'How to authenticate Ansible with Hashicorp Vault Signed SSH Certificates using "Valid_Principals"?
- I implemented Vault according to the documentation like this . https://medium.com/hashicorp-engineering/scaling-ssh-access-with-hashicorp-vault-720bde42a79d
- I follow this documentation to create playbook.https://github.com/nehrman/hc_vault_machine_credential And on the playbook I want to add the value "valid_principals" to authenticate. For example: valid_principals=it-system
- I tried many ways to add to the playbook but it didn't work.
- Please help me on the solution to this problem.
- Thank you.
- Here is my playbook look like:
- name: Create temporary directory to store public key
tempfile:
state: directory
suffix: app
register: r_tempfile
delegate_to: localhost
become: no
run_once: true
no_log: true
- name: Generate public key for sign to vault
command:
ssh-keygen -t rsa -f {{ r_tempfile.path | quote }}/id_rsa -C "" -N ""
delegate_to: localhost
become: no
run_once: true
no_log: true
- name: Read public key
set_fact:
temp_public_key: "{{ lookup('file', r_tempfile.path + '/id_rsa.pub') }} "
delegate_to: localhost
run_once: true
no_log: true
- name: Sign public key to Vault SSH CA
uri:
url: "{{ VAULT_SERVER }}/v1/ssh-ca-client-signer/sign/it-system-role"
validate_certs: no
method: POST
headers:
X-Vault-Token: "{{ VAULT_TOKEN }}"
body: "{{ lookup('template', '{{ role_path }}/templates/vault_pubkey.j2') }}"
body_format: json
return_content: yes
register: r_sign
become: no
delegate_to: localhost
run_once: true
- name: Store signed key temporarily
copy:
content: "{{ r_sign.json.data.signed_key }}"
dest: "{{ r_tempfile.path }}/signed"
delegate_to: localhost
become: no
run_once: true
no_log: true
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
