Skip to content
This repository was archived by the owner on May 30, 2025. It is now read-only.

Commit 852aa8e

Browse files
authored
Clean up README and add Token Auth details
1 parent f653556 commit 852aa8e

File tree

1 file changed

+134
-201
lines changed

1 file changed

+134
-201
lines changed

README.md

Lines changed: 134 additions & 201 deletions
Original file line numberDiff line numberDiff line change
@@ -7,161 +7,156 @@ _This open source project is community-supported. To report a problem or share a
77
In addition, use the **[Pull requests](../../pulls)** tab to contribute actual bug fixes or proposed enhancements.
88
We welcome and appreciate all contributions._
99

10-
Venafi Role for Ansible
11-
=======================
12-
This solution implements an Ansible Role that uses the [VCert-Python](https://github.com/Venafi/vcert-python)
13-
library to simplify certificate enrollment and ensure compliance with enterprise security policy.
10+
# Venafi Role for Ansible
1411

15-
Requirements
16-
------------
17-
`ansible`
18-
`VCert >= 0.6.8`
12+
This solution adds certificate enrollment capabilities to [Red Hat Ansible](https://www.ansible.com/) by seamlessly
13+
integrating with the [Venafi Trust Protection Platform](https://www.venafi.com/platform/trust-protection-platform)
14+
or [Venafi Cloud](https://www.venafi.com/platform/cloud/devops) in a manner that ensures compliance with corporate
15+
security policy and provides visibility into certificate issuance enterprise wide.
1916

20-
Quickstart
21-
------------
22-
1. Install Ansible and VCert via pip
23-
`sudo pip install ansible vcert --upgrade`
17+
## Requirements
2418

25-
Using with Ansible Galaxy
26-
--------------------------
27-
For more information about Ansible Galaxy, please refer to official documentation:
28-
https://galaxy.ansible.com/docs/using/installing.html
29-
30-
1. Install role with Ansible Galaxy command:
31-
`ansible-galaxy install venafi.ansible_role_venafi`
32-
This will install the Venafi Ansible Role from Ansible Galaxy - https://galaxy.ansible.com/venafi/ansible_role_venafi
33-
34-
1. Create the `credentials.yml` and populate it with connection parameters:
35-
```bash
36-
cat <<EOF >>credentials.yml
37-
user: 'admin'
38-
password: 'secret'
39-
url: 'https://tpp.venafi.instance.com/vedsdk/'
40-
zone: "Your\\policy\\folder"
41-
trust_bundle: "/path-to/tpp-trust-bundle.pem"
42-
EOF
43-
```
44-
_Note: trust bundle file must be in PEM (text) format; errors will occur if it is a binary format._
19+
Review the [Venafi](https://github.com/Venafi/vcert-python#prerequisites-for-using-with-trust-protection-platform)
20+
prerequisites, then install Ansible and [VCert-Python](https://github.com/Venafi/vcert-python) (v0.9.0 or higher) using `pip`:
21+
```sh
22+
pip install ansible vcert --upgrade
23+
```
4524

46-
1. Encrypt it using ansible-vault: This is not mandatory but it is highly recommended to encrypt the credentials file
47-
`ansible-vault encrypt credentials.yml`
25+
## Using with Ansible Galaxy
4826

49-
1. Write a simple playbook: Let's call the file sample.yml
50-
```yaml
51-
- hosts: localhost
52-
roles:
53-
- role: venafi.ansible_role_venafi
54-
certificate_cert_dir: "/tmp/etc/ssl/{{ certificate_common_name }}"
55-
```
27+
For more information about Ansible Galaxy, go to https://galaxy.ansible.com/docs/using/installing.html
5628

57-
1. Run the playbook:
58-
`ansible-playbook sample.yml --ask-vault-pass`
59-
Running the playbook will generate a certificate and place it into folder in /tmp/etc/ssl/ directory.
60-
Additional parameters can be added to the playbook to control the values of the variables for certificate management. Variables are documented below. You can also review defaults/main.yml file for the variables used.
29+
1. Install the [Venafi Role for Ansible](https://galaxy.ansible.com/venafi/ansible_role_venafi) from Ansible Galaxy:
6130

62-
Use `--ask-vault-pass` if you have encrypted the `credentials.yml` file. You can decrypt the file by providing the vault password to make changes to `credentials.yml` file at anytime.
31+
```sh
32+
ansible-galaxy install venafi.ansible_role_venafi
33+
```
6334

64-
Preparing a demo environemnt with docker to run ansible
35+
1. Create the `credentials.yml` and populate it with connection parameters:
6536

