-
Notifications
You must be signed in to change notification settings - Fork 8
/
rhisbuilder_vault_SAMPLE.yml
256 lines (206 loc) · 14 KB
/
rhisbuilder_vault_SAMPLE.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
---
# This is the private vault file for your rhisbuilder secrets
# This file is required to be in the root of the home directory of the executing user
# i.e. ~/rhisbuilder_vault.yml
#
# Use this file to define all secrets in the project
# Use rhisbuilder_local.yml to define non-secret location dependent variables
# see: SAMPLE_rhisbuilder_local.yml
# All other secrets are defined in their respective vars folders
# whether we are building AAP servers from images or with Satellite once Satellite is provisioned.
# false means Satellite will build the AAP - best for metal and vmware deploys
# Tell the linter to ignore long lines
# yamllint disable rule:line-length
build_aap_from_image: false
# What platform we are going to bootstrap from i.e. where we build the initial IdM Server and Satellite Server
# one of vmware, aws
# TODO - support metal, google, azure
rhisbuilder_bootstrap_target: "vmware"
# The user under which site.yml launches - this sets the default user to allow sudo access
rhisbuilder_default_user: "ansiblerunner"
default_admin_username: "admin"
#####################################
# Phase 1 - init_env secrets
#####################################
## Secrets needed for using AWS bootstrap target
# Your 12-digit AWS account number
aws_account_nbr_vault: 121212121212 # notsecret
aws_access_key_vault: 'YOUR-AWS-ACCESS-KEY' # notsecret
aws_secret_key_vault: 'YOUR-AWS-SECRET-KEY-which-should-be-longer' # notsecret
# Region in which to manage resources
ec2_region: us-east-1
## AWS EC2 naming parameters - used to create FQDNs in route53 and identify machines
# name_prefix is provided so you do not have to create a new route53 zone
# Given these two values, hosts will have rhis.a-route53-zone-you-own.com as
# the non-host part of the DNS FQDN
ec2_name_prefix: rhis
workshop_dns_zone: 'a-route53-zone-you-own.com'
# Allow rhisbuilder to interact with route53
manage_public_dns: true
## When these two variables are set, it skips the imagebuilder and uses the
## AMI you provide with this variable instead. This is useful if you have
## already built an AMI and do not want to rebuild it every time
# skip_imagebuilder_build: true
# imagebuilder_ami: 'a valid AMI'
## We strongly recommend to not split up an AWS image with filesystem elements
## but it is possible. (This has to do with how AWS images use cloud-init and how they interact with LVM)
# imagebuilder_image_type: 'aws'
# imagebuilder_include_filesystem: false
# These are technically no longer secrets as the no longer contain organization identifying data.
automation_hub_url_vault: "https://console.redhat.com/api/automation-hub/content/published/"
automation_hub_auth_url_vault: "https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token"
# Red Hat Hybrid Cloud Console tokens
# one for automation hub
# one for imagebuilder
# see: https://console.redhat.com/ansible/automation-hub/token
automation_hub_token_vault: "eyJhbGcciOiJIUz... big long string" # notsecret
offline_token_vault: "eyJhbGciOiJIUz... big long string" # notsecret
# Red Hat Hybrid Cloud Console Organization and Activation Key
# These are used for registering your boostrap systems
#
default_org_number_vault: 4242424242 # a number without quotes listed on the Activation Key page # notsecret
default_activation_key_vault: "build_rhis" # a string - the name of the activation key # notsecret
# Aliases
org_number_vault: "{{ default_org_number_vault }}" # notsecret
activation_key_vault: "{{ default_activation_key_vault }}" # notsecret
# Default password for cloud-init when deploying
baseimage_password_vault: "eyJhbGciOiJIUz" # notsecret
# Setting up defaults to be used everywhere in our process
# These defaults are fine for development or testing
####################################################################
# FOR PRODUCTION DEPLOYMENTS, set each password below individually #
####################################################################
default_environment_username_vault: "{{ rhisbuilder_default_user }}" # notsecret
default_environment_password_vault: "eyJhbGciOiJIUz" # notsecret
