Ansible Vars Plugin for Hashicorp Vault
Project description
Ansible Vars Plugin for Hashicorp Vault
Latest | |||
---|---|---|---|
PyPi | ||
---|---|---|
An Ansible Vars Plugin for Hashicorp Vault to lookup credentials/secrets,
injecting these into the playbook run (e.g. ansible_user
, ansible_password
,
etc).
Use Hashicorp Vault like you would ansible-vault'ed group_vars, domain_vars [a new concept in this module!] and host_vars.
This module was originaly developed for the gostint project.
Installation
sudo pip install hashivault-vars
Enable in Ansible
Symlink from ansible's vars plugins folder to hashivault_vars.py
, e.g.:
$ cd /usr/local/lib/python2.7/dist-packages/ansible/plugins/vars
$ sudo ln -s /usr/local/lib/python2.7/dist-packages/hashivault_vars/hashivault_vars.py .
On Alpine Linux:
pip install hvac hashivault-vars && \
ln -s /usr/lib/python2.7/site-packages/hashivault_vars/hashivault_vars.py \
/usr/lib/python2.7/site-packages/ansible/plugins/vars
Vault Secret Paths
Root path in vault:
/secret/ansible/
Precendence (applied top to bottom, so last takes precendence):
-
Groups:
/secret/ansible/groups/all
/secret/ansible/groups/ungrouped
/secret/ansible/groups/your_inv_item_group
- ...
-
Hosts/Domains:
/secret/ansible/{connection}/domains/com
/secret/ansible/{connection}/domains/example.com
/secret/ansible/{connection}/hosts/hosta.example.com
where {connection}
is ansible_connection
, e.g.: "ssh", "winrm", ...
(this plugin attempts to make assumptions where ansible_connection
is not
set)
All values retrieved from these paths are mapped as ansible variables,
e.g. ansible_user
, ansible_password
, etc.
The layered lookups are merged, with the last taking precendence over earlier lookups.
Lookups to the vault are cached for the run.
Developer Notes
Enable Debugging
(danger, will reveal retrieved vault secrets in the ansible log)
Set environment variable HASHIVAULT_VARS_DEBUG=1
.
Release to PyPi
From vagrant (pip prereqs are required), e.g.:
$ ./setup.py sdist bdist_wheel
$ twine upload dist/hashivault_vars-0.1.17*
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for hashivault_vars-0.1.18-py2-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 3626140213aa055786365e4a3b58ea1f541fdc04a5be3c4cfc735d7c02b0447a |
|
MD5 | fc5eebd153173e0e231a9af43ca92234 |
|
BLAKE2b-256 | 2fb9a6bb4dc775680f1ad02a9b06c4a779ad31bdc60199249bfcfd76c49cbe19 |