zuul-secrets.yml

- name: Encrypt secrets for zuul
  hosts: all
  vars:
    deployment: "{{ lookup('env', 'DEPLOYMENT') }}"
  tasks:
    - name: Download the zuul
      ansible.builtin.git:
        repo: "https://opendev.org/zuul/zuul.git"
        dest: /tmp/zuul
        clone: true
        version: 4.0.0
    - name: Creates zuul secrets directory
      ansible.builtin.file:
        path: ../secrets/zuul
        state: directory
        mode: 0755
    - name: Encrypt secrets to be used inside Zuul CI
      ansible.builtin.command: >
        /tmp/zuul/tools/encrypt_secret.py --insecure --tenant local
        --infile ../secrets/{{ deployment }}/{{ item.file_name }}
        --outfile ../secrets/zuul/{{ item.name }}-secret.yaml
        https://softwarefactory-project.io/zuul/ packit-service/packit-service
      with_items:
        - { file_name: "copr", name: "copr" }
        - { file_name: "fullchain.pem", name: "fullchain" }
        - { file_name: "id_rsa", name: "id_rsa" }
        - { file_name: "id_rsa.pub", name: "id_rsa_pub" }
        - { file_name: "packit-service.yaml", name: "packit_service" }
        - { file_name: "private-key.pem", name: "private_key" }
        - { file_name: "privkey.pem", name: "privkey" }
        - { file_name: "ssh_config", name: "ssh_config" }
      changed_when: true

    - name: Encode fedora keytab using base64 first
      block:
        - name: Base64 encode fedora.keytab
          ansible.builtin.shell: "set -o pipefail; cat ../secrets/{{ deployment }}/fedora.keytab | base64 > /tmp/fedora.keytab.b64"
          changed_when: false
        - name: Encrypt secret
          ansible.builtin.command: >
            /tmp/zuul/tools/encrypt_secret.py --insecure --tenant local
            --infile /tmp/fedora.keytab.b64
            --outfile ../secrets/zuul/fedora_keytab-secret.yaml
            https://softwarefactory-project.io/zuul/ packit-service/packit-service
          changed_when: true

    - name: Fill the <name> in newly generated secrets
      ansible.builtin.replace:
        path: ../secrets/zuul/{{ item }}-secret.yaml
        regexp: "<name>"
        replace: "{{ item }}"
      with_items:
        - cert
        - chain
        - copr
        - fullchain
        - id_rsa
        - id_rsa_pub
        - packit_service
        - private_key
        - privkey
        - ssh_config
        - fedora_keytab

    - name: Fill the <fieldname> in newly generated secrets
      ansible.builtin.replace:
        path: ../secrets/zuul/{{ item }}-secret.yaml
        regexp: "<fieldname>"
        replace: "value"
      with_items:
        - cert
        - chain
        - copr
        - fullchain
        - id_rsa
        - id_rsa_pub
        - packit_service
        - private_key
        - privkey
        - ssh_config
        - fedora_keytab