{"id":1469,"date":"2022-05-19T09:57:22","date_gmt":"2022-05-19T09:57:22","guid":{"rendered":"https:\/\/www.nicktailor.com\/?p=1469"},"modified":"2022-10-21T12:06:21","modified_gmt":"2022-10-21T12:06:21","slug":"how-to-pass-an-api-key-with-ansible","status":"publish","type":"post","link":"https:\/\/nicktailor.com\/tech-blog\/how-to-pass-an-api-key-with-ansible\/","title":{"rendered":"How to pass an API key with Ansible"},"content":{"rendered":"

https:\/\/chronosphere.io\/ – Third Party Cloud Monitoring Solution<\/span><\/strong><\/p>\n

Chronocollector<\/strong>: – <\/span>https:\/\/github.com\/Perfect10NickTailor\/chronocollector<\/span><\/a><\/p>\n

This role deploys the chronocollector management service which sends the data to <\/span>domain.chronosphere.io<\/span> For those of you who don\u2019t know what it is. Its basically a <\/span>cloud monitoring tool<\/span> that scrapes data on your instances and then you can create dashboards or even export the data to promethus to make it look pretty and easy to read. You will likely pay for subscription, they will give you a subdomain which becomes your gateway address (domain.<\/span>chronosphere.io)<\/p>\n

Special note: You then need to deploy the node_exporter to push to the hosts you want scraped. That is a separate playbook and stupid easy.<\/span><\/p>\n

\n
\n
\u25cf<\/span>This role will download the latest collector<\/span><\/div>\n<\/div>\n
\n
\u25cf<\/span>It will install the latest collector<\/span><\/div>\n<\/div>\n
\n
\u25cf<\/span>It will check to see if the ‘service’ its added to systemd, if nots.. adds it, if the service is there, it will move on and simply start the service.<\/span><\/div>\n<\/div>\n<\/div>\n

#nowthatsjustfunny<\/span>: So its debatable on how to approach passing {{ api_keys }} in a scalable and secure way. A lot of people create an <\/span>\u201cansible vault encrypted variable\u201d. <\/span>This is so that when they push their code to their git repos. The {{ api_key }} isn\u2019t exposed to someone simply glancing by the code. <\/span>The issue with this approach is now you have to remember a vault password to pass to ansible, so it can decrypt the {{ api_key }} to pass, inorder for it to work when you run the playbook.<\/span>(LAME)<\/span><\/p>\n

.<\/span><\/span><\/p>\n

#nowthatsjustcool:<\/span> So just for the purposes of this post and for fun. I wrote it so that you can simply pass the {{ api_key }} during runtime. This way instead of being prompted for the vault-pass, you are prompted for the api_key to pass as a variable when you run the book.<\/span> This gets rid of the need to setup a encrypted variable in your code entirely. <\/span>Everyone has their own way of doing things, but I tend to think outside the box, so it always way more fun to be different in how you think.
\n<\/span><\/p>\n

.<\/span><\/span><\/p>\n

Ansible Operational Documentation<\/span><\/strong><\/p>\n

How to use this role:<\/span><\/p>\n

\n
\n
1.<\/span>You must first download the git repository <\/span><\/div>\n
\n
\n
a.<\/span>git clone git@github.com:Perfect10NickTailor\/chronocollector.git<\/em><\/span><\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
2.<\/span>Under your user you will see a directory called <\/span>chronocollector<\/span><\/strong> cd into this directory here you will see the <\/span>defaults\/main.yml<\/span> where you can see what you can pass to <\/span>groups_vars & host_vars
\n<\/span><\/div>\n
\n
\n
b.<\/span>cd chronocollector<\/em><\/span><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

.<\/span><\/span><\/p>\n

\n
\n
3.<\/span>Next you want edit the <\/span>hosts.client<\/span> inside your <\/span>ansible\/inventory\/dev\/hosts.client<\/span><\/div>\n

Example file<\/span>: hosts.dev <\/span>or <\/span>hosts.staging<\/span><\/p>\n

\n
\n
c.<\/span>Put your server under the appropriate group inside the file and save<\/span><\/div>\n
\n
\n
i.<\/span>Testmachine1 ansible_host=192.168.60.10<\/em><\/span><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

Running your playbook: <\/span><\/strong><\/p>\n

\n
\n
1.<\/span>You must run your play book from inside parent ansible directory<\/span><\/strong><\/div>\n<\/div>\n<\/div>\n

.<\/span><\/span><\/p>\n

\n
\n
2.<\/span>Now there is a playbook called <\/span><\/strong>chronocollector.yml<\/span><\/a> in the <\/span>ansible<\/span> directory which simply calls the <\/span>chronocollector<\/span> role inside the <\/span>ansible\/roles\/chronocollector<\/span> directory, where the role should be living.<\/span><\/strong><\/div>\n

– <\/span>hosts<\/span>: <\/span>all<\/span><\/p>\n

\u00a0\u00a0<\/span>gather_facts<\/span>: <\/span>no<\/span><\/p>\n

\u00a0\u00a0<\/span>vars_prompt<\/span>:<\/span><\/p>\n

\u00a0 – <\/span>name<\/span>: <\/span>api_key<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0<\/span>prompt<\/span>: <\/span>Enter the API key<\/span><\/p>\n

