maas: Reusable tasks to communicate with MaaS API

Since MaaS API calls require a different nonce for each call,
we have to get it a lot.  These tasks will get called before
any POST.

Signed-off-by: David Galloway <david.galloway@ibm.com>

diff --git a/roles/maas/tasks/_auth_header.yml b/roles/maas/tasks/_auth_header.yml
new file mode 100644 (file)
index 0000000..6b556d2
--- /dev/null
+++ b/roles/maas/tasks/_auth_header.yml
@@ -0,0 +1,18 @@
+---
+# Build a FRESH OAuth header using the pre-encoded pieces from api_auth_pretasks.yml.
+# Requires: maas_ck_enc, maas_tk_enc, maas_sig_enc
+
+- name: Build OAuth header (fresh nonce/timestamp)
+  vars:
+    _nonce: "{{ lookup('community.general.random_string', length=24, upper=false, special=false) }}"
+    _ts: "{{ lookup('pipe', 'date +%s') }}"
+  set_fact:
+    maas_auth_header: >-
+      OAuth oauth_version="1.0",
+      oauth_signature_method="PLAINTEXT",
+      oauth_consumer_key="{{ maas_ck_enc }}",
+      oauth_token="{{ maas_tk_enc }}",
+      oauth_signature="{{ maas_sig_enc }}",
+      oauth_nonce="{{ _nonce | urlencode }}",
+      oauth_timestamp="{{ _ts }}"
+  no_log: true

diff --git a/roles/maas/tasks/api_auth_pretasks.yml b/roles/maas/tasks/api_auth_pretasks.yml
new file mode 100644 (file)
index 0000000..1f130f2
--- /dev/null
+++ b/roles/maas/tasks/api_auth_pretasks.yml
@@ -0,0 +1,27 @@
+---
+# Parse the MAAS API key ONCE and pre-encode the static OAuth pieces.
+# The key can come from either MAAS_{POK|TUC}_API_KEY in your env (via group_vars/maas.yml)
+# or the "Get API key" task in roles/maas/tasks/main.yml
+
+- name: Bail if no MAAS key
+  assert:
+    that:
+      - maas_api_key is defined
+      - (maas_api_key | length) > 0
+    fail_msg: "maas_api_key not available."
+
+# Split key: <consumer_key>:<token_key>:<token_secret>
+- name: Parse MAAS API key once
+  set_fact:
+    maas_ck_raw: "{{ (maas_api_key.split(':'))[0] }}"
+    maas_tk_raw: "{{ (maas_api_key.split(':'))[1] }}"
+    maas_ts_raw: "{{ (maas_api_key.split(':'))[2] }}"
+  no_log: true
+
+# Pre-encode static values used in every header
+- name: Pre-encode OAuth static pieces
+  set_fact:
+    maas_ck_enc: "{{ maas_ck_raw | urlencode }}"
+    maas_tk_enc: "{{ maas_tk_raw | urlencode }}"
+    maas_sig_enc: "{{ ('&' ~ maas_ts_raw) | urlencode }}"
+  no_log: true

diff --git a/roles/maas/tasks/main.yml b/roles/maas/tasks/main.yml
index 567ec0b5e5eb1bdb4fe89e45e1f928fa270b832a..23f09f5d8dbcf21f01d490818d04e42838cbf3d9 100644 (file)
--- a/roles/maas/tasks/main.yml
+++ b/roles/maas/tasks/main.yml
@@ -76,6 +76,11 @@
 # Configure MAAS
 - import_tasks: config_maas.yml
 
+- import_tasks: api_auth_pretasks.yml
+  tags:
+    - always
+    - api
+
 # Configure NTP Service
 - import_tasks: config_ntp.yml