Azure KeyVault secret read / Azure CLI restrictions (Ansible)

2
votes

We currently store a load of secrets in our azure keyvault for platform deployment. We deploy using Ansible, but it doesn't seem to have a read ability for keyvault (you can create, but not read!?). Our architect/product owner is forcing us to use this for storage, opposed to local vaults.

Our current solution is to have use azure CLI to login, then iterating through the list of secrets we want, one by one, and mapping to facts, then loggin out of the CLI. The problem with this is its single action, and seems to be rather slow. 

name: Capture KeyVault secret and register variable
local_action: "command az keyvault secret show --name {{ playsecret }} --vault-name {{ az_keyvault_name }}"
register: secretValue

So there is two problems with this, a solution that negates both would be ideal, but a solution to either would be great.

Problems:

  1. Azure cli login means we cant run things asynchronously. If both are reading secrets, the first to logout, logs the other out. (As we run this from an orchestration server. Its possible to negate this with more orch box's,but cost etc)
  2. Secret reading is single action, which seems to make it very slow (I suspect this is more on azure end than an ansible issue)
1
azureansibleazure-keyvaultazure-cli
Can you provide the whole ansible file which you use? – Charles Xu

1 Answers

2
votes

There is a preview module that helps with this https://github.com/Azure/azure_preview_modules. It lets you do 

some_secret_var: "{{ lookup('azure_keyvault_secret', 'some-secret-name', vault_url=vault_url, client_id=azure_credentials_client_id, secret=azure_credentials_secret, tenant_id=azure_credentials_tenant) }}"

in you vars file. Unfortunately this does not solve the slowness problem.