66-
1. Prepare demo environment (Skip this step if you want to use your own environment. Change tests/inventory file to use your own inventory.)
37+
**Trust Protection Platform**:
38+
39+
```sh
40+
cat <<EOF >>credentials.yml
41+
access_token: 'p0WTt3sDPbzm2BDIkoJROQ=='
42+
url: 'https://tpp.venafi.example'
43+
zone: "DevOps\\Ansible"
44+
trust_bundle: "/path/to/bundle.pem"
45+
EOF
46+
```
47+
48+
**Venafi Cloud**:
49+
50+
```sh
51+
cat <<EOF >>credentials.yml
52+
token: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
53+
zone: 'zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz'
54+
EOF
55+
```
56+
57+
The Venafi Role for Ansible supports the following connection and credential settings:
58+
59+
| Variable Name | Description |
60+
| -------------- | ------------------------------------------------------------ |
61+
| `access_token` | Trust Protection Platform access token for the "ansible-by-venafi" API Application |
62+
| `password` | **[DEPRECATED]** Trust Protection Platform WebSDK password, use `access_token` if possible |
63+
| `test_mode` | When "true", the role operates without connecting to Trust Protection Platform or Venafi Cloud |
64+
| `token` | Venafi Cloud API key |
65+
| `trust_bundle` | Text file containing trust anchor certificates in PEM (text) format, generally required for Trust Protection Platform |
66+
| `url` | Venafi service URL (e.g. "https://tpp.venafi.example"), generally only applicable to Trust Protection Platform |
67+
| `user` | **[DEPRECATED]** Trust Protection Platform WebSDK username, use `access_token` if possible |
68+
| `zone` | Trust Protection Platform policy folder or Venafi Cloud zone ID (shown in Venafi Cloud UI) |
69+
70+
1. Use `ansible-vault` to encrypt the `credentials.yml` file using a password. This is optional but highly recommended.
71+
As long as you know the password you can always decrypt the file to make changes and then re-encrypt it.
72+
Go to https://docs.ansible.com/ansible/latest/user_guide/vault.html for more information.
73+
74+
```sh
75+
ansible-vault encrypt credentials.yml
76+
```
77+
78+
1. Write a simple playbook called, for example, `sample.yml`.
79+
80+
```yaml
81+
- hosts: localhost
82+
roles:
83+
- role: venafi.ansible_role_venafi
84+
certificate_cert_dir: "/tmp/etc/ssl/{{ certificate_common_name }}"
85+
```
86+
87+
1. Run the playbook.
88+
89+
```sh
90+
ansible-playbook sample.yml --ask-vault-pass
91+
```
92+
93+
Running the playbook will generate a certificate and place it into folder in /tmp/etc/ssl/ directory.
94+
The `--ask-vault-pass` parameter is needed if you encrypted the `credentials.yml` file. Additional
95+
playbook variables can be added to specify properties of the certificate and key pair, file locations,
96+
and to override default behaviors.
97+
98+
| Variable Name | Description |
99+
| ---------------------------------------- | ------------------------------------------------------------ |
100+
| `credentials_file` | Name of the file containing Venafi credentials and connection settings<br/>Default: credentials.yml |
101+
| `certificate_common_name` | *Common Name* to request for the certificate.<br/>Default: "{{ ansible_fqdn }}" |
102+
| `certificate_alt_name` | Comma separated list of *Subject Alternative Names* to request for the certificate. Prefix each value with the SAN type (e.g. "DNS:host.company.com,IP:10.20.30.40,email:me@company.com") | |
103+
| `certificate_privatekey_type` | Key algorithm, "RSA" or "ECDSA"<br/>Default: "RSA" (from VCert) |
104+
| `certificate_privatekey_size` | Key size in bits for RSA keys<br/>Default: "2048" (from VCert) |
105+
| `certificate_privatekey_curve` | Elliptic Curve for ECDSA keys<br/>Default: "P251" (from VCert) |
106+
| `certificate_privatekey_passphrase` | Password to use for encrypting the private key |
107+
| `certificate_chain_option` | Specifies whether the root CA certificate appears "last" (default) or "first" in the chain file |
108+
| `certificate_cert_dir` | Local parent directory where the cryptographic assets will be stored<br/>Default: "/etc/ssl/{{ certificate_common_name }}" |
109+
| `certificate_cert_path` | Local directory where certificate files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.pem" |
110+
| `certificate_chain_path` | Local directory where certificate chain files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.chain.pem" |
111+
| `certificate_privatekey_path` | Local directory where private key files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.key" |
112+
| `certificate_csr_path` | Local directory where certificate signing request files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.csr" |
113+
| `certificate_remote_execution` | Specifies whether cryptographic assets will be generated remotely, or locally and then provisioned to the remote host<br/>Default: false |
114+
| `certificate_remote_cert_path` | Directory on remote host where certificate files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.pem" |
