community.general.consul_acl_bootstrap module – Bootstrap ACLs in Consul

Note

This module is part of the community.general collection (version 14.0.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.general.

To use it in a playbook, specify: community.general.consul_acl_bootstrap.

New in community.general 8.3.0

Synopsis

Parameters

Parameter

Comments

bootstrap_secret

string

The secret to be used as secret ID for the initial token.

Needs to be an UUID.

ca_path

string

The CA bundle to use for https connections.

If unset, the value of the CONSUL_CACERT environment variable is used when set. This is supported since community.general 13.4.0.

host

string

Host of the Consul agent.

If unset, the host component of url is used, and localhost when url is not set either.

port

integer

The port on which the consul agent is running.

If unset, the port component of url is used, and 8500 when that does not specify one either.

scheme

string

The protocol scheme on which the Consul agent is running.

If unset, a true value in the CONSUL_HTTP_SSL environment variable selects https, otherwise the scheme component of url is used, and http when that does not specify one either. A false CONSUL_HTTP_SSL does not downgrade an https url.

state

string

Whether the token should be present or absent.

Choices:

  • "present" ← (default)

  • "bootstrapped"

url

string

added in community.general 13.4.0

The address of the Consul agent, in the host:port or scheme://host:port form. The scheme and the port are optional, the host is not.

host, port and scheme take precedence over the components of this option.

If unset, the value of the CONSUL_HTTP_ADDR environment variable is used when set. An address these modules cannot use, a unix:// socket for example, makes the module fail, unless host, port and scheme are all set, in which case the address is not consulted at all.

validate_certs

boolean

Whether to verify the TLS certificate of the Consul agent.

If unset, the value of the CONSUL_HTTP_SSL_VERIFY environment variable is used when set. This is supported since community.general 13.4.0.

Choices:

  • false

  • true ← (default)

Attributes

Attribute

Support

Description

check_mode

Support: none

Can run in check_mode and return changed status prediction without modifying target.

diff_mode

Support: none

Returns details on what has changed (or possibly needs changing in check_mode), when in diff mode.

Examples

- name: Bootstrap the ACL system
  community.general.consul_acl_bootstrap:
    bootstrap_secret: 22eaeed1-bdbd-4651-724e-42ae6c43e387

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

result

dictionary

The bootstrap result as returned by the Consul HTTP API.

Note: (ansible-core 2.21 and before) If bootstrap_secret has been specified, the SecretID and ID do not contain the secret but VALUE_SPECIFIED_IN_NO_LOG_PARAMETER. If you pass bootstrap_secret, make sure your playbook/role does not depend on this return value! On ansible-core 2.22+, this is no longer a problem.

Returned: changed

Sample: {"AccessorID": "834a5881-10a9-a45b-f63c-490e28743557", "CreateIndex": 25, "CreateTime": "2024-01-21T20:26:27.114612038+01:00", "Description": "Bootstrap Token (Global Management)", "Hash": "X2AgaFhnQGRhSSF/h0m6qpX1wj/HJWbyXcxkEM/5GrY=", "ID": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", "Local": false, "ModifyIndex": 25, "Policies": [{"ID": "00000000-0000-0000-0000-000000000001", "Name": "global-management"}], "SecretID": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER"}

Authors

  • Florian Apolloner (@apollo13)