controller_credentials.yml

In these files we configure the base credentials for automation controller.
we will probably do this on a per environment basis. In this example, we will configure the environments with external credentials from an external vault (hashicorp).
As you will see, the lookup credentials are environment specific and the credentials are defined in the "all" and have no inputs defined. The inputs are now defined in the "controller_credential_input_sources.yml" files.

The infra.aap_configuration collection expects the vaules in the variable: controller_credentials. As we intend to configure everything just once, we spit the set of vars into the environments and join the lists in the main.yml, before calling the collection. If there are no credentials defined, do not add this file. If you do, ensure the file is present in all branches, with the correct content, described below.

variables

The api understands the following structure for credentials:

{
    "name": "",
    "description": "",
    "organization": null,
    "credential_type": null,
    "inputs": {},
    "user": null,
    "team": null
}

Below you will find some examples of the usage in configuration as code.

group_vars/all/controller_credentials.yml

Here we see an example of the configuration for credentials without inputs, these inputs are filled in by the credetial_input_sources in combination with the vault defenition below. You could use plain text usernames and passwords here DON'T. At least use ansible vault encrypted strings in git for usernames and passwords.
The best practice is to use an external secrets vault like "openbao". When using an external vault, use git secrets to access the vault from the pipeline.

When using the main.yml to appy the configuration as shown, you can use variables from the main playbook in the group_vars as shown in the Default_hashivault credential. This simplifies the configuration, there is now one definition in "all" that works in any environment, using these variables.

---
controller_credentials_all:

  - name: ansible
    description: The empty machine credential
    crdential_type: Machine
    organization: Default

  - name: gitlab
    description:
    credential_type: Source Control
    organization: Default

  - name: Default_automation_hub_image_pull_secret
    description:
    credential_type: Container Registry
    organization: Default

  - name: Default_automation_hub_token_published
    description:
    credential_type: Ansible Galaxy/Automation Hub API Token
    organization: Default

  - name: Default_automation_hub_token_community
    description:
    credential_type: Ansible Galaxy/Automation Hub API Token
    organization: Default

  - name: Default_automation_hub_token_rh_certified
    description:
    credential_type: Ansible Galaxy/Automation Hub API Token
    organization: Default

  - name: Default_automation_hub_token_validated
    description:
    credential_type: Ansible Galaxy/Automation Hub API Token
    organization: Default

  # When using a provate registry, you will need a image pull credential for this registry
  - name: image_pull_secret
    description: Secret to use the internal registry
    credential_type: Container Registry
    organization: Default
    inputs:
      host: registry-img.dev.lab
      username: <registry-username>
      password: <registry-password>
      verify_ssl: true

  - name: Default_hashivault
    description: HashiCorp Vault Secret Lookup example using token auth
    organization: Default
    credential_type: HashiCorp Vault Secret Lookup
    inputs:
      url: "{{ vault_url }}"
      token: "{{ vault_token }}"
      namespace: "{{ branch_name }}/{{ org_name }}"
      api_version: v1
      default_auth_path: token

But you can already see that the variable name used here has the "_all" extension, so the variable will not be overridden as this is not quite a inventory.
Why we do this, will become clear in a moment.

group_vars/dev/controller_credentials.yml

We configure specific credentials for the development environment here.
These will be used by all organizations.

---
controller_credentials_dev: []
  # There is no specific credential here at this time
...

Here the variable has the "_dev" extension, so the variable will not be overridden.

group_vars/prod/controller_credentials.yml

As we do not configure extra credentials in prod, this file is an empty set.

---
controller_credentials_prod: []
  # For prod, you should add the tokens as in dev here
...

Here the variable has the "_prod" extension, so the variable will not be overridden.

When we run a pipeline for a certain environment, the inventory structure will provide us with 2 variables: - controller_credentials_all
- controller_credentials_

We will merge these 2 variables into 1: controller_credentials and feed this to the infra.aap_configuration.controller_credentials role.
In main.yml the merge of the variables is done by this piece of code:

    - name: Set the controller vars
      ansible.builtin.set_fact:
        controller_credentials: >
          {{ controller_credentials_all |
          community.general.lists_mergeby(vars['controller_credentials_' + branch_name],
          'name', recursive=true, list_merge='append') }}

This results in the controller_credentials variable the collection needs.

If you wil be using external credentials in all environements, you can define the lookup credential per environment and define the credentials and the input_sources in the "all". The content of the credential is then managed in the external vault (where it should be).

Back