Closed Deliveranc3 closed 6 months ago
ansible-builder
doesn't currently support dealing with secrets, and the method you are currently using (doing ansible-builder create
then manual Containerfile modification) seems to be the best alternative that I can see, at this time. Supporting secrets in a first-class manner is something we are considering in a future version, but it is not currently scheduled for any version just yet.
I'm looking for a way to add roles from a GitHub Enterprise instance which is not available on the internet and only accepts SSH pulls (i.e. no HTTP access)
Let's say I have the following
requirements.yml
:I can install this fine on my local machine with my SSH credentials. I've even been able to clone into Containers before using Secret mounts in my Containerfile. but I can't seem to make this work with ansible-builder. The current
execution-environment.yml
I'm using is:Based on the output from ansible-builder, it appears that ansible-galaxy is always run as its own
RUN
directive, and the secret mount doesn't appear to persist betweenRUN
directives.I was able to make this work by calling
ansible-builder create
, adding the--mount=type=secret,id=gitssh
line to the Galaxy install command then building withpodman build --secret id=gitssh,src=/home/me/.ssh/id_rsa .
Is there a better way to do this that doesn't involve the intermediary step of editing my Containerfile?