Store ansible vault password in azure keystore

Jan Jaap

3/23/24, 1:36 PM

At my company we use Azure cloud services. For our local department we want to setup a set of Linux servers. These servers are used to form a test setup.

To setup and maintain these servers we chose to use Ansible. To store secrets such as login details, we use Azure keyvault. Or we can use a ansible-vault encrypted file with the password stored in the Azure keyvault.

This is were the problem is. If we were to perform the following Ansible playbook: (based on this documentation)

---
- hosts: linux-servers
  connection: local
  collections:
    - azure.azcollection

  vars:
    vault_name: <key_vault_name>
    secret_name: <password_name>
    resource_group: <resource_group_name
    vault_uri: <vault_uri_>

  tasks:

  - name: Get decrypt password.
    block:
    - name: Get secret value
      azure_rm_keyvaultsecret_info:
        vault_uri: "{{ vault_uri }}"
        name: "{{ secret_name }}"
      register: kvSecret

    - name: set secret fact
      set_fact: decrypt_password="{{ kvSecret['secrets'][0]['secret'] }}"

    - name: Output key vault secret
      debug: 
        msg="{{ decrypt_password }}"

  - name: Perform some management stuff
    file:
      path: /opt/testfile.ext
      owner: test
      group: test
      mode: '0666'

We are perfectly fine to obtain the password or any other values. However we want to use this obtained password to decrypt the ansible-vault files which contains the login for each of the linux-servers. This works well, as long as we do not use ansible-vault encrypted files, however we do want to use those as they contain the ssh logins for the servers.

From what I read from the documentation, it is only possible to provide the vault password via:

Prompt
File
Script file (python).

My question here is the following. Is there something we are missing? Is it possible to have a role/include precede the overall playbooks to obtain the ansible-vault password and decrypt the files?

Any pointers are alternatives are much appreciated.

155

0 + 3

azure

ansible

ansible-playbook

Sam Cogan

3/24/24, 10:00 AM

Why not just store all your secrets in Key Vault, which is more secure than using a file.

Zeitounator

3/24/24, 4:32 PM

Just a note: `3. Script file (python)` <= this is actually wrong, you can use absolutely any executable as long as it returns the password on a single line

Zeitounator

3/26/24, 9:07 AM

`3. Script file (python)` <= this is actually wrong as you can use absolutely any executable as long as 1) its name ends with `-client[.ext]`, 2) it accepts a `--vault-id` parameter 3) It displays any optional needed prompt directly to the TTY 4) it returns the password on stdout. See docs.ansible.com/ansible/latest/vault_guide/… for more info. I your case, a script using the `az` client to retrieve the secret in azure key vault shoud do the trick.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Store ansible vault password in azure keystore

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.