99711abf23
The enable-fips role has been refactored to support both centos/rhel and Ubuntu. In addition, for the Ubuntu tasks, a small role is added to enable a Ubuntu Advantage subscription. This is required because Ubuntu requires a subscription to enable FIPS. This role takes a subscription key as a parameter (ubuntu_ua_token.token). In Openstack, this is provided by the openstack-fips job in openstack/project-config, which will be the base job for OpenStack jobs. This job will provide the ubuntu_ua_token.token. Change-Id: I47a31f680172b47584510adb672b68498a85bd32
32 lines
584 B
YAML
32 lines
584 B
YAML
- name: Install ua-tools
|
|
become: true
|
|
package:
|
|
name: ubuntu-advantage-tools
|
|
state: present
|
|
|
|
- name: Enable fips
|
|
become: true
|
|
command: ua enable fips
|
|
|
|
- name: Verify fips is enabled
|
|
become: true
|
|
command: ua status
|
|
|
|
- name: Reboot server for FIPS mode
|
|
become: true
|
|
reboot:
|
|
reboot_timeout: 1800
|
|
|
|
- name: Run post-boot tasks
|
|
include_role:
|
|
name: post-reboot-tasks
|
|
|
|
- name: Ensure FIPS mode is enabled
|
|
become: true
|
|
command: cat /proc/sys/crypto/fips_enabled
|
|
register: _result
|
|
|
|
- name: Assert FIPS is enabled
|
|
assert:
|
|
that: _result.stdout == "1"
|