0

At my company we use Azure cloud services. For our local department we want to setup a set of Linux servers. These servers are used to form a test setup.

To setup and maintain these servers we chose to use Ansible. To store secrets such as login details, we use Azure keyvault. Or we can use a ansible-vault encrypted file with the password stored in the Azure keyvault.

This is were the problem is. If we were to perform the following Ansible playbook: (based on this documentation)

---
- hosts: linux-servers
  connection: local
  collections:
    - azure.azcollection

  vars:
    vault_name: <key_vault_name>
    secret_name: <password_name>
    resource_group: <resource_group_name
    vault_uri: <vault_uri_>

  tasks:

  - name: Get decrypt password.
    block:
    - name: Get secret value
      azure_rm_keyvaultsecret_info:
        vault_uri: "{{ vault_uri }}"
        name: "{{ secret_name }}"
      register: kvSecret

    - name: set secret fact
      set_fact: decrypt_password="{{ kvSecret['secrets'][0]['secret'] }}"

    - name: Output key vault secret
      debug: 
        msg="{{ decrypt_password }}"

  - name: Perform some management stuff
    file:
      path: /opt/testfile.ext
      owner: test
      group: test
      mode: '0666'

We are perfectly fine to obtain the password or any other values. However we want to use this obtained password to decrypt the ansible-vault files which contains the login for each of the linux-servers. This works well, as long as we do not use ansible-vault encrypted files, however we do want to use those as they contain the ssh logins for the servers.

From what I read from the documentation, it is only possible to provide the vault password via:

  1. Prompt
  2. File
  3. Script file (python).

My question here is the following. Is there something we are missing? Is it possible to have a role/include precede the overall playbooks to obtain the ansible-vault password and decrypt the files?

Any pointers are alternatives are much appreciated.

Jan Jaap
  • 101
  • Why not just store all your secrets in Key Vault, which is more secure than using a file. – Sam Cogan Mar 24 '23 at 10:00
  • Just a note: `3. Script file (python)` <= this is actually wrong, you can use absolutely any executable as long as it returns the password on a single line – Zeitounator Mar 24 '23 at 16:32
  • `3. Script file (python)` <= this is actually wrong as you can use absolutely any executable as long as 1) its name ends with `-client[.ext]`, 2) it accepts a `--vault-id` parameter 3) It displays any optional needed prompt directly to the TTY 4) it returns the password on stdout. See docs.ansible.com/ansible/latest/vault_guide/… for more info. I your case, a script using the `az` client to retrieve the secret in azure key vault shoud do the trick. – Zeitounator Mar 26 '23 at 09:07

0 Answers0