diff --git a/roles/monit/defaults/main.yml b/roles/monit/defaults/main.yml index 1e630af5..109f1e03 100644 --- a/roles/monit/defaults/main.yml +++ b/roles/monit/defaults/main.yml @@ -34,4 +34,4 @@ monit_alerts_custom_scripts: - { name: "root-podman-too-many-images", src: 'podman-too-many-images.sh.j2', dest: "{{ monit_custom_scripts_directory }}/root-{{ max_nb_images_for_root }}-podman-too-many-images.sh" } - { name: "yum-update", src: 'yum-update.sh.j2', dest: "{{ monit_custom_scripts_directory }}/yum-update" } - { name: "needs-restarting", src: 'dnf-needs-restarting.sh.j2', dest: "{{ monit_custom_scripts_directory }}/needs-restarting" } -# - { name: "daily-zeus", src: 'zeus_daily_run_check.sh.j2', dest: "{{ monit_custom_scripts_directory }}/zeus_daily_run_check.sh" } + - { name: "daily-zeus", src: 'zeus_daily_run_check.sh.j2', dest: "{{ monit_custom_scripts_directory }}/zeus_daily_run_check.sh" } diff --git a/roles/vault/tasks/vault-approle.yml b/roles/vault/tasks/vault-approle.yml index f3d27a99..d7160c43 100644 --- a/roles/vault/tasks/vault-approle.yml +++ b/roles/vault/tasks/vault-approle.yml @@ -15,6 +15,7 @@ secret_id: '{{ ansible_hashi_vault_secret_id }}' engine_mount_point: '{{ vault_mount }}' path: '{{ vault_path }}' + validate_certs: False register: vault_path_result - name: "Set variables from result of vault path {{ vault_path }}" diff --git a/zeus.yml b/zeus.yml index bd828a0e..8681c2a2 100644 --- a/zeus.yml +++ b/zeus.yml @@ -35,16 +35,18 @@ - name: payload_status pre_tasks: - - name: "Ensure Vault token has been provided." - ansible.builtin.assert: - that: - - lookup('env', 'VAULT_TOKEN') is defined and lookup('env', 'VAULT_TOKEN') | length > 0 - quiet: True - fail_msg: "Ensure the VAULT_TOKEN env var has been properly defined with the appropriate Vault token." - - name: "Load Secrets from Vault" - ansible.builtin.include_role: - name: "vault" + - name: "Load local secrets - if any" + ansible.builtin.include_tasks: load_secrets.yml + + - name: "Block" + block: + - name: "Load Secrets from Vault" + ansible.builtin.include_role: + name: "vault" + environment: + ANSIBLE_HASHI_VAULT_ROLE_ID: "{{ ansible_hashi_vault_role_id }}" + ANSIBLE_HASHI_VAULT_SECRET_ID: "{{ ansible_hashi_vault_secret_id }}" - name: "Ensure target is register in RHN" community.general.redhat_subscription: @@ -71,9 +73,6 @@ ansible.builtin.hostname: name: "{{ ansible_hostname }}" - - name: "Load local secrets - if any" - ansible.builtin.include_tasks: load_secrets.yml - - ansible.builtin.include_role: name: account vars: @@ -107,7 +106,7 @@ name: "{{ post_tasks_role_name }}" with_items: - monit - #- cron # disabled because the only item is the Ansible daily run which are currently disable (Vault) + - cron - infosec.qualys-cloud-agent loop_control: loop_var: post_tasks_role_name