Secrets in Ansible

Provisioning machines with passwords, API tokens and other secrets without getting a headache.

This talk was presented at the AnsibleBenelux meetup, hosted at the SecretHub offices in Delft, the Netherlands.

It discusses some challenges of using Ansible Vault and shows some cool things you can do with the SecretHub Ansible module that make your life easier as a DevOps engineer.

For full talk materials (including demo videos) see: https://github.com/secrethub/talks

Transcript

1. AnsibleBenelux 2018/9/19
2. WiFi: visitorswifi
3. WiFi: visitorswifi No password
4. #AnsibleBenelux
5. Secrets in Ansible Provisioning machines with passwords, API tokens and other secrets without getting a headache
6. AWS Cloud
7. AWS Cloud Google Cloud
8. Shared Resource AWS Cloud Google Cloud
9. Shared Resource AWS Cloud Google Cloud
10. Shared Resource AWS Cloud Google Cloud Customer Datacenter
11. Shared Resource AWS Cloud Google Cloud Azure Cloud Customer Datacenter
12. Shared Resource AWS Cloud Google Cloud Shared Resource Azure Cloud Customer Datacenter
13. Shared Resource AWS Cloud Google Cloud Shared Resource Azure Cloud Customer Datacenter
14. Shared Resource AWS Cloud Google Cloud Shared Resource Azure Cloud Customer Datacenter
15. Shared Resource AWS Cloud Google Cloud Shared Resource Azure Cloud Customer Datacenter DevOps
16. Shared Resource AWS Cloud Google Cloud Shared Resource Azure Cloud Customer Datacenter DevOps Admins
17. Shared Resource AWS Cloud Google Cloud Shared Resource Azure Cloud Customer Datacenter DevOps Admins Outside Contractors
18. Azure Cloud Azure Cloud Shared Resource Shared Resource Customer Datacenter Shared Resource AWS Cloud Google Cloud Google Cloud Shared Resource Customer Datacenter AWS Cloud Shared Resource AWS Cloud Google Cloud Shared Resource Azure Cloud Customer Datacenter DevOps Admins Outside Contractors
20. Marc Mackenbach marc@secrethub.io @marcmackenbach mackenbach SecretHub
22. ansible-vault
23. ansible-vault Vault is a built-in feature of Ansible that helps users to encrypt vars with a password.
24. team_vault.yml DevOps p3pp3r0ni_pizz4
25. team_vault.yml DevOps p3pp3r0ni_pizz4 admins_vault.yml Admins bi9d4ddy
26. --- - hosts: db_servers tasks: - include_vars: admin_vault.yml - include_vars: dev_vault.yml - name: "Create a database user for the app" postgresql_user: db: app name: "{{ db_user }}" password: "{{ db_pass }}" login_user: "{{ root_user }}" login_password: "{{ root_pass }}" state: present priv: characters:select - hosts: web_servers tasks: - include_vars: dev_vault.yml - name: "Start the app with secrets" shell: "server" environment: DB_HOST: "{{ db_server }}" DB_NAME: app DB_USER: "{{ db_user }}" DB_PASSWORD: "{{ db_pass }}" SLACK_TOKEN: "{{ slack_token }}"
27. --- - hosts: db_servers tasks: - include_vars: admin_vault.yml - include_vars: dev_vault.yml - name: "Create a database user for the app" postgresql_user: db: app name: "{{ db_user }}" password: "{{ db_pass }}" login_user: "{{ root_user }}" login_password: "{{ root_pass }}" state: present priv: characters:select - hosts: web_servers tasks: - include_vars: dev_vault.yml - name: "Start the app with secrets" shell: "server" environment: DB_HOST: "{{ db_server }}" DB_NAME: app DB_USER: "{{ db_user }}" DB_PASSWORD: "{{ db_pass }}" SLACK_TOKEN: "{{ slack_token }}" admin_vault.yml dev_vault.yml
28. Admin runs playbook
30. Dev runs playbook
32. team_vault.yml DevOps p3pp3r0ni_pizz4 admins_vault.yml Admins bi9d4ddy
33. team_vault.yml DevOps p3pp3r0ni_pizz4 admins_vault.yml Admins bi9d4ddy external_vault.yml Outside Contractors f1yin9_dutchm4n
34. team_vault.yml DevOps p3pp3r0ni_pizz4 admins_vault.yml Admins bi9d4ddy external_vault.yml Outside Contractors f1yin9_dutchm4n
35. Writing is manual
37. People leave
38. Rotate all secrets
39. SecretHub
40. Ansible Module SecretHub
41. --- - hosts: db_servers environment: SECRETHUB_CREDENTIAL: "{{ lookup('env', 'SECRETHUB_CREDENTIAL') }}" tasks: - name: "Ensure the SecretHub CLI is installed" secrethub_cli: - name: "Read database root user" secrethub_read: path: ansible-demo/infra/postgres/root_user register: db_root_user - name: "Read database root password" secrethub_read: path: ansible-demo/infra/postgres/root_pass register: db_root_pass - name: "Generate a database username for the app" secrethub_generate: path: ansible-demo/infra/app/db_user register: db_user - name: "Generate a database password for the app" secrethub_generate: path: ansible-demo/infra/app/db_pass register: db_pass - name: "Create a database user for the app" postgresql_user: db: app name: "{{ db_user.secret }}" password: "{{ db_pass.secret }}" login_user: "{{ db_root_user.secret }}" login_password: "{{ db_root_pass.secret }}" state: present priv: characters:select - hosts: web_servers environment: SECRETHUB_CREDENTIAL: "{{ lookup('env', 'SECRETHUB_CREDENTIAL') }}" tasks: - name: "Ensure the SecretHub CLI is installed" secrethub_cli: - name: "Read the app's database user" secrethub_read: path: ansible-demo/infra/app/db_user register: db_user - name: "Read the app's database password" secrethub_read: path: ansible-demo/infra/app/db_pass register: db_pass - name: "Read the app's slack_token" secrethub_read: path: ansible-demo/infra/app/slack_token register: slack_token - name: "Start the app with secrets" shell: "server" environment: DB_HOST: "{{ db_server }}" DB_NAME: app DB_USER: "{{ db_user.secret }}" DB_PASSWORD: "{{ db_pass.secret }}" SLACK_TOKEN: "{{ slack_token.secret }}"
42. --- - hosts: db_servers environment: SECRETHUB_CREDENTIAL: "{{ lookup('env', 'SECRETHUB_CREDENTIAL') }}" tasks: - name: "Ensure the SecretHub CLI is installed" secrethub_cli: - name: "Read database root user" secrethub_read: path: ansible-demo/infra/postgres/root_user register: db_root_user - name: "Read database root password" secrethub_read: path: ansible-demo/infra/postgres/root_pass register: db_root_pass - name: "Generate a database username for the app" secrethub_generate: path: ansible-demo/infra/app/db_user register: db_user - name: "Generate a database password for the app" secrethub_generate: path: ansible-demo/infra/app/db_pass register: db_pass - name: "Create a database user for the app" postgresql_user: db: app name: "{{ db_user.secret }}" password: "{{ db_pass.secret }}" login_user: "{{ db_root_user.secret }}" login_password: "{{ db_root_pass.secret }}" state: present priv: characters:select - hosts: web_servers environment: SECRETHUB_CREDENTIAL: "{{ lookup('env', 'SECRETHUB_CREDENTIAL') }}" tasks: - name: "Ensure the SecretHub CLI is installed" secrethub_cli: - name: "Read the app's database user" secrethub_read: path: ansible-demo/infra/app/db_user register: db_user - name: "Read the app's database password" secrethub_read: path: ansible-demo/infra/app/db_pass register: db_pass - name: "Read the app's slack_token" secrethub_read: path: ansible-demo/infra/app/slack_token register: slack_token - name: "Start the app with secrets" shell: "server" environment: DB_HOST: "{{ db_server }}" DB_NAME: app DB_USER: "{{ db_user.secret }}" DB_PASSWORD: "{{ db_pass.secret }}" SLACK_TOKEN: "{{ slack_token.secret }}" secrethub_cli
