[SET-651] Adds support to read secrets from HashiCorp Vault #232
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue: https://issues.redhat.com/browse/SET-651
This would be the first PR to add the support to read secrets from a specified HashiCorp Vault instance.
What it does are:
vault
to read secrets from specified paths in a HashiCorp Vault server. It uses the secret key as the Ansible variable name, and uses the secret value as the Ansbile variable value.token
andapprole
authentication method, depending on the environment set up, it will use different authentication approach.community.hashi_vault
to the requirements.yml filessh
role to support writing ssh private key files from content besides copying from another file. This is because the private keys are secrets, and they need to be put somewhere in the HashiCorp Vault. The change won't change current behavior unless the variable get updated (ssh_keys -> ssh_keys_content
).The
community.hashi_vault
requireshvac
python library installed, I don't add that in this PR because I think it is belongs to the playbook change, unless thevault
role is used, it is not required.The subsequent PR will include the
vault
role as the first task in thepre_tasks
section in the playbooks to enable vault access.