|
|
|
@ -23,19 +23,30 @@ version_added: "2.4"
|
|
|
|
|
description:
|
|
|
|
|
- Create and remove Docker secrets in a Swarm environment. Similar to `docker secret create` and `docker secret rm`.
|
|
|
|
|
- Adds to the metadata of new secrets 'ansible_key', an encrypted hash representation of the data, which is then used
|
|
|
|
|
- in future runs to test if a secret has changed.
|
|
|
|
|
- If 'ansible_key is not present, then a secret will not be updated unless the C(force) option is set.
|
|
|
|
|
in future runs to test if a secret has changed. If 'ansible_key is not present, then a secret will not be updated
|
|
|
|
|
unless the C(force) option is set.
|
|
|
|
|
- Updates to secrets are performed by removing the secret and creating it again.
|
|
|
|
|
options:
|
|
|
|
|
data:
|
|
|
|
|
description:
|
|
|
|
|
- String. The value of the secret. Required when state is C(present).
|
|
|
|
|
- The value of the secret. Required when state is C(present).
|
|
|
|
|
required: false
|
|
|
|
|
type: str
|
|
|
|
|
data_is_b64:
|
|
|
|
|
description:
|
|
|
|
|
- If set to C(true), the data is assumed to be Base64 encoded and will be
|
|
|
|
|
decoded before being used.
|
|
|
|
|
- To use binary C(data), it is better to keep it Base64 encoded and let it
|
|
|
|
|
be decoded by this option.
|
|
|
|
|
default: false
|
|
|
|
|
type: bool
|
|
|
|
|
version_added: "2.8"
|
|
|
|
|
labels:
|
|
|
|
|
description:
|
|
|
|
|
- "A map of key:value meta data, where both the I(key) and I(value) are expected to be a string."
|
|
|
|
|
- If new meta data is provided, or existing meta data is modified, the secret will be updated by removing it and creating it again.
|
|
|
|
|
required: false
|
|
|
|
|
type: dict
|
|
|
|
|
force:
|
|
|
|
|
description:
|
|
|
|
|
- Use with state C(present) to always remove and recreate an existing secret.
|
|
|
|
@ -46,6 +57,7 @@ options:
|
|
|
|
|
description:
|
|
|
|
|
- The name of the secret.
|
|
|
|
|
required: true
|
|
|
|
|
type: str
|
|
|
|
|
state:
|
|
|
|
|
description:
|
|
|
|
|
- Set to C(present), if the secret should exist, and C(absent), if it should not.
|
|
|
|
@ -72,10 +84,14 @@ author:
|
|
|
|
|
|
|
|
|
|
EXAMPLES = '''
|
|
|
|
|
|
|
|
|
|
- name: Create secret foo
|
|
|
|
|
- name: Create secret foo (from a file on the control machine)
|
|
|
|
|
docker_secret:
|
|
|
|
|
name: foo
|
|
|
|
|
data: Hello World!
|
|
|
|
|
# If the file is JSON or binary, Ansible might modify it (because
|
|
|
|
|
# it is first decoded and later re-encoded). Base64-encoding the
|
|
|
|
|
# file directly after reading it prevents this to happen.
|
|
|
|
|
data: "{{ lookup('file', '/path/to/secret/file') | base64 }}"
|
|
|
|
|
data_is_b64: true
|
|
|
|
|
state: present
|
|
|
|
|
|
|
|
|
|
- name: Change the secret data
|
|
|
|
@ -134,11 +150,12 @@ RETURN = '''
|
|
|
|
|
secret_id:
|
|
|
|
|
description:
|
|
|
|
|
- The ID assigned by Docker to the secret object.
|
|
|
|
|
returned: success
|
|
|
|
|
returned: success and C(state == "present")
|
|
|
|
|
type: str
|
|
|
|
|
sample: 'hzehrmyjigmcp2gb6nlhmjqcv'
|
|
|
|
|
'''
|
|
|
|
|
|
|
|
|
|
import base64
|
|
|
|
|
import hashlib
|
|
|
|
|
|
|
|
|
|
try:
|
|
|
|
@ -165,13 +182,18 @@ class SecretManager(DockerBaseClass):
|
|
|
|
|
self.name = parameters.get('name')
|
|
|
|
|
self.state = parameters.get('state')
|
|
|
|
|
self.data = parameters.get('data')
|
|
|
|
|
if self.data is not None:
|
|
|
|
|
if parameters.get('data_is_b64'):
|
|
|
|
|
self.data = base64.b64decode(self.data)
|
|
|
|
|
else:
|
|
|
|
|
self.data = to_bytes(self.data)
|
|
|
|
|
self.labels = parameters.get('labels')
|
|
|
|
|
self.force = parameters.get('force')
|
|
|
|
|
self.data_key = None
|
|
|
|
|
|
|
|
|
|
def __call__(self):
|
|
|
|
|
if self.state == 'present':
|
|
|
|
|
self.data_key = hashlib.sha224(to_bytes(self.data)).hexdigest()
|
|
|
|
|
self.data_key = hashlib.sha224(self.data).hexdigest()
|
|
|
|
|
self.present()
|
|
|
|
|
elif self.state == 'absent':
|
|
|
|
|
self.absent()
|
|
|
|
@ -247,6 +269,7 @@ def main():
|
|
|
|
|
name=dict(type='str', required=True),
|
|
|
|
|
state=dict(type='str', choices=['absent', 'present'], default='present'),
|
|
|
|
|
data=dict(type='str', no_log=True),
|
|
|
|
|
data_is_b64=dict(type='bool', default=False),
|
|
|
|
|
labels=dict(type='dict'),
|
|
|
|
|
force=dict(type='bool', default=False)
|
|
|
|
|
)
|
|
|
|
|