mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-07-21 12:20:21 -07:00
add support for systemd creds encrypt/decrypt (#9383)
* add support for systemd creds encrypt/decrypt Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * add __metaclass__ Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * Python 2.7 issues Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * update version_added and ci test aliases Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * switch to container Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * run tests in docker as well Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * move tasks into tasks/ Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * no need to call echo Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * lint and add become: Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * dont append a newline Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * don't clean newlines Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * only use module name Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * clean Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * change msg to value Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * add return values Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * update attributes and description Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * Update plugins/modules/systemd_creds_decrypt.py Co-authored-by: Felix Fontein <felix@fontein.de> * set newline default Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * Update plugins/modules/systemd_creds_encrypt.py Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com> * Update plugins/modules/systemd_creds_encrypt.py Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com> * Update plugins/modules/systemd_creds_encrypt.py Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com> * update required and spelling Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> * use single backslash Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> --------- Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com> Co-authored-by: Felix Fontein <felix@fontein.de> Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
This commit is contained in:
Thomas Sjögren
GitHub
parent
d887930e49
commit
482a90e8b4
7 changed files with 445 additions and 0 deletions
149
plugins/modules/systemd_creds_encrypt.py
Normal file
149
plugins/modules/systemd_creds_encrypt.py
Normal file
|
|
@ -0,0 +1,149 @@
|
|||
#!/usr/bin/python
|
||||
|
||||
# Copyright (c) 2024, Ansible Project
|
||||
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
# SPDX-License-Identifier: GPL-3.0-or-later
|
||||
|
||||
from __future__ import absolute_import, division, print_function
|
||||
|
||||
__metaclass__ = type
|
||||
|
||||
|
||||
DOCUMENTATION = r"""
|
||||
module: systemd_creds_encrypt
|
||||
short_description: C(systemd)'s C(systemd-creds encrypt) plugin
|
||||
description:
|
||||
- This module encrypts input using C(systemd)'s C(systemd-creds encrypt).
|
||||
author:
|
||||
- Thomas Sjögren (@konstruktoid)
|
||||
version_added: '10.2.0'
|
||||
extends_documentation_fragment:
|
||||
- community.general.attributes
|
||||
attributes:
|
||||
check_mode:
|
||||
support: full
|
||||
details:
|
||||
- This action does not modify state.
|
||||
diff_mode:
|
||||
support: N/A
|
||||
details:
|
||||
- This action does not modify state.
|
||||
options:
|
||||
name:
|
||||
description:
|
||||
- The credential name to embed in the encrypted credential data.
|
||||
type: str
|
||||
required: false
|
||||
not_after:
|
||||
description:
|
||||
- The time when the credential shall not be used anymore.
|
||||
- Takes a timestamp specification in the format described in
|
||||
V(systemd.time(7\)).
|
||||
type: str
|
||||
required: false
|
||||
pretty:
|
||||
description:
|
||||
- Pretty print the output so that it may be pasted directly into a
|
||||
unit file.
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
secret:
|
||||
description:
|
||||
- The secret to encrypt.
|
||||
type: str
|
||||
required: true
|
||||
timestamp:
|
||||
description:
|
||||
- The timestamp to embed into the encrypted credential.
|
||||
- Takes a timestamp specification in the format described in
|
||||
V(systemd.time(7\)).
|
||||
type: str
|
||||
required: false
|
||||
user:
|
||||
description:
|
||||
- A user name or numeric UID to encrypt the credential for.
|
||||
- If set to the special string V(self) it sets the user to the user
|
||||
of the calling process.
|
||||
- Requires C(systemd) 256 or later.
|
||||
type: str
|
||||
required: false
|
||||
notes:
|
||||
- C(systemd-creds) requires C(systemd) 250 or later.
|
||||
"""
|
||||
|
||||
EXAMPLES = """
|
||||
- name: Encrypt secret
|
||||
become: true
|
||||
community.general.systemd_creds_encrypt:
|
||||
name: db
|
||||
not_after: +48hr
|
||||
secret: access_token
|
||||
register: encrypted_secret
|
||||
|
||||
- name: Print the encrypted secret
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ encrypted_secret }}"
|
||||
"""
|
||||
|
||||
RETURN = r"""
|
||||
value:
|
||||
description: The Base64 encoded encrypted secret.
|
||||
type: str
|
||||
returned: always
|
||||
sample: "WhQZht+JQJax1aZemmGLxmAAAA..."
|
||||
"""
|
||||
|
||||
from ansible.module_utils.basic import AnsibleModule
|
||||
|
||||
|
||||
def main():
|
||||
"""Encrypt secret using systemd-creds."""
|
||||
module = AnsibleModule(
|
||||
argument_spec=dict(
|
||||
name=dict(type="str", required=False),
|
||||
not_after=dict(type="str", required=False),
|
||||
pretty=dict(type="bool", default=False),
|
||||
secret=dict(type="str", required=True, no_log=True),
|
||||
timestamp=dict(type="str", required=False),
|
||||
user=dict(type="str", required=False),
|
||||
),
|
||||
supports_check_mode=True,
|
||||
)
|
||||
|
||||
cmd = module.get_bin_path("systemd-creds", required=True)
|
||||
|
||||
name = module.params["name"]
|
||||
not_after = module.params["not_after"]
|
||||
pretty = module.params["pretty"]
|
||||
secret = module.params["secret"]
|
||||
timestamp = module.params["timestamp"]
|
||||
user = module.params["user"]
|
||||
|
||||
encrypt_cmd = [cmd, "encrypt"]
|
||||
if name:
|
||||
encrypt_cmd.append("--name=" + name)
|
||||
else:
|
||||
encrypt_cmd.append("--name=")
|
||||
if not_after:
|
||||
encrypt_cmd.append("--not-after=" + not_after)
|
||||
if pretty:
|
||||
encrypt_cmd.append("--pretty")
|
||||
if timestamp:
|
||||
encrypt_cmd.append("--timestamp=" + timestamp)
|
||||
if user:
|
||||
encrypt_cmd.append("--uid=" + user)
|
||||
encrypt_cmd.extend(["-", "-"])
|
||||
|
||||
rc, stdout, stderr = module.run_command(encrypt_cmd, data=secret, binary_data=True)
|
||||
|
||||
module.exit_json(
|
||||
changed=False,
|
||||
value=stdout,
|
||||
rc=rc,
|
||||
stderr=stderr,
|
||||
)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Loading…
Add table
Add a link
Reference in a new issue