Git Product home page Git Product logo

ansible-vault's Introduction

ansible-vault lookup module Build Status

This is a lookup module for secrets stored in HashiCorp Vault. Supports Ansible 1.9.x and 2.x

Installation

lookup plugins can be loaded from several different locations similar to $PATH, see lookup_plugins. An example setup can be found in the tests directory.

The source for the plugin can be pointed to via a requirements.yml file, and accessed via ansible-galaxy.

Configuration

The address to the Vault server:

export VAULT_ADDR=http://192.168.33.10:8200/

The plugin supports both Vault auth token and GitHub auth token. To use Vault auth token:

export VAULT_TOKEN=56f48aef-8ad3-a0c4-447b-8e96990776ff

If your Vault server is configured to use GitHub auth token:

export VAULT_GITHUB_API_TOKEN=56f48aef-8ad3-a0c4-447b-8e96990776ff

The plugin also supports Vault's CA-related environment variables, to enable use of a server certificate issued by a not-widely-trusted Certificate Authority. Use of this feature in the plugin requires Python 2.7.9.

export VAULT_CACERT=/etc/ssl/certs/localCA.pem
export VAULT_CAPATH=/etc/ssl/localCA

The Vault address, CA certificate, and path can also be set via the Ansible variables vault_addr, vault_cacert, and vault_capath, respectively.

export VAULT_CAHOSTVERIFY="no"

This avoid the hostname check for Vault certificate (useful with self-signed certicates). This option can also be set via the Ansible variable vault_cahostverify.

export VAULT_SKIP_VERIFY=1

This will disable ssl certs validation. VAULT_CACERT, VAULT_CAPATH and VAULT_CAHOSTVERIFY have to be unset. Can also be set via Ansible variable vault_skip_verify: <bool>.

For more information on setting variables in Ansible, see the variables docs.

The Vault token intentionally can not be set via an Ansible variable, as this is generally checked into revision control and would be a bad security practice somewhat defeating the purpose of using Vault. The token can be read from the file $HOME/.vault-token, as documented at Vault environment variables.

If any such parameter is set by both an environment variable and an alternative means, the environment variable takes precedence.

Caching

By default secrets fetched from Vault will be cached in memory, unless you specify

export ANSIBLE_HASHICORP_VAULT_USE_CACHE=no

Note that secrets will be fetched once per fork (defaults to 5). If you turn off this feature by toggling above variable, all lookups will be done per node instead.

Approle support

If you want to use the Approle auth backend, you can do this by setting the follwing environment variables. If those vars are set, it is tried to get an approle token. If caching is enabled, the token is stored in the cache, so that it can be reused.

export ANSIBLE_HASHICORP_VAULT_ROLE_ID=ba78195c-12c9-557f-f8e2-75705b9b52ec
export ANSIBLE_HASHICORP_VAULT_SECRET_ID=5a4d079b-e6aa-ad54-8b0c-09dd35b740ee

Per default the authentication will be done against ${YOUR_HOST}/v1/auth/approle/login You can change this to fit your layout by setting the following var to your value:

export ANSIBLE_HASHICORP_VAULT_ROLE_PATH=v1/auth/my/role/path/approle/login

Usage

ansible-vault works as any other lookup plugin.

- debug: msg="{{ lookup('vault', 'secret/foo', 'value') }}"
# templates/example.j2

# Generic secrets
{{ lookup('vault', 'secret/hello').value }} # world
# Generic secrets with parameters
{{ lookup('vault', 'pki/issue/example-dot-com common_name=foo.example.com format=pem_bundle').certificate }}
# Specify field inside lookup
{{ lookup('vault', 'secret/hello', 'value') }} # world
# This syntax for Ansible 1.9.x
{{ lookup('vault', ['secret/hello', 'value']) }} # world

# Dynamic secrets
{% set aws = lookup('vault', 'aws/creds/deploy') %}
access_key = {{ aws.access_key }} # AKSCAIZSFSYHFGA
secret_key = {{ aws.secret_key }} # 4XSLxDUS+hyXgoIHEhCKExHDGAJDHFiUA/adi

If the desired value is stored within Vault with the key 'value' (like 'value=world' shown above), within a task, the lookup can be performed with:

with_vault:
- secret/hello

And then referenced with "{{ item.value }}"

Alternatively, the lookup can be performed with:

with_vault:
- secret/hello
- value

And then referenced with "{{ item }}"

Both of these forms work with both Ansible 1.9.x and 2.x. They only work within tasks, though. You can not use the with_vault: syntax within a variable definition file.

What's the difference between ansible-vault and hashi_vault

  • (Ansible Vault) No external dependencies; (hashi_vault) requires hvac
  • (Ansible Vault) Uses the same environment variables as vault itself
  • (Ansible Vault) Quicker update cycle
  • (Ansible Vault) Supports dynamic secrets
  • (Ansible Vault) Supports custom fields

ansible-vault's People

Contributors

andor44 avatar cheekyhalf avatar dervolker avatar foolswood avatar fredleger avatar jhaals avatar mcinquin avatar mfriedenhagen avatar mikethecanuck avatar movermeyer avatar msabramo avatar njordr avatar richfromm avatar susman avatar

Watchers

 avatar  avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.