'How to authenticate Ansible with Hashicorp Vault Signed SSH Certificates using "Valid_Principals"?

  • I implemented Vault according to the documentation like this . https://medium.com/hashicorp-engineering/scaling-ssh-access-with-hashicorp-vault-720bde42a79d
  • I follow this documentation to create playbook.https://github.com/nehrman/hc_vault_machine_credential And on the playbook I want to add the value "valid_principals" to authenticate. For example: valid_principals=it-system
  • I tried many ways to add to the playbook but it didn't work.
  • Please help me on the solution to this problem.
  • Thank you.
  • Here is my playbook look like:
- name: Create temporary directory to store public key
  tempfile:
   state: directory
   suffix: app
  register: r_tempfile
  delegate_to: localhost
  become: no
  run_once: true
  no_log: true

- name: Generate public key for sign to vault
  command:
   ssh-keygen -t rsa -f {{ r_tempfile.path | quote }}/id_rsa  -C "" -N ""
  delegate_to: localhost
  become: no
  run_once: true
  no_log: true

- name: Read public key
  set_fact:
   temp_public_key: "{{ lookup('file', r_tempfile.path + '/id_rsa.pub') }} "
  delegate_to: localhost
  run_once: true
  no_log: true

- name: Sign public key to Vault SSH CA
  uri:
   url: "{{ VAULT_SERVER }}/v1/ssh-ca-client-signer/sign/it-system-role"
   validate_certs: no
   method: POST
   headers:
    X-Vault-Token: "{{ VAULT_TOKEN }}"
   body: "{{ lookup('template', '{{ role_path }}/templates/vault_pubkey.j2') }}"
   body_format: json
   return_content: yes
  register: r_sign
  become: no
  delegate_to: localhost
  run_once: true

- name: Store signed key temporarily
  copy:
   content: "{{ r_sign.json.data.signed_key }}"
   dest: "{{ r_tempfile.path }}/signed"
  delegate_to: localhost
  become: no
  run_once: true
  no_log: true


Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source