kpfleming.powerdns_auth.cryptokey module – Manages a CryptoKey in a zone of PowerDNS Authoritative server

Note

This module is part of the kpfleming.powerdns_auth collection (version 25.2.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install kpfleming.powerdns_auth. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: kpfleming.powerdns_auth.cryptokey.

Synopsis

• This module can create, delete, activate/deactivate, publish/unpublish a CryptoKey in a zone of PowerDNS Authoritative server.

Requirements

The below requirements are needed on the host that executes this module.

• bravado

Parameters

Parameter	Comments
active boolean	Whether the CryptoKey is active or not. Choices: false ← (default) true
algorithm string	Algorithm for CryptoKey generation.
api_key string / required	Key (token) used to authenticate to the API endpoint in the server.
api_spec_path string	Path of the OpenAPI (Swagger) API spec document in api_url. Default: "/api/docs"
api_url string	URL of the API endpoint in the server. Default: "http://localhost:8081"
bits integer	Size of the CryptoKey in bits when algorithm is a variant of RSA. Default: 4096
dnskey string	The DNSKEY record for the CryptoKey. Required alongside privatekey for CryptoKey creation if algorithm is not present.
id string	The CryptoKey id.
keytype string / required	The type of CryptoKey, either zone signing key (zsk), key signing key (ksk) or combined signing key (csk) Note that by default if only one CryptoKey is present it will be used as a csk regardless of the provided type. For the CryptoKey to assume its role another CryptoKey of the opposite type has to be present (zsk for ksk and vice-versa). Choices: "zsk" "ksk" "csk"
privatekey string	The privatekey in ISC format. Required if dnskey
published boolean	Whether the CryptoKey is published or not. Choices: false true ← (default)
server_id string	ID of the server instance which holds the key. Default: "localhost"
state string	If present the CryptoKey will be created If present and id the CryptoKey will be updated If absent the CryptoKey will be deleted If exists lists all the keys in the zone If exists and id returns the corresponding CryptoKey Choices: "present" ← (default) "absent" "exists"
zone_name string / required	Name of the zone

Examples

%YAML 1.2
---
- name: Generate key
  kpfleming.powerdns_auth.cryptokey:
    api_key: foo
    zone_name: crypto.example.
    state: present
    keytype: csk
    algorithm: ed25519
    active: true

- name: Import key
  kpfleming.powerdns_auth.cryptokey:
    api_key: foo
    zone_name: crypto.example.
    state: present
    keytype: zsk
    dnskey: "257 3 15 lMu/7quhLeSueMcdlt3T0sxln32yhrhASCKKDB1xJOk="
    privatekey: |
      Private-key-format: v1.2
      Algorithm: 15 (ED25519)
      PrivateKey: Rnt2dv3mWMmP8bU/8koayZ4R5dWdI86zJmZ0nnjPe6Q=
    active: true

- name: Delete key
  kpfleming.powerdns_auth.cryptokey:
    api_key: foo
    zone_name: crypto.example.
    state: absent
    id: 1

- name: Activating key
  kpfleming.powerdns_auth.cryptokey:
    api_key: foo
    zone_name: crypto.example.
    state: present
    id: 1
    active: true

- name: Listing a specific key
  kpfleming.powerdns_auth.cryptokey:
    api_key: foo
    zone_name: crypto.example.
    state: exists
    id: 1

- name: Listing all keys in the zone
  kpfleming.powerdns_auth.cryptokey:
    api_key: foo
    zone_name: crypto.example.
    state: exists

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
cryptokeys list / elements=dictionary	List of existing CryptoKeys after all the changes are made. Returned: always
active boolean	whether or not the CryptoKey is active Returned: success
algorithm string	the CryptoKey algorithm Returned: success
bits integer	size in bits, used in dnskey record Returned: success
dnskey string	the dnskey record Returned: success
ds list / elements=string	when keytype is ksk or csk, used to create the DS record on the parent zone Returned: success
flags string	flags Returned: success
id string	the id of the CryptoKey Returned: success
keytype string	the type of the CryptoKey Returned: success
published boolean	whether or not the CryptoKey is published Returned: success
type string	always Cryptokey Returned: success
exists boolean	If id is provided, whether a corresponding key exists Otherwise if there is any key in the zone Returned: when state is exists

Authors

• Mohamed Chamrouk (@mohamed-chamrouk)

Collection links

• Issue Tracker
• Repository (Sources)