diff --git a/cesnet-central/deployments/fullhub.yaml b/cesnet-central/deployments/fullhub.yaml index 6812913d837f83c18ff42777bf6ba0ffdfe12c8a..1e1daba9b784942473083981b0b428f3786ffe8b 100644 --- a/cesnet-central/deployments/fullhub.yaml +++ b/cesnet-central/deployments/fullhub.yaml @@ -192,15 +192,15 @@ hub: - urn:geant:eosc-federation.eu:group:asg:notebooks.open-science-cloud.ec.europa.eu:role=admin claim_groups_key: "entitlements" EGICheckinAuthenticator: - checkin_host: "{{ secret['checkin_host'] }}" - authorize_url: "https://{{ secret['checkin_host'] }}/OIDC/authorization" - token_url: "https://{{ secret['checkin_host'] }}/OIDC/token" - userdata_url: "https://{{ secret['checkin_host'] }}/OIDC/userinfo" - introspect_url: "https://{{ secret['checkin_host'] }}/OIDC/introspect" - client_id: "{{ secret['client_id'] }}" - client_secret: "{{ secret['client_secret'] }}" + checkin_host: "{{ secrets['checkin_host'] }}" + authorize_url: "https://{{ secrets['checkin_host'] }}/OIDC/authorization" + token_url: "https://{{ secrets['checkin_host'] }}/OIDC/token" + userdata_url: "https://{{ secrets['checkin_host'] }}/OIDC/userinfo" + introspect_url: "https://{{ secrets['checkin_host'] }}/OIDC/introspect" + client_id: "{{ secrets['client_id'] }}" + client_secret: "{{ secrets['client_secret'] }}" oauth_callback_url: "https://{{ notebooks_hostname }}/hub/oauth_callback" - openid_configuration_url: "https://{{ secret['checkin_host'] }}/.well-known/openid-configuration" + openid_configuration_url: "https://{{ secrets['checkin_host'] }}/.well-known/openid-configuration" scope: ["openid", "profile", "email", "offline_access", "entitlements"] username_claim: "sub" extra_authorize_params: diff --git a/common/deployments/hub-production.yaml b/common/deployments/hub-production.yaml index 8a6c8e8c98de31294c5ad4fe825ccc16fe8d743b..e4083690721145336fda83b61272f91899e66aba 100644 --- a/common/deployments/hub-production.yaml +++ b/common/deployments/hub-production.yaml @@ -173,15 +173,15 @@ hub: - urn:geant:open-science-cloud.ec.europa.eu:group:asg:notebooks.open-science-cloud.ec.europa.eu:role=admin claim_groups_key: "entitlements" EGICheckinAuthenticator: - checkin_host: "{{ secret['checkin_host'] }}" - authorize_url: "https://{{ secret['checkin_host'] }}/OIDC/authorization" - token_url: "https://{{ secret['checkin_host'] }}/OIDC/token" - userdata_url: "https://{{ secret['checkin_host'] }}/OIDC/userinfo" - introspect_url: "https://{{ secret['checkin_host'] }}/OIDC/introspect" - client_id: "{{ secret['client_id'] }}" - client_secret: "{{ secret['client_secret'] }}" + checkin_host: "{{ secrets['checkin_host'] }}" + authorize_url: "https://{{ secrets['checkin_host'] }}/OIDC/authorization" + token_url: "https://{{ secrets['checkin_host'] }}/OIDC/token" + userdata_url: "https://{{ secrets['checkin_host'] }}/OIDC/userinfo" + introspect_url: "https://{{ secrets['checkin_host'] }}/OIDC/introspect" + client_id: "{{ secrets['client_id'] }}" + client_secret: "{{ secrets['client_secret'] }}" oauth_callback_url: "https://{{ notebooks_hostname }}/hub/oauth_callback" - openid_configuration_url: "https://{{ secret['checkin_host'] }}/.well-known/openid-configuration" + openid_configuration_url: "https://{{ secrets['checkin_host'] }}/.well-known/openid-configuration" scope: ["openid", "profile", "email", "offline_access", "entitlements"] username_claim: "sub" extra_authorize_params: diff --git a/common/deployments/hub-staging.yaml