You are reading an unmaintained version of the Ansible documentation. Unmaintained Ansible versions can contain unfixed security vulnerabilities (CVE). Please upgrade to a maintained version. See the latest Ansible documentation.

cyberark.conjur.conjur_variable lookup – Fetch credentials from CyberArk Conjur.

Note

This lookup plugin is part of the cyberark.conjur collection (version 1.2.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install cyberark.conjur. You need further requirements to be able to use this lookup plugin, see Requirements for details.

To use it in a playbook, specify: cyberark.conjur.conjur_variable.

New in cyberark.conjur 1.0.2

Synopsis

• Retrieves credentials from Conjur using the controlling host’s Conjur identity or environment variables. Environment variables could be CONJUR_ACCOUNT, CONJUR_APPLIANCE_URL, CONJUR_CERT_FILE, CONJUR_AUTHN_LOGIN, CONJUR_AUTHN_API_KEY, CONJUR_AUTHN_TOKEN_FILE Conjur info - https://www.conjur.org/.

Requirements

The below requirements are needed on the local controller node that executes this lookup.

• The controlling host running Ansible has a Conjur identity. (More: https://docs.conjur.org/latest/en/Content/Get%20Started/key_concepts/machine_identity.html)

Terms

Parameter	Comments
Terms string / required	Variable path

Parameters

Parameter	Comments
as_file boolean	Store lookup result in a temporary file and returns the file path. Thus allowing it to be consumed as an ansible file parameter (eg ansible_ssh_private_key_file). Choices: false ← (default) true
authn_token_file path	Path to the access token file. Default: "/var/run/conjur/access-token" Configuration: INI entry: [conjur,] authn_token_file = /var/run/conjur/access-token Environment variable: CONJUR_AUTHN_TOKEN_FILE
config_file path	Path to the Conjur configuration file. The configuration file is a YAML file. Default: "/etc/conjur.conf" Configuration: INI entry: [conjur,] config_file_path = /etc/conjur.conf Environment variable: CONJUR_CONFIG_FILE
identity_file path	Path to the Conjur identity file. The identity file follows the netrc file format convention. Default: "/etc/conjur.identity" Configuration: INI entry: [conjur,] identity_file_path = /etc/conjur.identity Environment variable: CONJUR_IDENTITY_FILE
validate_certs boolean	Flag to control SSL certificate validation Choices: false true ← (default)

Examples

---
  - hosts: localhost
    collections:
      - cyberark.conjur
    tasks:
      - name: Lookup variable in Conjur
        debug:
          msg: "{{ lookup('cyberark.conjur.conjur_variable', '/path/to/secret') }}"

Return Value

Key	Description
Return value string	Value stored in Conjur. Returned: success

Authors

• CyberArk BizDev (@cyberark-bizdev)

Hint

Configuration entries for each entry type have a low to high priority order. For example, a variable that is lower in the list will override a variable that is higher up.

Collection links

Issue Tracker Repository (Sources)