ansible escaping certificate content - parsing

Question

I have an issue with ansible. I am attempting to install some software which requires a auto-generated certificate. The certificate is auto-generated each time the install is run.
I run the command to pull the certificate out of a settings file.
bosh alias-env director -e director --ca-cert <(bosh int ./creds.yml --path /director_ssl/ca)
there seems to be escape characters in the certificate and ansible craps out every time.
The certicate output is :
:~$ bosh int ./creds.yml --path /director_ssl/ca
-----BEGIN CERTIFICATE-----
MIIDFDCCAfygAwIBAgIRALV4CbzZnmM/DpVWtV0QpXAwDQYJKoZIhvcNAQELBQAw
MzEMMAoGA1UEBhMDVVNBMRYwFAYDVQQKEw1DbG91ZCBGb3VuZHJ5MQswCQYDVQQD
EwJjYTAeFw0xNzA2MjMxMjI1MzNaFw0xODA2MjMxMjI1MzNaMDMxDDAKBgNVBAYT
A1VTQTEWMBQGA1UEChMNQ2xvdWQgRm91bmRyeTELMAkGA1UEAxMCY2EwggEiMA0G
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB7PNn3J3RayZp32cSWofTsNAj5VjD
h0dl8cpPxEgmrRjGDbKMplP1IqgfudxeJLlNzhNBRmrfqXc9RLvLCp9+foeq/ErC
nKzLKPYsu2bHXsVFqTFDotl7TL9TSd9JGeKKom4RwzlZ5deXlfZIduYwdMAOGfOL
hAqsbO9BewdlNWTFJIRsR+KHPlvxs1kvQohIxzPRv5MjyRm6ylUwuWNs0bEQixIs
C34379sba12FFlN8dO3okZKH26rnIMCzpIOH7IBZsEPLFWl1T3NkWITzFpsg4wiX
ajiK/LI441cFld28g4TgqvfCMFtmmsYcnpNAC7RKGSYkvAkXKSbKkagLAgMBAAGj
IzAhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEB
CwUAA4IBAQCTTJHimCiXniG/UwbQ2ZPS1gMGnjWHvvnroA3sg0Jnv3Se3opxhlro
lbaJqMfR46d3bRyILjtiTD3aDC71aUu8CIeaVlzRIOW0BSWQFZB67y/ZkLe96wg0
8LafcTh2UqYw77Xlt9fwRoZTAwFjnXW/SV0DpKfTmMdCN9M/rtPLiJSsVN8Z1get
/p2YHYAJ6OU3ClKNfVgcmC1IFauQb77ctMsd0sY2t6XMY7HY6RACYNidfHJM14tL
YCtkuvFs8ZP8TpHQY0C5FuNk0nPHcbUiHaD3KAuWRoGkFNvnD54v4IX13zy/iWgU
1TU2nomKujmt5lEB8NZF7jzfW2vlxprA
-----END CERTIFICATE-----
Succeeded
the error I get is:
TASK [set env vars for login to director...] ***********************************
fatal: [51.xxx.xxx.xxx]: FAILED! => {"changed": true, "cmd": "bosh alias-env boshdir -e boshdir --ca-cert <(bosh int ./creds.yml --path /director_ssl/ca)", "delta": "0:00:00.001721", "end": "2017-06-26 09:16:49.854271", "failed": true, "rc": 2, "start": "2017-06-26 09:16:49.852550", "stderr": "/bin/sh: 1: Syntax error: \"(\" unexpected", "stderr_lines": ["/bin/sh: 1: Syntax error: \"(\" unexpected"], "stdout": "", "stdout_lines": []}
I tried switching up ansible shells from shell, Command and RAW. and raw seem to work for the ingestion of the certificate values, but doesn't seem to be able to access the other env variables I set in a previous task. Does anyone know how to escape out the certificate content?
The ansible script I run for this portion of the setup is:
---
- hosts: all
gather_facts: no
tasks:
- name: Update director creds file on deployment server
copy: src="files/bosh-creds.yml" dest="/home/bosher/creds.yml" owner="bosher" group="bosher" mode="0755"
become: yes
- name: Update state file on deployment server
copy: src="files/bosh-state.json" dest="/home/bosher/state.json" owner="bosher" group="bosher" mode="0755"
become: yes
- name: Update bosh concourse Manifest on deployment server
copy: src="files/temp-con-man.yml" dest="/home/bosher/con-man.yml" owner="bosher" group="bosher" mode="0755"
become: yes
- name: Update bosh cloud config on deployment server
copy: src="files/temp-con-cloud-azure.yml" dest="/home/bosher/cloud-config.yml" owner="bosher" group="bosher" mode="0755"
become: yes
- name: Download bosh exe and place in path location
get_url: url="https://s3.amazonaws.com/bosh-cli-artifacts/bosh-cli-2.0.16-linux-amd64" dest="/usr/local/bin/bosh" mode="0755"
become: true
- name: set jumpbox host file for dns of director...
shell: |
sudo chmod 777 /etc/hosts
sudo echo "10.0.0.6 boshdir" >> /etc/hosts
sudo chmod 644 /etc/hosts
- name: set env vars for login to director...
shell: |
export BOSH_CLIENT=admin
export BOSH_CLIENT_SECRET=`bosh int ./creds.yml --path /admin_password`
- name: set env vars for login to director...
shell: bosh alias-env director -e director --ca-cert <(bosh int ./creds.yml --path /director_ssl/ca)
- name: upload stemcells and releases to director...
shell: |
bosh -e director us "https://s3.amazonaws.com/bosh-core-stemcells/azure/bosh-stemcell-3421-azure-hyperv-ubuntu-trusty-go_agent.tgz"
bosh -e director ur "http://bosh.io/d/github.com/concourse/concourse"
bosh -e director ur "https://s3.amazonaws.com/bosh-compiled-release-tarballs/garden-runc-1.6.0-ubuntu-trusty-3363.20-20170505-155950-147762079-20170505155956.tgz?versionId=DNopG3gqI9AbTzMddjmAIvIJetuuh6LY"
echo y | bosh -e director ucc "~/cloud-config.yml"
- name: run the concourse install...
shell: echo y | sudo bosh -e director -d "concourse" deploy "./manifest.yml"
This seems to be kicking me and I can't seem to get it work. Can some one point out what I am doing wrong here?

Answer 1

Your error is that the shell used (/bin/sh) does not handle the '<(cmd)' syntax
$ /bin/sh -c 'cat <(echo foo)'
/bin/sh: 1: Syntax error: "(" unexpected
$ /bin/bash -c 'cat <(echo foo)'
foo
You can use another shell with the executable parameter of shell module.
BUT
Environment are not shared between tasks: each task launch an independent shell through SSH.
You have 2 choices:
launch all bosh preparation and commands in only 1 task
- name: launch all bosh commands
shell: |
export BOSH_CLIENT=admin
export BOSH_CLIENT_SECRET=`bosh int ./creds.yml --path /admin_password`
bosh alias-env director -e director --ca-cert <(bosh int ./creds.yml --path /director_ssl/ca)
bosh -e director us "https://s3.amazonaws.com/bosh-core-stemcells/azure/bosh-stemcell-3421-azure-hyperv-ubuntu-trusty-go_agent.tgz"
bosh -e director ur "http://bosh.io/d/github.com/concourse/concourse"
bosh -e director ur "https://s3.amazonaws.com/bosh-compiled-release-tarballs/garden-runc-1.6.0-ubuntu-trusty-3363.20-20170505-155950-147762079-20170505155956.tgz?versionId=DNopG3gqI9AbTzMddjmAIvIJetuuh6LY"
echo y | bosh -e director ucc "~/cloud-config.yml"
echo y | sudo bosh -e director -d "concourse" deploy "./manifest.yml"
args:
executable: /bin/bash
Use the environment key to set environment on tasks. You also have to register output of commands to use them as envvars later.
- name: Get secret for login to director...
shell: bosh int ./creds.yml --path /admin_password
environment:
BOSH_CLIENT: admin
register: bosh_client_secret
- name: set env vars for login to director...
shell: bosh alias-env director -e director --ca-cert <(bosh int ./creds.yml --path /director_ssl/ca)
args:
executable: /bin/bash
environment:
BOSH_CLIENT: admin
BOSH_CLIENT_SECRET: "{{ bosh_client_secret.stdout }}"
...