roles/cert-manager: add get_certificate.sh

playbook/roles/cert-manager/files/get_certificate.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+check_empty() {
+  if [ -z "$1" ]; then
+    echo "$2"
+    exit 1
+  fi
+}
+
+check_empty "$1" "Please provide DOMAIN" && DOMAIN=$1
+check_empty "$2" "Please provide VAULT_ADDR" && VAULT_ADDR=$2
+check_empty "$3" "Please provide VAULT_TOKEN" && VAULT_TOKEN=$3
+
+SECRET_PATH="certs/$DOMAIN"
+
+# Output paths
+CERTIFICATE_PATH="/etc/ssl/${DOMAIN}.pem"
+PRIVATE_KEY_PATH="/etc/ssl/${DOMAIN}.key"
+
+# Read certificate from Vault
+vault kv get -field=certificate certs/${DOMAIN} > "$CERTIFICATE_PATH"
+# Read private key from Vault
+vault kv get -field=private_key certs/${DOMAIN} > "$PRIVATE_KEY_PATH"
+
+# Set permissions for the private key (modify as needed)
+chmod 600 "$PRIVATE_KEY_PATH"
+
+echo "Certificate and private key have been written to $CERTIFICATE_PATH and $PRIVATE_KEY_PATH"

playbook/roles/cert-manager/tasks/main.yml

@@ -2,33 +2,6 @@
   script: files/certs_automated_issuance.sh {{ domain }} {{ dns_ak }} {{ dns_sk }}
   when: (inventory_hostname in groups[group]) and (auto_issuance == true)
 
-#- name: certs automated issuance 
-#  script: files/fetch_certs_from_vault.py {{ domain }} {{ dns_ak }} {{ dns_sk }}
-#  when: (inventory_hostname in groups[group]) and (vault == true)
-
-- name: Fetch Certificate and Private Key from Vault
-  community.hashi_vault.vault_read:
-    url: "{{ vault_url }}"
-    token: "{{ vault_token }}"
-    path: "{{ vault_secret_path }}"
-  register: vault_result
+- name: certs automated issuance 
+  script: files/get_certificate.sh {{ domain }} {{ vault_url }} {{ vault_token }}
   when: (inventory_hostname in groups[group]) and (vault == true)
-
-- name: Write Certificate to File
-  ansible.builtin.copy:
-    content: "{{ vault_result.data.certificate }}"
-    dest: "/etc/ssl/{{ domain }}.pem"
-    owner: root
-    group: root
-    mode: '0644'
-  when: (inventory_hostname in groups[group]) and (vault == true)
-
-- name: Write Private Key to File
-  ansible.builtin.copy:
-    content: "{{ vault_result.data.private_key }}"
-    dest: "/etc/ssl/{{ domain }}.key"
-    owner: root
-    group: root
-    mode: '0600'
-  when: (inventory_hostname in groups[group]) and (vault == true)
-