115+
| `certificate_remote_chain_path` | Directory on remote host where certificate chain files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.chain.pem" |
116+
| `certificate_remote_privatekey_path` | Directory on remote host where private key files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.key" |
117+
| `certificate_copy_private_key_to_remote` | Specifies whether to copy the private key file to the remote host<br/>Default: true |
118+
119+
Defaults are defined in the [defaults/main.yml](defaults/main.yml) file.
120+
121+
## Preparing a Docker demo environment for running Ansible
122+
123+
1. (Optional) Prepare the demo environment. If you want to use your own inventory, update the tests/inventory file.
67124
68125
1. To run our test/demo playbook you'll need the Docker provisioning role.
69-
Download it into the tests/roles/provision_docker directory:
70-
```bash
71-
git clone https://github.com/chrismeyersfsu/provision_docker.git tests/roles/provision_docker
72-
```
126+
Download it into the `tests/roles/provision_docker` directory:
127+
128+
```sh
129+
git clone https://github.com/chrismeyersfsu/provision_docker.git tests/roles/provision_docker
130+
```
73131
74-
1. Build Docker images needed for the demo playbook:
75-
```bash
132+
1. Then build the Docker images needed for the demo playbook:
133+
134+
```sh
76135
docker build ./tests --tag local-ansible-test
77136
```
78137
79-
Demo certificates will be placed in the /tmp/ansible/etc/ssl directory on the Ansible host.
80-
From there they will be distributed to the /etc/ssl/ directory of remote hosts.
138+
Demo certificates will be placed in the `/tmp/ansible/etc/ssl` directory on the Ansible host.
139+
From there they will be distributed to the `/etc/ssl/` directory of remote hosts.
81140
82-
1. Generate a credentials file for either Venafi Platform or Venafi Cloud as described in the QuickStart.
141+
1. Generate a credentials file for either Trust Protection Platform or Venafi Cloud as described in the above section.
83142
84-
1. For Venafi Platform create a `credentials.yml` similar to the following:
85-
86-
1. For Venafi Cloud set the token to your API key in the `credentials.yml` and the Zone ID
87-
of the Venafi Cloud zone that you want to request certificates from:
88-
```yaml
89-
token: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
90-
zone: "zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz"
91-
```
92-
1. Encrypt the credentials file using ansible-vault; you will be asked to enter a password:
93-
```bash
94-
ansible-vault encrypt credentials.yml
95-
```
96-
97-
1. Run Ansible playbook (remove docker_demo=true if you want to use your own inventory).
98-
The contents of `credentials.yml` will be used to decide whether Venafi Cloud of the TPP Platform is used. If you set a token, the
99-
playbook runs using Venafi Cloud. If you set a password, the playbook runs using Venafi Platform.
100-
You will be asked for the vault password you entered before.
101-
```bash
102-
ansible-playbook -i tests/inventory \
143+
1. Run the Ansible playbook (remove `docker_demo=true` if you want to use your own inventory).
144+
The contents of `credentials.yml` will be used to decide whether Trust Protection Platform or Venafi Cloud is used.
145+
If you set the `token` parameter, the playbook assumes you are using Venafi Cloud. If you set the `access_token` or
146+
`password` parameters, the playbook assumes you are using Trust Protection Platform.
147+
148+
```sh
149+
ansible-playbook -i tests/inventory \
103150
tests/venafi-playbook-example.yml \
104151
--extra-vars "credentials_file=credentials.yml docker_demo=true" \
105152
--ask-vault-pass
106-
```
107-
108-
109-
Role Variables
110-
--------------
111-
112-
For default variables values, please look into defaults/main.yml file.
113-
114-
```yaml
115-
# Credentials.
116-
venafi:
117-
# Venafi Platform connection parameters
118-
user: 'admin'
119-
password: 'myTPPpassword'
120-
url: 'https://tpp.venafi.example/vedsdk'
121-
zone: "devops\\vcert"
122-
# Path to PEM bundle (text format) that includes the trust anchor (root CA) certificate for the Venafi Platform API server
123-
trust_bundle: "/opt/venafi/bundle.pem"
124-
# Venafi Cloud connection parameters
125-
#token: 'enter-cloud-api-token-here'
126-
#zone: 'enter Zone ID obtained from Venafi Cloud Web UI'
127-
#Test mode parameter
128-
#test_mode: true
129-
130-
# All variables from venafi section should be in credentials file.
131-
credentials_file: credentials.yml
132-
133-
# Certificate parameters. These are examples.
134-
certificate_common_name: "{{ ansible_fqdn }}"
135-
certificate_alt_name: "IP:192.168.1.1,DNS:www.venafi.example.com,DNS:m.venafi.example.com,email:e@venafi.com,email:e2@venafi.com,IP Address:192.168.2.2"
136-
137-
certificate_privatekey_type: "RSA"
138-
certificate_privatekey_size: "2048"
139-