b/common/deployments/hub-staging.yaml index e8ba7fb9ae1c91c0dba14fabee13f237febed997..27e9dc5dc0f9ae17baad972750cb84acfcbb72a6 100644 --- a/common/deployments/hub-staging.yaml +++ b/common/deployments/hub-staging.yaml @@ -173,15 +173,15 @@ hub: - urn:geant:eosc-federation.eu:group:asg:notebooks.open-science-cloud.ec.europa.eu:role=admin claim_groups_key: "entitlements" EGICheckinAuthenticator: - checkin_host: "{{ secret['checkin_host'] }}" - authorize_url: "https://{{ secret['checkin_host'] }}/OIDC/authorization" - token_url: "https://{{ secret['checkin_host'] }}/OIDC/token" - userdata_url: "https://{{ secret['checkin_host'] }}/OIDC/userinfo" - introspect_url: "https://{{ secret['checkin_host'] }}/OIDC/introspect" - client_id: "{{ secret['client_id'] }}" - client_secret: "{{ secret['client_secret'] }}" + checkin_host: "{{ secrets['checkin_host'] }}" + authorize_url: "https://{{ secrets['checkin_host'] }}/OIDC/authorization" + token_url: "https://{{ secrets['checkin_host'] }}/OIDC/token" + userdata_url: "https://{{ secrets['checkin_host'] }}/OIDC/userinfo" + introspect_url: "https://{{ secrets['checkin_host'] }}/OIDC/introspect" + client_id: "{{ secrets['client_id'] }}" + client_secret: "{{ secrets['client_secret'] }}" oauth_callback_url: "https://{{ notebooks_hostname }}/hub/oauth_callback" - openid_configuration_url: "https://{{ secret['checkin_host'] }}/.well-known/openid-configuration" + openid_configuration_url: "https://{{ secrets['checkin_host'] }}/.well-known/openid-configuration" scope: ["openid", "profile", "email", "offline_access", "entitlements"] username_claim: "sub" extra_authorize_params: diff --git a/common/playbooks/notebooks.yaml b/common/playbooks/notebooks.yaml index 4e78571e01e6da721561c017826766e592f2c666..893f911b102a4c11f27328c86b844b1fdbce234e 100644 --- a/common/playbooks/notebooks.yaml +++ b/common/playbooks/notebooks.yaml @@ -14,18 +14,18 @@ vars: name: "{{ item | basename | splitext | first }}" set_fact: - secrets: "{{ secrets|default({}) | combine({name: lookup('community.hashi_vault.hashi_vault', (vault_mount_point, 'deployment-' + name) | join('/'), - token_validate=false)}) }}" + deployment_secrets: "{{ deployment_secrets|default({}) | combine({name: lookup('community.hashi_vault.hashi_vault', + (vault_mount_point, 'deployment-' + name) | join('/'), token_validate=false)}) }}" with_fileglob: - "../deployments/*.yaml" - name: Debug Deployments Secrets debug: msg: "{{ item.key }} = {{ item.value }}" - loop: "{{ secrets | dict2items }}" + loop: "{{ deployment_secrets | dict2items }}" - name: Copy config file to master vars: name: "{{ item | basename | splitext | first }}" - secret: "{{ secrets[name] }}" + secrets: "{{ deployment_secrets[name] }}" template: src: "{{ item }}" dest: "/tmp/{{ item | basename }}" diff --git a/common/playbooks/security-assets.yaml b/common/playbooks/security-assets.yaml index 8c90747d5cb2b3529fc4c9836a7e6f17c63dbc0b..9c389d28f21d57745c8b4acca2a7869dd5278ad8 100644 --- a/common/playbooks/security-assets.yaml +++ b/common/playbooks/security-assets.yaml @@ -18,11 +18,11 @@ tasks: - name: Get Secrets From Vault set_fact: - secret: "{{ lookup('community.hashi_vault.hashi_vault', (vault_mount_point, 'site-' + site_name) | join('/'), token_validate=false) }}" + secrets: "{{ lookup('community.hashi_vault.hashi_vault', (vault_mount_point, 'site-' + site_name) | join('/'), token_validate=false) }}" - name: Debug Secrets debug: msg: "{{ item.key }} = {{ item.value }}" - loop: "{{ secret | dict2items }}" + loop: "{{ secrets | dict2items }}" - name: Directory for for GLPI agent configuration file: path: /etc/glpi-agent/conf.d diff --git a/common/playbooks/security-scanner.yaml b/common/playbooks/security-scanner.yaml index 623c9b88f6babab6331b16447e13d26db2ad1fcf..05c59a940772c68b8120b86f5b0e95a041b0c617 100644 --- a/common/playbooks/security-scanner.yaml +++ b/common/playbooks/security-scanner.yaml @@ -18,11 +18,11 @@ when: "'deepfence' not in ansible_local.helm_repos | map(attribute='name') | list" - name: Get Secrets From Vault set_fact: - secret: "{{ lookup('community.hashi_vault.hashi_vault', [ vault_mount_point, 'site-' + site_name] | join('/'), token_validate=false) }}" + secrets: "{{ lookup('community.hashi_vault.hashi_vault', [ vault_mount_point, 'site-' + site_name] | join('/'), token_validate=false) }}" - name: Debug Secrets debug: msg: "{{ item.key }} = {{ item.value }}" - loop: "{{ secret | dict2items }}" + loop: "{{ secrets | dict2items }}" - name: Deepfence ThreadManager Agent Configuration template: src: templates/deepfence-agent.yaml.j2 diff --git a/common/playbooks/templates/deepfence-agent.yaml.j2 b/common/playbooks/templates/deepfence-agent.yaml.j2 index bf13c80180b698b1e6024ef147501fc292370d58..ed678a2e32c8c758a1118b5bed89d8ed40a56d9b 100644 --- a/common/playbooks/templates/deepfence-agent.yaml.j2 +++ b/common/playbooks/templates/deepfence-agent.yaml.j2 @@ -1,5 +1,5 @@ -managementConsoleUrl: "{{ secret['deepfence_host'] | default('') }}" -deepfenceKey: "{{ secret['deepfence_key'] | default('') }}" +managementConsoleUrl: "{{ secrets['deepfence_host'] | default('') }}" +deepfenceKey: "{{ secrets['deepfence_key'] | default('') }}" clusterName: "jupyter-{{ site_name }}" mountContainerRuntimeSocket: containerSock: true diff --git a/testing/deployments/hub.yaml b/testing/deployments/hub.yaml index 467a234460f7b4fe24708d9fe0e1d9abbc8c7e7e..17ce5663293caa5ffe3b42de04b9df54101239d5 100644 --- a/testing/deployments/hub.yaml +++ b/testing/deployments/hub.yaml @@ -174,15 +174,15 @@ hub: - urn:geant:eosc-federation.eu:group:asg:notebooks.open-science-cloud.ec.europa.eu:role=admin claim_groups_key: "entitlements" EGICheckinAuthenticator: - checkin_host: "{{ secret['checkin_host'] }}" - authorize_url: "https://{{ secret['checkin_host'] }}/OIDC/authorization" - token_url: "https://{{ secret['checkin_host'] }}/OIDC/token" - userdata_url: "https://{{ secret['checkin_host'] }}/OIDC/userinfo" - introspect_url: "https://{{ secret['checkin_host'] }}/OIDC/introspect" - client_id: "{{ secret['client_id'] }}" - client_secret: "{{ secret['client_secret'] }}" + checkin_host: "{{ secrets['checkin_host'] }}" + authorize_url: "https://{{ secrets['checkin_host'] }}/OIDC/authorization" + token_url: "https://{{ secrets['checkin_host'] }}/OIDC/token" + userdata_url: "https://{{ secrets['checkin_host'] }}/OIDC/userinfo" + introspect_url: "https://{{ secrets['checkin_host'] }}/OIDC/introspect" + client_id: "{{ secrets['client_id'] }}" + client_secret: "{{ secrets['client_secret'] }}" oauth_callback_url: "https://{{ notebooks_hostname }}/hub/oauth_callback" - openid_configuration_url: "https://{{ secret['checkin_host'] }}/.well-known/openid-configuration" + openid_configuration_url: "https://{{ secrets['checkin_host'] }}/.well-known/openid-configuration" scope: ["openid", "profile", "email", "offline_access", "entitlements"] username_claim: "sub" extra_authorize_params: