Ansible variable from github actions secret

Viewed 982

I'm trying to use Githubactions secrets in my ansible playbooks that will then be passed to templates, but there is no lookup plugin for GHA. This does not work:

- hosts: the-host
  vars:
    influxdb_pass: "{{ lookup('env', 'secret.INFLUXDB_PASS' }}"

My workaround is to expose the secrets through GHA environment variables and just use the ansible env lookup plugin:

name: Pull Request - Ansible
on:
  pull_request:
    branches:
      - master
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v1
      - name: Config updates
        env:
          INFLUXDB_PASS: ${{ secrets.INFLUXDB_PASS }}
- hosts: the-host
  vars:
    influxdb_pass: "{{ lookup('env', 'INFLUXDB_PASS' }}"

The problem is I manage plenty of secrets and it is annoying having to:

  1. Add the secret in the repo settings
  2. Define the variable in ansible-playbook
  3. Explicitly expose the secrets through environment variables in the GHA workflow.

When in other CI tools such as Gitlab you don't need to do the explicit secret expose, you can consume secrets directly as env vars.

Does anyone have advice on a better approach for GHA?

0 Answers
Related