azure.azcollection.azure_keyvault_secret lookup – Read secret from Azure Key Vault.
Note
This lookup plugin is part of the azure.azcollection collection (version 2.7.0).
You might already have this collection installed if you are using the ansible
package.
It is not included in ansible-core
.
To check whether it is installed, run ansible-galaxy collection list
.
To install it, use: ansible-galaxy collection install azure.azcollection
.
You need further requirements to be able to use this lookup plugin,
see Requirements for details.
To use it in a playbook, specify: azure.azcollection.azure_keyvault_secret
.
New in azure.azcollection 1.12.0
Synopsis
This lookup returns the content of secret saved in Azure Key Vault.
When ansible host is MSI enabled Azure VM, user don’t need provide any credential to access to Azure Key Vault.
Requirements
The below requirements are needed on the local controller node that executes this lookup.
requests
azure
Terms
Parameter |
Comments |
---|---|
Secret name, version can be included like secret_name/secret_version. |
Keyword parameters
This describes keyword parameters of the lookup. These are the values key1=value1
, key2=value2
and so on in the following
examples: lookup('azure.azcollection.azure_keyvault_secret', key1=value1, key2=value2, ...)
and query('azure.azcollection.azure_keyvault_secret', key1=value1, key2=value2, ...)
Parameter |
Comments |
---|---|
Client id of service principal that has access to the Azure Key Vault |
|
Specify which cloud, such as |
|
Secret of the service principal. |
|
Tenant id of service principal. |
|
MSI token autodiscover, default is true. |
|
Url of Azure Key Vault. |
Notes
Note
When keyword and positional parameters are used together, positional parameters must be listed before keyword parameters:
lookup('azure.azcollection.azure_keyvault_secret', term1, term2, key1=value1, key2=value2)
andquery('azure.azcollection.azure_keyvault_secret', term1, term2, key1=value1, key2=value2)
If version is not provided, this plugin will return the latest version of the secret.
If ansible is running on Azure Virtual Machine with MSI enabled, client_id, secret and tenant isn’t required.
For enabling MSI on Azure VM, please refer to this doc https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/
After enabling MSI on Azure VM, remember to grant access of the Key Vault to the VM by adding a new Acess Policy in Azure Portal.
If MSI is not enabled on ansible host, it’s required to provide a valid service principal which has access to the key vault.
To authenticate via service principal, pass client_id, secret and tenant_id or set environment variables AZURE_CLIENT_ID, AZURE_CLIENT_SECRET and AZURE_TENANT_ID.
Authentication via
az login
is also supported.To use a plugin from a collection, please reference the full namespace, collection name, and lookup plugin name that you want to use.
Return Value
Key |
Description |
---|---|
secret content string Returned: success |