Ansible Vars Plugin for Hashicorp Vault
An Ansible Vars Plugin for Hashicorp Vault to lookup credentials/secrets,
injecting these into the playbook run (e.g.
Use Hashicorp Vault like you would ansible-vault'ed group_vars, domain_vars [a new concept in this module!] and host_vars.
This module was originaly developed for the gostint project.
- You may need
pip install urllib3
pip install hvac
sudo pip install hashivault-vars
Enable in Ansible
vars_plugins = /usr/local/lib/python2.7/dist-packages/hashivault_vars
Or, symlink from ansible's vars plugins folder to
$ cd /usr/local/lib/python2.7/dist-packages/ansible/plugins/vars $ sudo ln -s /usr/local/lib/python2.7/dist-packages/hashivault_vars/hashivault_vars.py .
On Alpine Linux:
pip install hvac hashivault-vars && \ ln -s /usr/lib/python2.7/site-packages/hashivault_vars/hashivault_vars.py \ /usr/lib/python2.7/site-packages/ansible/plugins/vars
Vault Secret Paths
Root path in vault:
Precendence (applied top to bottom, so last takes precendence):
ansible_connection, e.g.: "ssh", "winrm", ...
(this plugin attempts to make assumptions where
ansible_connection is not
set, but does not assume to inject this into vars in the playbook. Best
practice therefore would be to set
ansible_connection in your ansible
All values retrieved from these paths are mapped as ansible variables,
The layered lookups are merged, with the last taking precedence over earlier lookups.
Lookups to the vault are cached for the run.
Pull requests and merges to master trigger pylint and BATS tests.
Running BATS tests
(danger, will reveal retrieved vault secrets in the ansible log)
Set environment variable
Release to PyPi
From vagrant (pip prereqs are required), e.g.:
$ ./setup.py sdist bdist_wheel
Release from host:
$ twine upload dist/hashivault_vars-0.1.17*