[[TOC]]
The gcp_vault_secret is an Ansible module for retrieving secret data from GCP Secret Manager.
If you want to compile it for local testing, you can do it:
mkdir -p $HOME/.ansible/plugins/modules
go get -d -v ./...
go build -x -o $HOME/.ansible/plugins/modules/gcp_vault_secret .Important: module's code is executed on remote hosts! Hence you must compile the binary with GOOS and GOARCH of the target host (not your laptop or whatever you're running ansible from).
| parameter | required | default | choices | comments |
|---|---|---|---|---|
| name | yes | None | Name of the secret in GCP Secret Manager | |
| creds_file | no | /tmp/.ansible/gcp_vault_secret_creds.json | file path or "system" | Path to Google API credentials file on remote filesystem or use "system" if the default service account has permissions |
| project_id | no | taken from creds_file, specify if "system" is used | Name of the GCP Project where Secret Manager resides | |
| private_google_api_endpoint | no | no | yes/no | Make all requests to Google API via privately routed endpoint (private.googleapis.com:443) |
Example of usage in a playbook (for this example you will need to export GOOGLE_APPLICATION_CREDENTIALS variable with local path to Google API creds file on your local host):
---
- name: Test module gcp_vault_secret
tasks:
- name: Copy GCP credentials file to remote host
copy:
src: "{{ lookup('env', 'GOOGLE_APPLICATION_CREDENTIALS') }}"
dest: /tmp/.ansible/gcp_vault_secret_creds.json
mode: '0600'
remote_src: no
- name: Retrieve private key
gcp_vault_secret:
name: "my-secret-name"
private_google_api_endpoint: no
register: ssl_private_key
- name: Save secret key to disk
copy:
content: "{{ ssl_private_key.data }}\n"
dest: /etc/pki/tls/private/ssl.keyThis is an example where the default service account on a system has read access to secret manager.
---
- name: Test module gcp_vault_secret
tasks:
- name: Use default VM service account
gcp_vault_secret:
name: "my-secret-name"
private_google_api_endpoint: yes
creds_file: "system"
project_id: "gcp-project-name"
register: ssl_private_key
- name: Save secret key to disk
copy:
content: "{{ ssl_private_key.data }}\n"
dest: /etc/pki/tls/private/ssl.key| name | description | type | sample |
|---|---|---|---|
| data | Plain-text secret data retrieved from Secret Manager | string | Bla!bla@MyPassWORd |
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent