build

roles/kubernetes/tasks/Rocky.yml

@@ -78,6 +78,61 @@
     - name: Apply sysctl
       command: sysctl --system
 
+    - name: Read GitLab password from Vault
+      ansible.builtin.set_fact:
+        gitlab_private_key: >-
+          {{
+            lookup(
+              'community.hashi_vault.hashi_vault',
+              'secret=secret/data/gitlab '
+              ~ 'field=ssh_private_key '
+              ~ 'url=http://vault.home.lan:8205 '
+              ~ 'token=' ~ lookup('env', 'VAULT_TOKEN')
+            )
+          }}
+    - name: Read GitLab password from Vault
+      ansible.builtin.set_fact:
+        gitlab_public_key: >-
+          {{
+            lookup(
+              'community.hashi_vault.hashi_vault',
+              'secret=secret/data/gitlab '
+              ~ 'field=ssh_public_key '
+              ~ 'url=http://vault.home.lan:8205 '
+              ~ 'token=' ~ lookup('env', 'VAULT_TOKEN')
+            )
+          }}
+
+    - name: Store ssh key in file
+      ansible.builtin.copy:
+        content: "{{ gitlab_private_key.ssh_private_key }}\n"
+        dest: /home/{{ ansible_user_id }}/.ssh/id_ed25519_gitlab
+        owner: "{{ ansible_user_id }}"
+        group: "{{ ansible_user_id }}"
+        mode: '0600'
+
+    - name: Store ssh key in file
+      ansible.builtin.copy:
+        content: "{{ gitlab_public_key.ssh_public_key }}\n"
+        dest: /home/{{ ansible_user_id }}/.ssh/id_ed25519_gitlab.pub
+        owner: "{{ ansible_user_id }}"
+        group: "{{ ansible_user_id }}"
+        mode: '0600'
+
+    - name: Configure SSH for GitLab
+      ansible.builtin.blockinfile:
+        path: "{{ ansible_env.HOME }}/.ssh/config"
+        create: yes
+        owner: "{{ ansible_user_id }}"
+        group: "{{ ansible_user_id }}"
+        mode: '0600'
+        block: |
+          Host gitlab.sectorq.eu
+            HostName gitlab.sectorq.eu
+            User git
+            IdentityFile {{ ansible_env.HOME }}/.ssh/id_ed25519_gitlab
+            IdentitiesOnly yes
+
     - name: Install required packages
       dnf:
         name: