add existing file encryption check

stackhpc · Nov 19, 2024 · ecac530 · ecac530
1 parent 53027c6
commit ecac530
Showing 1 changed file with 16 additions and 1 deletion.
diff --git a/etc/kayobe/ansible/wazuh-secrets.yml b/etc/kayobe/ansible/wazuh-secrets.yml
@@ -19,6 +19,22 @@
         path: "{{ wazuh_secrets_path }}"
       register: waz_exist_result
 
+    - name: Check if secret is encrypted
+      block:
+        - name: Try to decrypt secret
+          no_log: True
+          copy:
+            content: "{{ lookup('ansible.builtin.file', wazuh_secrets_path) | ansible.builtin.vault(ansible_vault_password) }}"
+            dest: "{{ wazuh_secrets_path }}"
+            decrypt: True
+          vars:
+            ansible_vault_password: "{{ lookup('ansible.builtin.env', 'KAYOBE_VAULT_PASSWORD') }}"
+      rescue:
+        - name: Secrets already decrypted
+          ansible.builtin.debug:
+            msg: 'Secret was already decrypted'
+      when: waz_exist_result.stat.exists
+
     - name: Template new secrets
       no_log: True
       template:
@@ -34,4 +50,3 @@
         decrypt: false
       vars:
         ansible_vault_password: "{{ lookup('ansible.builtin.env', 'KAYOBE_VAULT_PASSWORD') }}"
-      when: not waz_exist_result.stat.exists