Background
- We use Ansible to provision and manage Azure infrastructure. At the moment we run Ansible "manually" i.e. we manually execute playbooks for various automated tasks. No CI infrastructure.
- Probably not relevant but we manage our inventory using dynamic script
azure_rm.py
. - We are encouraged to be as secure as possible i.e.
- Don't store Vault passwords in
~/.vault_pass
or in any local file - Don't store Azure secrets in
~/.azure/credentials
- Don't store anything secure in
.bashrc
.
- Don't store Vault passwords in
In such a scenario, I am having trouble coming up with a coherent strategy to ensure that my playbooks can access Azure secrets, while following the guidelines above.
Question
How can I avoid storing Ansible Vault and Azure credentials on files, while still ensuring my playbooks can access them?
What I've tried
So far I have come up with a wrapper script that
- asks the user for Vault password
- Uses that to decrypt a Vaulted Shell script
- Evaluates the script, which loads Azure environment variables into the environment;
- Runs the playbook on the environment that has been thus set.
Any better (more elegant, less complicated, more "Ansible") solutions out there?