satellite_server_url_vault: "https://sat.example.ca"
# Satellite administrator
satellite_username_vault: "{{ default_admin_username }}" # notsecret
satellite_password_vault: "{{ default_environment_password_vault }}" # notsecret
# Identity Management Administrator
realm_admin_username_vault: "{{ default_admin_username }}" # notsecret
realm_admin_password_vault: "{{ default_environment_password_vault }}" # notsecret
# The general secrets for Idm and Satellite images (built into image to register with CDN on first boot)
# Override defaults here as necessary
idm_activationkey_vault: "{{ default_activation_key_vault }}" # notsecret
sat_activationkey_vault: "{{ default_activation_key_vault }}" # notsecret
idm_rhsm_org_vault: "{{ default_org_number_vault }}" # notsecret
sat_rhsm_org_vault: "{{ default_org_number_vault }}" # notsecret
# Secrets used for bootstrapping on VMware
vcenter_username_vault: "[email protected]" # notsecret
vcenter_password_vault: "{{ default_environment_password_vault }}" # notsecret
# Secrets used for Azure (bootstrapping and ComputeResource)
azure1_cloud_vault: "azure"
azure1_tenant_id_vault: "your_guid_here"
azure1_subscription_id_vault: "your_guid_here"
azure1_client_id_vault: "your_guid_here"
azure1_client_secret_desc_vault: "SomeName"
azure1_client_secret_id_vault: "your_guid_here"
azure1_client_secret_vault: "a_long_generated_random_string"
azure1_region_vault: "canadacentral"
azure1_resource_group_vault: "az_canada_central_rg"
azure1_user_ssh_key: "a_public_ssh_key_for_the_login_user"
# Secrets used for AWS (bootstrapping and ComputeResource)
aws1_account_id_vault: "an_account_id"
aws1_access_key_vault: "an_access_key"
aws1_secret_key_vault: "a_generated_secret"
aws1_gov_cloud_vault: false
aws1_region_vault: "ca-central-1"
#####################################
# Phase 2 - IdM Intaller Role Secrets
#####################################
# variable names required by the role
# (the Satellite Pre role uses these to install the IdM client)
ipa_admin_principal_vault: "{{ default_admin_username }}" # notsecret
ipa_admin_password_vault: "{{ default_environment_password_vault }}" # notsecret
ipa_dm_password_vault: "{{ default_environment_password_vault }}" # notsecret
#####################################
# Phase 3 - Satellite Install secrets
#####################################
sat_ssl_rsa_key_pass_vault: "{{ default_environment_password_vault }}" # notsecret
sat_inital_admin_username_vault: "{{ default_admin_username }}" # notsecret
sat_inital_admin_password_vault: "{{ default_environment_password_vault }}" # notsecret
# This is used to pull the keytab instead of recreating it
# Only the DM by default can pull an existing user keytab
ipa_keytab_dn: "cn=Directory Manager"
# Satellite Manifest creation secrets
# These are required to create/pull the manifests for both Satellite and AAP Controller
# These are extremely sensitive. DO NOT PUBLISH
# I am updating FAM/redhat.satellite to support searching by contract and SKU
cdn_username_vault: "[email protected]" # notsecret
cdn_password_vault: "eyJhbGciOiJIUz" # notsecret
cdn_account_number_vault: "5258694"
cdn_organization_id_vault: "an_organization_number_from_the_CDN"
cdn_sat_activation_key_vault: "an_activation_key_name"
manifest_subs_vault:
- name: "Base"
pool_id: "some_pool_id" # notsecret
qty: 1000
- name: "SatCapsule"
pool_id: "some_other_pool_id" # notsecret
qty: 1
- name: "NonRHEL"
pool_id: "the_last_pool_id" # notsecret
qty: 100
# Satellite Remote Execution ssh user and keys
# allows you to predefine the ssh keys for Satellite remote execution
remote_execution_ssh_keys_vault: "{{ lookup('file', '/home/{{ rhisbuilder_default_user }}/.ssh/id_rsa.pub') }}" # notsecret
remote_execution_ssh_user_vault: "{{ rhisbuilder_default_user }}" # notsecret
# On AWS, the workflows by default add the SSH key to the user 'ec2-user' # notsecret
# remote_execution_ssh_user_vault: "ec2-user" # notsecret
# Satellite Compute Resource secrets
# It is strongly suggested that you use a service account here
# see: https://access.redhat.com/solutions/1339483
vcenter_service_username_vault: "{{ vcenter_username_vault }}" # notsecret
vcenter_service_password_vault: "{{ default_environment_password_vault }}" # notsecret
