From 2803510ac9aa44b118471bfe6c20e8052a9c39f7 Mon Sep 17 00:00:00 2001 From: wakonig_k Date: Tue, 9 Sep 2025 10:43:11 +0200 Subject: [PATCH 1/7] Update file bec_config_server.yaml.j2 --- templates/bec_config_server.yaml.j2 | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/templates/bec_config_server.yaml.j2 b/templates/bec_config_server.yaml.j2 index 33c81e9..336f38b 100644 --- a/templates/bec_config_server.yaml.j2 +++ b/templates/bec_config_server.yaml.j2 @@ -6,6 +6,8 @@ file_writer: log_writer: base_path: {{ log_writer_base_path }} scilog: - env_file: ./ + env_file: /etc/bec/secrets/.scilog.env acl: - acl_file: ./.bec_acl.env + env_file: /etc/bec/secrets/.bec_acl.env +atlas: + env_file: /etc/bec/secrets/.atlas.env From 5427b6f62c4a71193afcd553fedeae86cad24e9c Mon Sep 17 00:00:00 2001 From: wakonig_k Date: Tue, 9 Sep 2025 10:47:12 +0200 Subject: [PATCH 2/7] fix: add folder for secrets, owned by the service user --- tasks/main.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tasks/main.yaml b/tasks/main.yaml index 64947bf..e3517b1 100644 --- a/tasks/main.yaml +++ b/tasks/main.yaml @@ -47,6 +47,12 @@ path: "{{ timestamped_deployment_path }}" state: directory +- name: Create a folder for secrets + ansible.builtin.file: + owner: "{{ service_user }}" + path: "/etc/bec/secrets" + state: directory + - name: Clone BEC repository become_user: "{{ deployment_user }}" ansible.builtin.git: From e61b4794354ddbe3ddc48ebd680da24fcec11880 Mon Sep 17 00:00:00 2001 From: wakonig_k Date: Tue, 9 Sep 2025 11:57:19 +0200 Subject: [PATCH 3/7] feat: add atlas deploy steps --- tasks/main.yaml | 47 ++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 44 insertions(+), 3 deletions(-) diff --git a/tasks/main.yaml b/tasks/main.yaml index e3517b1..f352293 100644 --- a/tasks/main.yaml +++ b/tasks/main.yaml @@ -2,7 +2,7 @@ - name: Edit redis config on rhel9 ansible.builtin.lineinfile: path: /etc/redis/redis.conf - regexp: '^bind ' + regexp: "^bind " line: bind * -::* when: ansible_distribution_major_version == "9" notify: @@ -11,7 +11,7 @@ - name: Disable redis protected-mode on rhel9 ansible.builtin.lineinfile: path: /etc/redis/redis.conf - regexp: '^protected-mode ' + regexp: "^protected-mode " line: protected-mode no when: ansible_distribution_major_version == "9" notify: @@ -20,7 +20,7 @@ - name: Edit redis config on rhel8 ansible.builtin.lineinfile: path: /etc/redis.conf - regexp: '^bind ' + regexp: "^bind " line: bind 0.0.0.0 when: ansible_distribution_major_version == "8" notify: @@ -52,6 +52,47 @@ owner: "{{ service_user }}" path: "/etc/bec/secrets" state: directory + mode: "0750" + +- name: Get BEC Atlas authentication token + ansible.builtin.uri: + url: "https://bec-atlas-qa.psi.ch/api/v1/user/login" + method: POST + body_format: json + body: + username: "admin@bec_atlas.ch" + password: "{{ bec_atlas_token }}" + return_content: yes + register: atlas_auth_response + when: bec_atlas_token is defined + ignore_errors: true + no_log: true + +- name: Fetch deployment credentials from BEC Atlas + ansible.builtin.uri: + url: "https://bec-atlas-qa.psi.ch/api/v1/deploymentCredentials/env" + method: GET + headers: + Authorization: "Bearer {{ atlas_auth_response.content | trim | regex_replace('^\"(.*)\"$', '\\1') }}" + body_format: form-urlencoded + body: + deployment_name: "{{ deployment_name }}.psi.ch" + return_content: yes + register: atlas_credentials + when: bec_atlas_token is defined and atlas_auth_response is succeeded + ignore_errors: true + no_log: true + +- name: Save BEC Atlas credentials to file + ansible.builtin.copy: + content: "{{ atlas_credentials.content }}" + dest: "/etc/bec/secrets/.atlas.env" + owner: "{{ service_user }}" + group: "{{ service_user }}" + mode: "0600" + become: true + when: bec_atlas_token is defined and atlas_credentials is succeeded + ignore_errors: true - name: Clone BEC repository become_user: "{{ deployment_user }}" From 8e71c1c06c55b54727901af5fb519874ca914847 Mon Sep 17 00:00:00 2001 From: wakonig_k Date: Tue, 9 Sep 2025 12:06:00 +0200 Subject: [PATCH 4/7] fix: check status code before continuing --- tasks/main.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tasks/main.yaml b/tasks/main.yaml index f352293..9204635 100644 --- a/tasks/main.yaml +++ b/tasks/main.yaml @@ -63,6 +63,7 @@ username: "admin@bec_atlas.ch" password: "{{ bec_atlas_token }}" return_content: yes + status_code: 200 register: atlas_auth_response when: bec_atlas_token is defined ignore_errors: true @@ -78,8 +79,11 @@ body: deployment_name: "{{ deployment_name }}.psi.ch" return_content: yes + status_code: 200 register: atlas_credentials - when: bec_atlas_token is defined and atlas_auth_response is succeeded + when: + - bec_atlas_token is defined + - atlas_auth_response is succeeded ignore_errors: true no_log: true From 80dfb853203c43e7d6312575b2fb086fc4f2e12e Mon Sep 17 00:00:00 2001 From: wakonig_k Date: Wed, 10 Sep 2025 14:36:22 +0200 Subject: [PATCH 5/7] fix: env vars for bec atlas credentials --- tasks/main.yaml | 6 ++---- vars/main.yaml | 1 + 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/tasks/main.yaml b/tasks/main.yaml index 9204635..ba93de6 100644 --- a/tasks/main.yaml +++ b/tasks/main.yaml @@ -77,7 +77,7 @@ Authorization: "Bearer {{ atlas_auth_response.content | trim | regex_replace('^\"(.*)\"$', '\\1') }}" body_format: form-urlencoded body: - deployment_name: "{{ deployment_name }}.psi.ch" + deployment_name: "{{ inventory_hostname }}" return_content: yes status_code: 200 register: atlas_credentials @@ -91,10 +91,8 @@ ansible.builtin.copy: content: "{{ atlas_credentials.content }}" dest: "/etc/bec/secrets/.atlas.env" - owner: "{{ service_user }}" - group: "{{ service_user }}" mode: "0600" - become: true + become: "{{ service_user }}" when: bec_atlas_token is defined and atlas_credentials is succeeded ignore_errors: true diff --git a/vars/main.yaml b/vars/main.yaml index 9aa320f..e60fc52 100644 --- a/vars/main.yaml +++ b/vars/main.yaml @@ -3,3 +3,4 @@ deployment_path: "{{ deployment_path_prefix }}/{{ deployment_name }}_deployments timestamped_deployment_path: "{{ deployment_path }}/{{ ansible_date_time['iso8601_basic_short'] }}" bec_venv_path: "{{ timestamped_deployment_path }}/bec_venv" user_git_branch_name: "{{ git_username }}_{{ deployment_name }}_{{ ansible_date_time['iso8601_basic_short'] }}" +bec_atlas_token: "{{ lookup('env', 'BEC_ATLAS_TOKEN') }}" From 7e05eb4bee342864cb7093f2d9b62037833cc6b2 Mon Sep 17 00:00:00 2001 From: wakonig_k Date: Wed, 10 Sep 2025 14:46:11 +0200 Subject: [PATCH 6/7] refactor: change from inventory name to fqdn --- tasks/main.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/main.yaml b/tasks/main.yaml index ba93de6..8472514 100644 --- a/tasks/main.yaml +++ b/tasks/main.yaml @@ -77,7 +77,7 @@ Authorization: "Bearer {{ atlas_auth_response.content | trim | regex_replace('^\"(.*)\"$', '\\1') }}" body_format: form-urlencoded body: - deployment_name: "{{ inventory_hostname }}" + deployment_name: "{{ ansible_fqdn }}" return_content: yes status_code: 200 register: atlas_credentials From ecda3e0725e2dcb9b20b670faa13580f1a7252d0 Mon Sep 17 00:00:00 2001 From: wakonig_k Date: Wed, 10 Sep 2025 14:48:08 +0200 Subject: [PATCH 7/7] fix: typo --- tasks/main.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/main.yaml b/tasks/main.yaml index 8472514..0cd8172 100644 --- a/tasks/main.yaml +++ b/tasks/main.yaml @@ -92,7 +92,7 @@ content: "{{ atlas_credentials.content }}" dest: "/etc/bec/secrets/.atlas.env" mode: "0600" - become: "{{ service_user }}" + become_user: "{{ service_user }}" when: bec_atlas_token is defined and atlas_credentials is succeeded ignore_errors: true