43. --- - hosts: db_servers environment: SECRETHUB_CREDENTIAL: "{{ lookup('env', 'SECRETHUB_CREDENTIAL') }}" tasks: - name: "Ensure the SecretHub CLI is installed" secrethub_cli: - name: "Read database root user" secrethub_read: path: ansible-demo/infra/postgres/root_user register: db_root_user - name: "Read database root password" secrethub_read: path: ansible-demo/infra/postgres/root_pass register: db_root_pass - name: "Generate a database username for the app" secrethub_generate: path: ansible-demo/infra/app/db_user register: db_user - name: "Generate a database password for the app" secrethub_generate: path: ansible-demo/infra/app/db_pass register: db_pass - name: "Create a database user for the app" postgresql_user: db: app name: "{{ db_user.secret }}" password: "{{ db_pass.secret }}" login_user: "{{ db_root_user.secret }}" login_password: "{{ db_root_pass.secret }}" state: present priv: characters:select - hosts: web_servers environment: SECRETHUB_CREDENTIAL: "{{ lookup('env', 'SECRETHUB_CREDENTIAL') }}" tasks: - name: "Ensure the SecretHub CLI is installed" secrethub_cli: - name: "Read the app's database user" secrethub_read: path: ansible-demo/infra/app/db_user register: db_user - name: "Read the app's database password" secrethub_read: path: ansible-demo/infra/app/db_pass register: db_pass - name: "Read the app's slack_token" secrethub_read: path: ansible-demo/infra/app/slack_token register: slack_token - name: "Start the app with secrets" shell: "server" environment: DB_HOST: "{{ db_server }}" DB_NAME: app DB_USER: "{{ db_user.secret }}" DB_PASSWORD: "{{ db_pass.secret }}" SLACK_TOKEN: "{{ slack_token.secret }}" secrethub_read
44. --- - hosts: db_servers environment: SECRETHUB_CREDENTIAL: "{{ lookup('env', 'SECRETHUB_CREDENTIAL') }}" tasks: - name: "Ensure the SecretHub CLI is installed" secrethub_cli: - name: "Read database root user" secrethub_read: path: ansible-demo/infra/postgres/root_user register: db_root_user - name: "Read database root password" secrethub_read: path: ansible-demo/infra/postgres/root_pass register: db_root_pass - name: "Generate a database username for the app" secrethub_generate: path: ansible-demo/infra/app/db_user register: db_user - name: "Generate a database password for the app" secrethub_generate: path: ansible-demo/infra/app/db_pass register: db_pass - name: "Create a database user for the app" postgresql_user: db: app name: "{{ db_user.secret }}" password: "{{ db_pass.secret }}" login_user: "{{ db_root_user.secret }}" login_password: "{{ db_root_pass.secret }}" state: present priv: characters:select - hosts: web_servers environment: SECRETHUB_CREDENTIAL: "{{ lookup('env', 'SECRETHUB_CREDENTIAL') }}" tasks: - name: "Ensure the SecretHub CLI is installed" secrethub_cli: - name: "Read the app's database user" secrethub_read: path: ansible-demo/infra/app/db_user register: db_user - name: "Read the app's database password" secrethub_read: path: ansible-demo/infra/app/db_pass register: db_pass - name: "Read the app's slack_token" secrethub_read: path: ansible-demo/infra/app/slack_token register: slack_token - name: "Start the app with secrets" shell: "server" environment: DB_HOST: "{{ db_server }}" DB_NAME: app DB_USER: "{{ db_user.secret }}" DB_PASSWORD: "{{ db_pass.secret }}" SLACK_TOKEN: "{{ slack_token.secret }}" secrethub_generate