certificate_privatekey_curve: "P251"
140-
certificate_privatekey_passphrase: "password"
141-
certificate_chain_option: "last"
142-
143-
certificate_cert_dir: "/etc/ssl/{{ certificate_common_name }}"
144-
certificate_cert_path: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.pem"
145-
certificate_chain_path: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.chain.pem"
146-
certificate_privatekey_path: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.key"
147-
certificate_csr_path: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.csr"
148-
149-
# Where to execute venafi_certificate module. If set to false, certificate will be
150-
# created on Ansible master host and then copied to the remote server.
151-
certificate_remote_execution: false
152-
# Remote location where to place the certificate.
153-
certificate_remote_cert_path: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.pem"
154-
certificate_remote_chain_path: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.chain.pem"
155-
certificate_remote_privatekey_path: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.key"
156-
# Set to false if you don't want to copy private key to remote location.
157-
certificate_copy_private_key_to_remote: true
158-
159-
```
153+
```
154+
155+
You will be prompted for the password for decrypting the `credentials.yml` as before. The source file for the
156+
credentials can be overridden using the *credentials_file* variable and this can be specified on the command line
157+
using the `--extra-vars` parameter as shown.
160158
161-
Example Playbook
162-
----------------
163-
164-
Playbook file example:
159+
## Sample Playbook
165160
166161
```yaml
167162
- hosts: servers
@@ -184,79 +179,17 @@ Playbook file example:
184179
certificate_remote_privatekey_path: "{{ certificate_remote_cert_dir }}/{{ certificate_common_name }}.key"
185180
# Set to false if you don't want to copy private key to remote location.
186181
certificate_copy_private_key_to_remote: true
187-
188-
```
189-
190-
Credential file examples:
191-
192-
For Venafi Trust Protection Platform:
193-
194-
```yaml
195-
user: 'admin'
196-
password: 'secret'
197-
url: 'https://tpp.venafi.instance.com/vedsdk/'
198-
zone: "Your\\policy\\folder"
199-
trust_bundle: "/path-to/tpp-trust-bundle.pem"
200-
```
201-
_Note: trust bundle file must be in PEM (text) format; errors will occur if it is a binary format._
202-
203-
For Venafi Cloud:
204-
205-
```yaml
206-
token: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
207-
zone: "zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz"
208182
```
209183
210-
By default credentials are read from file credentials.yml but can be overridden using
211-
the *credentials_file* variable, for example:
212-
213-
ansible-playbook playbook.yml --extra-vars "credentials_file=other_credentials.yml"
214-
215-
Look in the [/tests](/tests) directory and Makefile for additional examples.
216184
For playbook examples look into [venafi-playbook-example.yml](tests/venafi-playbook-example.yml) file.
217185
For role examples look into [venafi-role-playbook-example.yml](tests/venafi-role-playbook-example.yml) file
218186
219-
For official documentation about using roles see https://docs.ansible.com/ansible/latest/user_guide/playbooks_reuse_roles.html
220-
221-
Security best practices
222-
----------------
223-
224-
We strongly recommend that you use ansible-vault for the credentials file.
225-
To do so you can use the following steps:
226-
227-
1. Create the `credentials.yml` and populate it with connection parameters:
228-
```bash
229-
cat <<EOF >>credentials.yml
230-
user: 'admin'
231-
password: 'secret'
232-
url: 'https://tpp.venafi.instance.com/vedsdk/'
233-
zone: "Your\\policy\\folder"
234-
trust_bundle: "/path-to/tpp-trust-bundle.pem"
235-
EOF
236-
```
237-
1. Encrypt it using ansible-vault:
238-
`ansible-vault encrypt credentials.yml`
239-
240-
1. Add option "--vault-id @prompt" to your ansible-playbook
241-
command to prompt for vault password:
242-
```bash
243-
ansible-playbook --vault-id @prompt playbook.yml
244-
```
245-
246-
For other Vault use cases see https://docs.ansible.com/ansible/latest/user_guide/vault.html
247-
248-
249-
Venafi Platform configuration requirements
250-
----------------
251-
Please refer to this section:
252-
https://github.com/Venafi/vcert-python#prerequisites-for-using-with-trust-protection-platform
187+
For more information about using roles go to https://docs.ansible.com/ansible/latest/user_guide/playbooks_reuse_roles.html
253188
254-
License
255-
-------
189+
## License
256190
257-
Apache License Version 2.0
191+
Copyright &copy; Venafi, Inc. All rights reserved.
258192
259-
Author Information
260-
------------------
193+
This solution is licensed under the Apache License, Version 2.0. See `LICENSE` for the full license text.
261194
262-
Venafi Inc.
195+
Please direct questions/comments to opensource@venafi.com.

0 commit comments

Comments
 (0)