google.cloud.gcp_secret_manager lookup – Get Secrets from Google Cloud as a Lookup plugin
Note
This lookup plugin is part of the google.cloud collection (version 1.4.1).
You might already have this collection installed if you are using the ansible
package.
It is not included in ansible-core
.
To check whether it is installed, run ansible-galaxy collection list
.
To install it, use: ansible-galaxy collection install google.cloud
.
To use it in a playbook, specify: google.cloud.gcp_secret_manager
.
Note
The google.cloud collection will be removed from Ansible 12 due to violations of the Ansible inclusion requirements. The collection has unresolved sanity test failures. See the discussion thread for more information.
Synopsis
retrieve secret keys in Secret Manager for use in playbooks
see https://cloud.google.com/iam/docs/service-account-creds for details on creating credentials for Google Cloud and the format of such credentials
once a secret value is retreived, it is returned decoded. It is up to the developer to maintain secrecy of this value once returned.
Keyword parameters
This describes keyword parameters of the lookup. These are the values key1=value1
, key2=value2
and so on in the following
examples: lookup('google.cloud.gcp_secret_manager', key1=value1, key2=value2, ...)
and query('google.cloud.gcp_secret_manager', key1=value1, key2=value2, ...)
Parameter |
Comments |
---|---|
support for GCP Access Token defaults to OS env variable GCP_ACCESS_TOKEN if not present |
|
the type of authentication to use with Google Cloud (i.e. serviceaccount or machineaccount) defaults to OS env variable GCP_AUTH_KIND if not present |
|
the name of the secret to look up in Secret Manager |
|
how to handle errors strict means raise an exception warn means warn, and return none ignore means just return none Choices:
|
|
The name of the google cloud project defaults to OS env variable GCP_PROJECT if not present |
|
Authenticaiton scopes for Google Secret Manager Default: |
|
email associated with the service account defaults to OS env variable GCP_SERVICE_ACCOUNT_EMAIL if not present |
|
JSON Credential file obtained from Google Cloud defaults to OS env variable GCP_SERVICE_ACCOUNT_FILE if not present see https://cloud.google.com/iam/docs/service-account-creds for details |
|
JSON Object representing the contents of a service_account_file obtained from Google Cloud defaults to OS env variable GCP_SERVICE_ACCOUNT_INFO if not present |
|
the version name of your secret to retrieve Default: |
Examples
- name: Test secret using env variables for credentials
ansible.builtin.debug:
msg: "{{ lookup('google.cloud.gcp_secret_manager', key='secret_key') }}"
- name: Test secret using explicit credentials
ansible.builtin.debug:
msg: "{{ lookup('google.cloud.gcp_secret_manager', key='secret_key', project='project', auth_kind='serviceaccount', service_account_file='file.json') }}"
- name: Test getting specific version of a secret (old version)
ansible.builtin.debug:
msg: "{{ lookup('google.cloud.gcp_secret_manager', key='secret_key', version='1') }}"
- name: Test getting specific version of a secret (new version)
ansible.builtin.debug:
msg: "{{ lookup('google.cloud.gcp_secret_manager', key='secret_key', version='2') }}"
Return Value
Key |
Description |
---|---|
the contents of the secret requested (please use “no_log” to not expose this secret) Returned: success |