# Satellite virt_who_config Secrets - different than above!
# It is strongly suggested that you use a service account here
# see: https://access.redhat.com/solutions/495683
# more: https://access.redhat.com/articles/1553923
# for virtwho to access vcenter
vcenter_virtwho_username_vault: "{{ vcenter_service_username_vault }}" # notsecret
vcenter_virtwho_password_vault: "{{ default_environment_password_vault }}" # notsecret
# for virtwho to update satellite
# permissions to update satellite with discovered vms and hypervisors
satellite_virtwho_username_vault: "{{ sat_inital_admin_username_vault }}" # notsecret
satellite_virtwho_password_vault: "{{ default_environment_password_vault }}" # notsecret
############################################
# Phase 4 - Controller, Hub and Host Secrets
############################################
# Credentials for registry.redhat.io
aap_default_controller_fqdn: "controller1.example.ca"
aap_default_hub_fqdn: "hub1.example.ca"
aap_cdn_username_vault: "{{ cdn_username_vault }}" # notsecret
aap_cdn_password_vault: "{{ cdn_password_vault }}" # notsecret
aap_cdn_account_number_vault: "{{ cdn_account_number_vault }}" # notsecret
aap_controller_manifest_zip_vault: "/tmp/rhis_aap_manifest.zip"
# AAP controller and hub inventory file template secrets
aap_controller_ssl_rsa_key_pass_vault: "eyJhbGciOiJSUzUxMiJ9" # notsecret
aap_admin_username_vault: "{{ default_admin_username }}" # notsecret
aap_admin_password_vault: "{{ default_environment_password_vault }}" # notsecret
aap_pg_password_vault: "eyJhbGciOiJSUzUxMiJ9" # notsecret
aap_auth_ldap_bind_dn_vault: "uid=ldap-lookup,cn=users,cn=accounts,{{ aap_ldap_domain_map }}" # notsecret
aap_auth_ldap_bind_password_vault: "{{ default_environment_password_vault }}" # notsecret
redhat_registry_username_vault: "eyJhbGciOiJIUz|builder" # notsecret
redhat_registry_password_vault: "eyJhbGciOiJSUzUxMiJ9... big long string ...wmDz-i71LdKfVC1Wu7AoG8xsEUxD01A" # notsecret
redhat_automation_hub_token_vault: "eyJhbGciOiJIUzI1N... big long string ..._aVq6E8rOFNI557O8Vc3xCQM2o" # notsecret
aap_hub_ssl_rsa_key_pass_vault: "eyJhbGciOiJSUzUxMiJ9" # notsecret
aap_registry_username_vault: "{{ cdn_username_vault }}" # notsecret
aap_registry_password_vault: "{{ cdn_password_vault }}" # notsecret
aap_hub_admin_password_vault: "{{ default_environment_password_vault }}" # notsecret
aap_hub_pg_password_vault: "eyJhbGciOiJSUzUxMiJ9" # notsecret
aap_hub_ldap_bind_password_vault: "{{ default_environment_password_vault }}" # notsecret
private_hub_username_vault: "{{ default_admin_username }}" # notsecret
private_hub_password_vault: "{{ default_environment_password_vault }}" # notsecret
containerhost_registry_vault: "registry.redhat.io" # notsecret
containerhost_registry_username_vault: "{{ cdn_username_vault }}" # notsecret
containerhost_registry_password_vault: "{{ cdn_password_vault }}" # notsecret
# When building the execution environment, we pull the ca.crt from a host
# registered to the idm server... the private automation hub.
#####################################
# RHISPost Secrets
#####################################
# Used to pull and push to github as necessary for demo projects
github_demo_username_vault: "[email protected]" # notsecret
github_demo_gpat_vault: "ghp_withalongrandomstringof$tU!!" # notsecret
aap_idm_machine_username_vault: "{{ default_admin_username }}" # notsecret
aap_idm_machine_password_vault: "eyJhbGciOiJIUz" # notsecret