Commit ea28f740 authored by Pierre Smeyers's avatar Pierre Smeyers
Browse files

Merge branch 'feat/deprecated-jwt-variables' into 'master' 

feat(oidc): OIDC authentication support now requires explicit configuration(see doc)

Closes #20

See merge request to-be-continuous/ansible!47
parents 004578d7 2c295137

README.md

+3 −0
Original line number Diff line number Diff line
@@ -541,6 +541,7 @@ In order to be able to communicate with the Vault server, the variant requires t 
| ----------------- | -------------------------------------- | ----------------- |

| `TBC_VAULT_IMAGE` | The [Vault Secrets Provider](https://gitlab.com/to-be-continuous/tools/vault-secrets-provider) image to use (can be overridden) | `$CI_REGISTRY/to-be-continuous/tools/vault-secrets-provider:master` |

| `VAULT_BASE_URL`  | The Vault server base API url          | _none_ |

| `VAULT_OIDC_AUD`  | The `aud` claim for the JWT | `$CI_SERVER_URL` |

| :lock: `VAULT_ROLE_ID`   | The [AppRole](https://www.vaultproject.io/docs/auth/approle) RoleID | **must be defined** |

| :lock: `VAULT_SECRET_ID` | The [AppRole](https://www.vaultproject.io/docs/auth/approle) SecretID | **must be defined** |
@@ -573,6 +574,8 @@ include: 
    file: '/templates/gitlab-ci-ansible-vault.yml'



variables:

    # audience claim for JWT

    VAULT_OIDC_AUD: "https://vault.acme.host"

    # Secrets managed by Vault

    ANSIBLE_VAULT_PASSWORD: "@url@http://vault-secrets-provider/api/secrets/b7ecb6ebabc231/my-infra/ansible?field=vault.password"

    ANSIBLE_PRIVATE_KEY: "@url@http://vault-secrets-provider/api/secrets/b7ecb6ebabc231/my-infra/ansible?field=priv_key"

templates/gitlab-ci-ansible-vault.yml

+6 −0
Original line number Diff line number Diff line
@@ -7,6 +7,7 @@ variables: 
  # variables have to be explicitly declared in the YAML to be exported to the service

  VAULT_ROLE_ID: "$VAULT_ROLE_ID"

  VAULT_SECRET_ID: "$VAULT_SECRET_ID"

  VAULT_OIDC_AUD: "$CI_SERVER_URL"



.ansible-base:

  services:
@@ -14,3 +15,8 @@ variables: 
      command: ["--service", "ansible", "4.1.0" ]

    - name: "$TBC_VAULT_IMAGE"

      alias: "vault-secrets-provider"

  variables:

    VAULT_JWT_TOKEN: "$VAULT_JWT_TOKEN"

  id_tokens:

    VAULT_JWT_TOKEN:

      aud: "$VAULT_OIDC_AUD"