\u00a0\u00a0<\/span>roles<\/span>: <\/span><\/p>\n

\u00a0 \u00a0 – <\/span>role<\/span>: <\/span>chronocollector<\/span><\/p>\n

.<\/span><\/span><\/p>\n

Command:<\/span><\/strong><\/p>\n

ansible-playbook -i inventory\/dev\/hosts.dev chronocollector.yml -u nickadmin -Kkb –ask-become –limit=’testmachine3′<\/span><\/strong><\/p>\n

\n
\n
\u25cf<\/span>-i : This flag tells ansibe-playbook command which hosts file to use, these are always defined by customer like <\/span>hosts.dev<\/span><\/strong> or <\/span>hosts.staging<\/span><\/strong><\/div>\n<\/div>\n
\n
\u25cf<\/span>-u : this is the ssh_user you will be connecting to the servers with<\/span><\/div>\n<\/div>\n
\n
\u25cf<\/span>-Kkb : this tells ansible that you will be using sudo su \u2013 for the ssh_user when running all role\/tasks<\/span><\/div>\n<\/div>\n
\n
\u25cf<\/span>-ask-beocme : is saying become root<\/span><\/div>\n<\/div>\n
\n
\u25cf<\/span>-limit=\u2019server\u2019 : this allows you to segement which server you want to run the playbook against.<\/span><\/div>\n<\/div>\n<\/div>\n

.<\/span><\/span><\/p>\n

Successful run: <\/span><\/p>\n

.<\/span><\/span><\/p>\n

Notice: It asks you for the API key at runtime.<\/span><\/p>\n

ntailor@jumphost:~\/ansible2$ ansible-playbook -i ansible\/inventory\/dev\/hosts.dev chronocollector.yml -u nicktadmin -Kkb –ask-become –limit=’testmachine3′<\/span><\/p>\n

SSH password: <\/span><\/p>\n

BECOME password[defaults to SSH password]: <\/span><\/p>\n

Enter the API key: <\/span><\/p>\n

.<\/span><\/span><\/p>\n

PLAY [all] ***************************************************************************************************************************************************************************************************************<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : download node collector] *************************************************************************************************************************************************************************<\/span><\/p>\n

ok: [testmachine3]<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : move collector to \/usr\/local\/bin] ****************************************************************************************************************************************************************<\/span><\/p>\n

ok: [testmachine3]<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : mkdir directory \/etc\/chronocollector] ************************************************************************************************************************************************************<\/span><\/p>\n

ok: [testmachine3]<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : Copy default config.yml to \/etc\/chronocollector\/] ************************************************************************************************************************************************<\/span><\/p>\n

ok: [testmachine3]<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : Touch again the same file, but do not change times this makes the task idempotent] ***************************************************************************************************************<\/span><\/p>\n

changed: [testmachine3]<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : Ensure API key is present in config file] ********************************************************************************************************************************************************<\/span><\/p>\n

changed: [testmachine3]<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : Change file ownership, group and permissions apitoken file to secure it from prying eyes other than root] ****************************************************************************************<\/span><\/p>\n

changed: [testmachine3]<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : Check that the service file \/etc\/systemd\/system\/collector.service exists] ************************************************************************************************************************<\/span><\/p>\n

ok: [testmachine3]<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : Include add systemd task if service file does not exist] *****************************************************************************************************************************************<\/span><\/p>\n

included: ansible\/roles\/chronocollector\/tasks\/systemd.yml for testmachine3<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : Create startup file for collector in systemd] ****************************************************************************************************************************************************<\/span><\/p>\n

changed: [testmachine3]<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : Create systemd collector.service] ****************************************************************************************************************************************************************<\/span><\/p>\n

changed: [testmachine3]<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : check whether custom line exists] ****************************************************************************************************************************************************************<\/span><\/p>\n

changed: [testmachine3]<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : Start Collector Service via systemd] *************************************************************************************************************************************************************<\/span><\/p>\n

changed: [testmachine3]<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : Show status of collector from systemd] ***********************************************************************************************************************************************************<\/span><\/p>\n

changed: [testmachine3]<\/span><\/p>\n

.<\/span><\/span><\/p>\n

TASK [chronocollector : debug] *******************************************************************************************************************************************************************************************<\/span><\/p>\n

ok: [testmachine3] => {<\/span><\/p>\n

“status.stdout”: ” Active: failed (Result: exit-code) since Thu 2022-05-19 10:31:49 BST; 315ms ago”<\/span><\/p>\n

}<\/span><\/p>\n

.<\/span><\/span><\/p>\n

PLAY RECAP ***************************************************************************************************************************************************************************************************************<\/span><\/p>\n

testmachine3 : ok=15 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 <\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

https:\/\/chronosphere.io\/ – Third Party Cloud Monitoring Solution Chronocollector: – https:\/\/github.com\/Perfect10NickTailor\/chronocollector This role deploys the chronocollector management service which sends the data to domain.chronosphere.io For those of you who don\u2019t know what it is. Its basically a cloud monitoring tool that scrapes data on your instances and then you can create dashboards or even export the data to promethus to makeRead More …<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[51,135,138],"tags":[],"class_list":["post-1469","post","type-post","status-publish","format-standard","hentry","category-ansible","category-apis","category-linux"],"_links":{"self":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/1469","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/comments?post=1469"}],"version-history":[{"count":13,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/1469\/revisions"}],"predecessor-version":[{"id":1484,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/1469\/revisions\/1484"}],"wp:attachment":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/media?parent=1469"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/categories?post=1469"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/tags?post=1469"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Example: of ansible\/<\/span><\/strong>chronocollector.yml<\/span><\/strong><\/a><\/p>\n<\/div>\n<\/div>\n