CODEWITHSUNDEEP
jenkinsansiblejenkins-pipelineansible-2.xansible-vault
Lucas.de
Lucas.de

Reputation: 605

Launch Ansible playbook containing vault file reference from jenkinsfile

I have a Jenkinsfile trying to launch an Ansible playbook which references some parameters stored in an Ansible vault encrypted file.

Ansible is installed in version 2.4.0.0

Here is a snippet of my jenkins file:

withCredentials([[$class: 'StringBinding', credentialsId: 'vault_token', variable: 'VAULT_TOKEN']]) {

                    ansiblePlaybook(
                            playbook: "./ansible/playbooks/deploy.yml",
                            inventory: "./ansible/hosts/hosts",
                            credentialsId: "$VAULT_TOKEN"
                }

And there is the playbook:

---
- hosts: managers
  become: true
  tasks:
  - include_vars: ../vaults/passwords.yml
  - name: Log into Docker repository
    docker_login:
      registry: my.registry.org
      username: "{{ reg_user }}"
      password: "{{ reg_password }}"

This playbooks includes the vault file containing the encrypted values. When Jenkins execute the Jenkinsfile, I get the following error: Attempting to decrypt but no vault secrets found

Why is ansible not using the credentialId i've passed to him in the Jenkinsfile and what is the good way to pass this credential?

Upvotes: 2

Views: 9263

Answers (2)

Himanshu Singla
Himanshu Singla

Reputation: 410

  1. Please use 'vaultCredentialsId' instead of 'credentialsId' for vault token.
  2. Remove 'withCredentials'part and straightaway write like vaultCredentialsId:'vault_token' Ansible Plugin link

Upvotes: 3

ryan1506
ryan1506

Reputation: 195

try the following

withCredentials([file(credentialsId: 'vault_token', variable: 'VAULT_TOKEN')]) {
        ansiblePlaybook colorized: true, credentialsId: '', forks: 10, inventory: 'ansible/hosts/hosts', limit: '', playbook: 'ansible/playbooks/deploy.yml', sudoUser: null, extras: "--vault-password-file ${VAULT_TOKEN}"
        }

you need to add the

extras: "--vault-password-file ${VAULT_TOKEN}"

and leave credentialsId blank.

Upvotes: 0

Related Questions