Feature: Support external key store service

[ilbarone87]

Related to

Configuration

Impact

security improvements

Missing Feature

Would be nice (in particular after the addition of support for TF and OT) and an improvement to security if a built-in feature would allow to pull secrets from external secrets vault like Hashicorp Vault, Azure Keyvaults or AWS KMS. Both competitors like AWX (built-in) and rundeck (with plugin) have already this present. Doing this trough playbooks in Anisble at the moment is not the best user experience.

Implementation

I’ll leave this to the contributors.

Design

No response

[aleksandrgluhov]

Upvote to this feature request, this can be useful to store kube config and other keys more convenient.

As a pure ansible solution I personally use this self-made sugar:

Variables file:

vault_url: "https://foo.bar"
vault_ansible:
  role_id: !vault |
    asdfasdfasdfasdf
  secret_id: !vault |
    asdfasdfasdfasdf

vault_ansible_auth: >
  auth_method=approle
  role_id={{vault_ansible.role_id}}
  secret_id={{ vault_ansible.secret_id }}
  url={{ vault_url }}

Template file:

application.secret_property={{ lookup('community.hashi_vault.hashi_vault', 'kv_storage/data/secret:key' + vault_ansible_auth) }}

[lafayetteduarte]

+1

[Omicron7]

https://github.com/semaphoreui/semaphore/pull/2360 adds support for Ansible vault password client scripts, which could solve some of this feature request. You'd need to write a client script that uses Hashicorp Vault, Azure Keyvaults or AWS KMS as a backend for a password for decrypting a vault.