45. --- - hosts: db_servers environment: SECRETHUB_CREDENTIAL: "{{ lookup('env', 'SECRETHUB_CREDENTIAL') }}" tasks: - name: "Ensure the SecretHub CLI is installed" secrethub_cli: - name: "Read database root user" secrethub_read: path: ansible-demo/infra/postgres/root_user register: db_root_user - name: "Read database root password" secrethub_read: path: ansible-demo/infra/postgres/root_pass register: db_root_pass - name: "Generate a database username for the app" secrethub_generate: path: ansible-demo/infra/app/db_user register: db_user - name: "Generate a database password for the app" secrethub_generate: path: ansible-demo/infra/app/db_pass register: db_pass - name: "Create a database user for the app" postgresql_user: db: app name: "{{ db_user.secret }}" password: "{{ db_pass.secret }}" login_user: "{{ db_root_user.secret }}" login_password: "{{ db_root_pass.secret }}" state: present priv: characters:select - hosts: web_servers environment: SECRETHUB_CREDENTIAL: "{{ lookup('env', 'SECRETHUB_CREDENTIAL') }}" tasks: - name: "Ensure the SecretHub CLI is installed" secrethub_cli: - name: "Read the app's database user" secrethub_read: path: ansible-demo/infra/app/db_user register: db_user - name: "Read the app's database password" secrethub_read: path: ansible-demo/infra/app/db_pass register: db_pass - name: "Read the app's slack_token" secrethub_read: path: ansible-demo/infra/app/slack_token register: slack_token - name: "Start the app with secrets" shell: "server" environment: DB_HOST: "{{ db_server }}" DB_NAME: app DB_USER: "{{ db_user.secret }}" DB_PASSWORD: "{{ db_pass.secret }}" SLACK_TOKEN: "{{ slack_token.secret }}" <var>.secret
46. --- - hosts: db_servers environment: SECRETHUB_CREDENTIAL: "{{ lookup('env', 'SECRETHUB_CREDENTIAL') }}" tasks: - name: "Ensure the SecretHub CLI is installed" secrethub_cli: - name: "Read database root user" secrethub_read: path: ansible-demo/infra/postgres/root_user register: db_root_user - name: "Read database root password" secrethub_read: path: ansible-demo/infra/postgres/root_pass register: db_root_pass - name: "Generate a database username for the app" secrethub_generate: path: ansible-demo/infra/app/db_user register: db_user - name: "Generate a database password for the app" secrethub_generate: path: ansible-demo/infra/app/db_pass register: db_pass - name: "Create a database user for the app" postgresql_user: db: app name: "{{ db_user.secret }}" password: "{{ db_pass.secret }}" login_user: "{{ db_root_user.secret }}" login_password: "{{ db_root_pass.secret }}" state: present priv: characters:select - hosts: web_servers environment: SECRETHUB_CREDENTIAL: "{{ lookup('env', 'SECRETHUB_CREDENTIAL') }}" tasks: - name: "Ensure the SecretHub CLI is installed" secrethub_cli: - name: "Read the app's database user" secrethub_read: path: ansible-demo/infra/app/db_user register: db_user - name: "Read the app's database password" secrethub_read: path: ansible-demo/infra/app/db_pass register: db_pass - name: "Read the app's slack_token" secrethub_read: path: ansible-demo/infra/app/slack_token register: slack_token - name: "Start the app with secrets" shell: "server" environment: DB_HOST: "{{ db_server }}" DB_NAME: app DB_USER: "{{ db_user.secret }}" DB_PASSWORD: "{{ db_pass.secret }}" SLACK_TOKEN: "{{ slack_token.secret }}" admin access dev access
47. Admin runs playbook
48. TODO: videos
49. Dev runs playbook
50. TODO: videos
51. Recap
52. github.com/secrethub/ansible-secrethub SecretHub
53. QA