You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on May 30, 2025. It is now read-only.
For more information about Ansible Galaxy, go to https://galaxy.ansible.com/docs/using/installing.html
56
28
57
-
1. Run the playbook:
58
-
`ansible-playbook sample.yml --ask-vault-pass`
59
-
Running the playbook will generate a certificate and place it into folder in /tmp/etc/ssl/ directory.
60
-
Additional parameters can be added to the playbook to control the values of the variables for certificate management. Variables are documented below. You can also review defaults/main.yml file for the variables used.
29
+
1. Install the [Venafi Role for Ansible](https://galaxy.ansible.com/venafi/ansible_role_venafi) from Ansible Galaxy:
61
30
62
-
Use `--ask-vault-pass` if you have encrypted the `credentials.yml` file. You can decrypt the file by providing the vault password to make changes to `credentials.yml` file at anytime.
31
+
```sh
32
+
ansible-galaxy install venafi.ansible_role_venafi
33
+
```
63
34
64
-
Preparing a demo environemnt with docker to run ansible
35
+
1. Create the `credentials.yml` and populate it with connection parameters:
65
36
66
-
1. Prepare demo environment (Skip this step if you want to use your own environment. Change tests/inventory file to use your own inventory.)
37
+
**Trust Protection Platform**:
38
+
39
+
```sh
40
+
cat <<EOF >>credentials.yml
41
+
access_token: 'p0WTt3sDPbzm2BDIkoJROQ=='
42
+
url: 'https://tpp.venafi.example'
43
+
zone: "DevOps\\Ansible"
44
+
trust_bundle: "/path/to/bundle.pem"
45
+
EOF
46
+
```
47
+
48
+
**Venafi Cloud**:
49
+
50
+
```sh
51
+
cat <<EOF >>credentials.yml
52
+
token: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
53
+
zone: 'zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz'
54
+
EOF
55
+
```
56
+
57
+
The Venafi Role for Ansible supports the following connection and credential settings:
|`credentials_file`| Name of the file containing Venafi credentials and connection settings<br/>Default: credentials.yml |
101
+
|`certificate_common_name`|*Common Name* to request for the certificate.<br/>Default: "{{ ansible_fqdn }}"|
102
+
|`certificate_alt_name`| Comma separated list of *Subject Alternative Names* to request for the certificate. Prefix each value with the SAN type (e.g. "DNS:host.company.com,IP:10.20.30.40,email:me@company.com") ||
103
+
|`certificate_privatekey_type`| Key algorithm, "RSA" or "ECDSA"<br/>Default: "RSA" (from VCert) |
104
+
|`certificate_privatekey_size`| Key size in bits for RSA keys<br/>Default: "2048" (from VCert) |
105
+
|`certificate_privatekey_curve`| Elliptic Curve for ECDSA keys<br/>Default: "P251" (from VCert) |
106
+
|`certificate_privatekey_passphrase`| Password to use for encrypting the private key |
107
+
|`certificate_chain_option`| Specifies whether the root CA certificate appears "last" (default) or "first"in the chain file |
108
+
|`certificate_cert_dir`| Local parent directory where the cryptographic assets will be stored<br/>Default: "/etc/ssl/{{ certificate_common_name }}"|
109
+
|`certificate_cert_path`| Local directory where certificate files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.pem"|
110
+
|`certificate_chain_path`| Local directory where certificate chain files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.chain.pem"|
111
+
|`certificate_privatekey_path`| Local directory where private key files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.key"|
112
+
|`certificate_csr_path`| Local directory where certificate signing request files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.csr"|
113
+
|`certificate_remote_execution`| Specifies whether cryptographic assets will be generated remotely, or locally and then provisioned to the remote host<br/>Default: false|
114
+
|`certificate_remote_cert_path`| Directory on remote host where certificate files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.pem"|
115
+
|`certificate_remote_chain_path`| Directory on remote host where certificate chain files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.chain.pem"|
116
+
|`certificate_remote_privatekey_path`| Directory on remote host where private key files will be stored<br/>Default: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.key"|
117
+
|`certificate_copy_private_key_to_remote`| Specifies whether to copy the private key file to the remote host<br/>Default: true|
118
+
119
+
Defaults are defined in the [defaults/main.yml](defaults/main.yml) file.
120
+
121
+
## Preparing a Docker demo environment for running Ansible
122
+
123
+
1. (Optional) Prepare the demo environment. If you want to use your own inventory, update the tests/inventory file.
67
124
68
125
1. To run our test/demo playbook you'll need the Docker provisioning role.
69
-
Download it into the tests/roles/provision_docker directory:
0 commit comments