ansible/awx

New credentials type to provide VAULT_ADDR and VAULT_TOKEN env vars

Open

#13.117 geöffnet am 26. Okt. 2022

Auf GitHub ansehen
 (2 Kommentare) (1 Reaktion) (0 zugewiesene Personen)Python (3.333 Forks)batch import
Hacktoberfestcommunitycomponent:apicomponent:docscomponent:uigood first issuehelp wantedtype:enhancement

Repository-Metriken

Stars
 (13.071 Stars)
PR-Merge-Metriken
 (Durchschn. Merge 24T 6h) (30 gemergte PRs in 30 T)

Beschreibung

Please confirm the following

  • I agree to follow this project's code of conduct.
  • I have checked the current issues for duplicates.
  • I understand that AWX is open source software provided for free and that I might not receive a timely response.

Feature type

Enhancement to Existing Feature

Feature Summary

We have two credentials types that can use hashicorp vault to retrieve a value from a secret or sign an SSH key certificate, that can be used to connect automatically to a host.

What we lack is a credentials type to allow connection to a hashicorp vault server for use by the playbook. If we could use the current hashicorp vault plugin to provide the VAULT_ADDR and VAULT_TOKEN env vars, the playbook could then use the ansible lookup hashi_vault seamlessly.

I know I can just define a new credential type to manually provide these vars. But I wish to be able to use some vault authentication methods such as approle which is implemented in the secret lookup and SSH signing credentials types.

Select the relevant components

  • UI
  • API
  • Docs
  • Collection
  • CLI
  • Other

Steps to reproduce

  • use hashi_vault ansible lookup module in a playbook without having to initialize vault token in it.
  • configure a new credentials type Hashicorp Vault token that would expose VAULT_ADDR and VAULT_TOKEN env vars to the playbook, after authenticating to the vault server

Current results

Just not possible, AFAICT.

Sugested feature result

hashi_vault lookup module seamless use.

Additional information

I'm not sure a credentials type can be used to expose env vars, though.

Contributor Guide