Ansible 塔 - 在 Playbook 中使用 Azure 密钥库机密

Question

I am currently trying to utilize the Credential of type Microsoft Azure Key Vault within a playbook. From some googling I have found some resources on specifying Credential Types and specifying a custom injector, but would prefer to achieve this with the built in credential if possible.

Currently, I have my key vault credentials properly configured and tested from the UI, and is able to find secrets using the service principal details I have supplied.

I wish to use this credential to dynamically access and lookup secrets within my playbooks with some sort of command like {{ my_kv_store }}:secret_name . Is achieving this sort of functionality possible?

Thanks in advance.

Answer 1

Decided to deviate away from trying to use Azure Key Vault and went with the Credential Type route instead with the Azure cli within the playbook.

Steps I followed:

New Credential Type: Azure Service Principal

# Input Configuration
fields:
  - id: vault_url
    type: string
    label: Vault URL (DNS Name)
  - id: client_id
    type: string
    label: Client ID
  - id: client_secret
    type: string
    label: Client Secret
    secret: true
  - id: tenant_id
    type: string
    label: Tenant ID
required:
  - vault_url
  - client_id
  - client_secret
  - tenant_id

# Injector Configuration
env:
  AZ_CLIENT_ID: '{{ client_id }}'
  AZ_CLIENT_SECRET: '{{ client_secret }}'
  AZ_TENANT_ID: '{{ tenant_id }}'
  AZ_VAULT_URL: '{{ vault_url }}'

Example Credential Configuration

New Credential: Azure SP Creds

1. Select Credential Type
2. Select the previously defined Credential Type (Azure Service Principal)
3. Provide the necessary input fields

Using Credential with your Job

1. Within Job Template
   1. Select Azure SP Creds
2. Within your playbook.yml

---
- name: grab test-secret from azure kv
  hosts: localhost
  gather_facts: false
  connection: local
  vars:
    kv_secret_name: "test-secret"
  tasks:
    - name: set facts
      set_fact:
        az_vault_name: "kv-237-gr-vnet-devops"
        az_tenant_id:   '{{ lookup("env", "AZ_TENANT_ID") }}'
        az_client_id:   '{{ lookup("env", "AZ_CLIENT_ID") }}'
        az_client_secret:  '{{ lookup("env", "AZ_CLIENT_SECRET") }}'
        az_vault_url:      '{{ lookup("env", "AZ_VAULT_URL") }}'
    - name: connect AZ CLI to Azure
      shell: |
        az login --service-principal -u "{{ az_client_id }}" -p "{{ az_client_secret }}" --tenant "{{ az_tenant_id }}"
      args:
        executable: /usr/bin/bash
    - name: Retrieve secret and register as var
      shell: az keyvault secret show --name "{{ kv_secret_name }}" --vault-name "{{ az_vault_name }}" --query value -o tsv
      args:
        executable: /usr/bin/bash
      register: azure_secret
    - debug:
        msg: "{{ azure_secret.stdout }}"
    
    # - name: Use creds to get KV secret
    #   azure_rm_keyvaultsecret_info
    #   debug: msg="the value of this secret is {{lookup('azure_kv',secretname,vault_url=url, client_id=client_id, secret=secret, tenant_id=tenant)}}"

- hosts: all
  vars:
    kv_secret: "{{ hostvars['localhost']['azure_secret']['stdout'] }}"
  tasks:
    - name: "Show the secret retrieved from localhost"
      shell: echo "{{ kv_secret }}"