
||||
__metaclass__ = type
|
||||
|
||||
|
||||
DOCUMENTATION = r"""
|
||||
module: systemd_creds_encrypt
|
||||
short_description: C(systemd)'s C(systemd-creds encrypt) plugin
|
||||
description:
|
||||
- This module encrypts input using C(systemd)'s C(systemd-creds encrypt).
|
||||
author:
|
||||
- Thomas Sjögren (@konstruktoid)
|
||||
version_added: '10.2.0'
|
||||
extends_documentation_fragment:
|
||||
- community.general.attributes
|
||||
attributes:
|
||||
check_mode:
|
||||
support: full
|
||||
details:
|
||||
- This action does not modify state.
|
||||
diff_mode:
|
||||
support: N/A
|
||||
details:
|
||||
- This action does not modify state.
|
||||
options:
|
||||
name:
|
||||
description:
|
||||
- The credential name to embed in the encrypted credential data.
|
||||
type: str
|
||||
required: false
|
||||
not_after:
|
||||
description:
|
||||
- The time when the credential shall not be used anymore.
|
||||
- Takes a timestamp specification in the format described in
|
||||
V(systemd.time(7\)).
|
||||
type: str
|
||||
required: false
|
||||
pretty:
|
||||
description:
|
||||
- Pretty print the output so that it may be pasted directly into a
|
||||
unit file.
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
secret:
|
||||
description:
|
||||
- The secret to encrypt.
|
||||
type: str
|
||||
required: true
|
||||
timestamp:
|
||||
description:
|
||||
- The timestamp to embed into the encrypted credential.
|
||||
- Takes a timestamp specification in the format described in
|
||||
V(systemd.time(7\)).
|
||||
type: str
|
||||
required: false
|
||||
user:
|
||||
description:
|
||||
- A user name or numeric UID to encrypt the credential for.
|
||||
- If set to the special string V(self) it sets the user to the user
|
||||
of the calling process.
|
||||
- Requires C(systemd) 256 or later.
|
||||
type: str
|
||||
required: false
|
||||
notes:
|
||||
- C(systemd-creds) requires C(systemd) 250 or later.
|
||||
"""
|
||||
|
||||
EXAMPLES = """
|
||||
- name: Encrypt secret
|
||||
become: true
|
||||
community.general.systemd_creds_encrypt:
|
||||
name: db
|
||||
not_after: +48hr
|
||||
secret: access_token
|
||||
register: encrypted_secret
|
||||
|
||||
- name: Print the encrypted secret
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ encrypted_secret }}"
|
||||
"""
|
||||
|
||||
RETURN = r"""
|
||||
value:
|
||||
description: The Base64 encoded encrypted secret.
|
||||
type: str
|
||||
returned: always
|
||||
sample: "WhQZht+JQJax1aZemmGLxmAAAA..."
|
||||
"""
|
||||
|
||||
from ansible.module_utils.basic import AnsibleModule
|
||||
|
||||
|
||||
def main():
|
||||
"""Encrypt secret using systemd-creds."""
|
||||
module = AnsibleModule(
|
||||
argument_spec=dict(
|
||||
name=dict(type="str", required=False),
|
||||
not_after=dict(type="str", required=False),
|
||||
pretty=dict(type="bool", default=False),
|
||||
secret=dict(type="str", required=True, no_log=True),
|
||||
timestamp=dict(type="str", required=False),
|
||||
user=dict(type="str", required=False),
|
||||
),
|
||||
supports_check_mode=True,
|
||||
)
|
||||
|
||||
cmd = module.get_bin_path("systemd-creds", required=True)
|
||||
|
||||
name = module.params["name"]
|
||||
not_after = module.params["not_after"]
|
||||
pretty = module.params["pretty"]
|
||||
secret = module.params["secret"]
|
||||
timestamp = module.params["timestamp"]
|
||||
user = module.params["user"]
|
||||
|
||||
encrypt_cmd = [cmd, "encrypt"]
|
||||
if name:
|
||||
encrypt_cmd.append("--name=" + name)
|
||||
else:
|
||||
encrypt_cmd.append("--name=")
|
||||
if not_after:
|
||||
encrypt_cmd.append("--not-after=" + not_after)
|
||||
if pretty:
|
||||
encrypt_cmd.append("--pretty")
|
||||
if timestamp:
|
||||
encrypt_cmd.append("--timestamp=" + timestamp)
|
||||
if user:
|
||||
encrypt_cmd.append("--uid=" + user)
|
||||
encrypt_cmd.extend(["-", "-"])
|
||||
|
||||
rc, stdout, stderr = module.run_command(encrypt_cmd, data=secret, binary_data=True)
|
||||
|
||||
module.exit_json(
|
||||
changed=False,
|
||||
value=stdout,
|
||||
rc=rc,
|
||||
stderr=stderr,
|
||||
)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Loading…
Add table
Add a link
Reference in a new issue