zeus: use local secrets to store vault creds

roles/monit/defaults/main.yml

@@ -34,4 +34,4 @@ monit_alerts_custom_scripts:
   - { name: "root-podman-too-many-images", src: 'podman-too-many-images.sh.j2', dest: "{{ monit_custom_scripts_directory }}/root-{{ max_nb_images_for_root }}-podman-too-many-images.sh" }
   - { name: "yum-update", src: 'yum-update.sh.j2', dest: "{{ monit_custom_scripts_directory }}/yum-update" }
   - { name: "needs-restarting", src: 'dnf-needs-restarting.sh.j2', dest: "{{ monit_custom_scripts_directory }}/needs-restarting" }
-#  - { name: "daily-zeus", src: 'zeus_daily_run_check.sh.j2', dest: "{{ monit_custom_scripts_directory }}/zeus_daily_run_check.sh" }
+  - { name: "daily-zeus", src: 'zeus_daily_run_check.sh.j2', dest: "{{ monit_custom_scripts_directory }}/zeus_daily_run_check.sh" }

roles/vault/tasks/vault-approle.yml

@@ -15,6 +15,7 @@
     secret_id: '{{ ansible_hashi_vault_secret_id }}'
     engine_mount_point: '{{ vault_mount }}'
     path: '{{ vault_path }}'
+    validate_certs: False
   register: vault_path_result
 
 - name: "Set variables from result of vault path {{ vault_path }}"

zeus.yml

@@ -35,16 +35,18 @@
       - name: payload_status
 
   pre_tasks:
-    - name: "Ensure Vault token has been provided."
-      ansible.builtin.assert:
-        that:
-          - lookup('env', 'VAULT_TOKEN') is defined and lookup('env', 'VAULT_TOKEN') | length > 0
-        quiet: True
-        fail_msg: "Ensure the VAULT_TOKEN env var has been properly defined with the appropriate Vault token."
 
-    - name: "Load Secrets from Vault"
-      ansible.builtin.include_role:
-        name: "vault"
+    - name: "Load local secrets - if any"
+      ansible.builtin.include_tasks: load_secrets.yml
+
+    - name: "Block"
+      block:
+        - name: "Load Secrets from Vault"
+          ansible.builtin.include_role:
+            name: "vault"
+      environment:
+        ANSIBLE_HASHI_VAULT_ROLE_ID: "{{ ansible_hashi_vault_role_id }}"
+        ANSIBLE_HASHI_VAULT_SECRET_ID: "{{ ansible_hashi_vault_secret_id }}"
 
     - name: "Ensure target is register in RHN"
       community.general.redhat_subscription:
@@ -71,9 +73,6 @@
       ansible.builtin.hostname:
         name: "{{ ansible_hostname }}"
 
-    - name: "Load local secrets - if any"
-      ansible.builtin.include_tasks: load_secrets.yml
-
     - ansible.builtin.include_role:
         name: account
       vars:
@@ -107,7 +106,7 @@
         name: "{{ post_tasks_role_name }}"
       with_items:
         - monit
-        #- cron # disabled because the only item is the Ansible daily run which are currently disable (Vault)
+        - cron
         - infosec.qualys-cloud-agent
       loop_control:
         loop_var: post_tasks_role_name