Added vault password config

rundeck-plugins · Jun 26, 2024 · 2e25020 · 2e25020
1 parent d629f2f
commit 2e25020
Show file tree

Hide file tree

Showing 2 changed files with 60 additions and 10 deletions.
diff --git a/src/main/groovy/com/rundeck/plugins/ansible/ansible/AnsibleInventoryList.java b/src/main/groovy/com/rundeck/plugins/ansible/ansible/AnsibleInventoryList.java
@@ -1,10 +1,14 @@
 package com.rundeck.plugins.ansible.ansible;
 
+import com.rundeck.plugins.ansible.util.AnsibleUtil;
 import com.rundeck.plugins.ansible.util.ProcessExecutor;
+import com.rundeck.plugins.ansible.util.VaultPrompt;
 import lombok.Builder;
 import lombok.Data;
 
 import java.io.BufferedReader;
+import java.io.File;
+import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.util.ArrayList;
@@ -20,13 +24,19 @@ public class AnsibleInventoryList {
     private String configFile;
     private boolean debug;
 
+    private AnsibleVault ansibleVault;
+    private VaultPrompt vaultPrompt;
+    private File tempInternalVaultFile;
+    private File tempVaultFile;
+    private File vaultPromptFile;
+
     public static final String ANSIBLE_INVENTORY = "ansible-inventory";
 
     /**
      * Executes Ansible command to bring all nodes from inventory
      * @return output in yaml format
      */
-    public String getNodeList() {
+    public String getNodeList() throws Exception {
 
         List<String> procArgs = new ArrayList<>();
         procArgs.add(ANSIBLE_INVENTORY);
@@ -41,6 +51,10 @@ public String getNodeList() {
             }
             processEnvironment.put("ANSIBLE_CONFIG", configFile);
         }
+        //set STDIN variables
+        List<VaultPrompt> stdinVariables = new ArrayList<>();
+
+        processAnsibleVault(stdinVariables, procArgs);
 
         if(debug){
             System.out.println("getNodeList " + procArgs);
@@ -52,6 +66,7 @@ public String getNodeList() {
             proc = ProcessExecutor.builder().procArgs(procArgs)
                     .redirectErrorStream(true)
                     .environmentVariables(processEnvironment)
+                    .stdinVariables(stdinVariables)
                     .build().run();
 
             StringBuilder stringBuilder = new StringBuilder();
@@ -81,4 +96,23 @@ public String getNodeList() {
             }
         }
     }
+
+    private void processAnsibleVault(List<VaultPrompt> stdinVariables, List<String> procArgs)
+            throws IOException {
+
+        if(ansibleVault == null){
+            tempInternalVaultFile = AnsibleVault.createVaultScriptAuth("ansible-script-vault");
+            ansibleVault = AnsibleVault.builder()
+                    .masterPassword(vaultPrompt.getVaultPassword())
+                    .vaultPasswordScriptFile(tempInternalVaultFile)
+                    .debug(debug).build();
+        }
+
+        if (vaultPrompt != null) {
+            stdinVariables.add(vaultPrompt);
+            tempVaultFile = ansibleVault.getVaultPasswordScriptFile();
+            procArgs.add("--vault-id");
+            procArgs.add(tempVaultFile.getAbsolutePath());
+        }
+    }
 }
diff --git a/src/main/groovy/com/rundeck/plugins/ansible/plugin/AnsibleResourceModelSource.java b/src/main/groovy/com/rundeck/plugins/ansible/plugin/AnsibleResourceModelSource.java
@@ -23,6 +23,7 @@
 import com.rundeck.plugins.ansible.ansible.AnsibleInventoryList;
 import com.rundeck.plugins.ansible.ansible.AnsibleRunner;
 import com.rundeck.plugins.ansible.ansible.InventoryList;
+import com.rundeck.plugins.ansible.util.VaultPrompt;
 import org.rundeck.app.spi.Services;
 import org.rundeck.storage.api.PathUtil;
 import org.rundeck.storage.api.StorageException;
@@ -373,18 +374,19 @@ public AnsibleRunner.AnsibleRunnerBuilder buildAnsibleRunner() throws ResourceMo
   @Override
   public INodeSet getNodes() throws ResourceModelSourceException {
     NodeSetImpl nodes = new NodeSetImpl();
+    AnsibleRunner.AnsibleRunnerBuilder runnerBuilder = buildAnsibleRunner();
 
     if (gatherFacts) {
-      processWithGatherFacts(nodes);
+      processWithGatherFacts(nodes, runnerBuilder);
     } else {
-      ansibleInventoryList(nodes);
+      ansibleInventoryList(nodes, runnerBuilder);
     }
 
     return nodes;
   }
 
-  public void processWithGatherFacts(NodeSetImpl nodes) throws ResourceModelSourceException {
-    AnsibleRunner.AnsibleRunnerBuilder runnerBuilder = buildAnsibleRunner();
+  public void processWithGatherFacts(NodeSetImpl nodes, AnsibleRunner.AnsibleRunnerBuilder runnerBuilder) throws ResourceModelSourceException {
+
     final Gson gson = new Gson();
     Path tempDirectory;
     try {
@@ -665,10 +667,10 @@ public FileVisitResult postVisitDirectory(Path dir, IOException exc) throws IOEx
    * @param nodes Rundeck nodes
    * @throws ResourceModelSourceException
    */
-  public void ansibleInventoryList(NodeSetImpl nodes) throws ResourceModelSourceException {
+  public void ansibleInventoryList(NodeSetImpl nodes, AnsibleRunner.AnsibleRunnerBuilder runnerBuilder) throws ResourceModelSourceException {
     Yaml yaml = new Yaml(new SafeConstructor(new LoaderOptions()));
 
-    String listResp = getNodesFromInventory();
+    String listResp = getNodesFromInventory(runnerBuilder);
 
     Map<String, Object> allInventory = yaml.load(listResp);
     Map<String, Object> all = InventoryList.getValue(allInventory, ALL);
@@ -702,18 +704,32 @@ public void ansibleInventoryList(NodeSetImpl nodes) throws ResourceModelSourceEx
    * Gets Ansible nodes from inventory
    * @return Ansible nodes
    */
-  public String getNodesFromInventory() {
+  public String getNodesFromInventory(AnsibleRunner.AnsibleRunnerBuilder runnerBuilder) throws ResourceModelSourceException {
+
+    AnsibleRunner runner = runnerBuilder.build();
 
     if (this.ansibleInventoryListBuilder == null) {
       this.ansibleInventoryListBuilder = AnsibleInventoryList.builder()
               .inventory(inventory)
               .configFile(configFile)
               .debug(debug);
     }
+
+    if(runner.getVaultPass() != null){
+      VaultPrompt vaultPrompt = VaultPrompt.builder()
+              .vaultId("None")
+              .vaultPassword(runner.getVaultPass() + "\n")
+              .build();
+      ansibleInventoryListBuilder.vaultPrompt(vaultPrompt);
+    }
+
     AnsibleInventoryList inventoryList = this.ansibleInventoryListBuilder.build();
-    //inventoryList.processVault();
 
-    return inventoryList.getNodeList();
+    try {
+        return inventoryList.getNodeList();
+    } catch (Exception e) {
+      throw new ResourceModelSourceException(e.getMessage(),e);
+    }
   }
 
   private String getStorageContentString(String storagePath, StorageTree storageTree) throws ConfigurationException {