How to pass credentials to a playbook deploying VMWare VMs

[slekkus75]

Hi, cannot find on how to pass the credentials to a playbook. Using this collection: https://docs.ansible.com/ansible/latest/collections/community/vmware/vmware_guest_module.html
I added a (non-db) cred under credentials, but this is a key based value. What does it pass? Or should I do:
vccenter_host = cred.url
vccenter_uname = cred.name
vccenter_upass = cred.pass

regards..

[ansibleguy76]

what exactly is not working?

you can pass the stored credentials in several ways. with the form property "credentials" or with a field called credentials or by adding "asCredential" property to a field. each time you pass the name of the credentials and they will be injected as a dict with all properties like user, password. the password is encrypted in the database. make a simple playbook and debug the credentials object to see all the properties.

[ansibleguy76]

https://ansibleforms.com/faq/#pass-credentials

[ansibleguy76]

credentials:
testcred: testcredvar

this would indicate that you have a credential stored called testcredvar and you pass it to the playbook as dict testcred

[ansibleguy76]

don't look at the args i pass. i store the extravars as json files and delete them after. this to avoid encoding issues.

simply do

debug: var=testcreds

[slekkus75]

Oooh.. that did the trick. Thanks a bunch!

Same goes for ansible become user/pass "ansibleCredentials"?
Add a cred in DB, then pass it with above?

[ansibleguy76]

correct. ansibleCredentials will be used to authenticate against your host

[slekkus75]

Lacking ansible skills or missing a dev background or I must as be dumb as they come :)
Went through documentation, issues, faq and discussions but it just doesn't click.

[ansibleguy76]

so, store credentials and give them a name. example vcenter

then you can inject them as extravars by either:

forms property credentials

credentials:
  vmware: vcenter

this injects the vcenter credentials and expose them as the extravar dict variable vmware

then you can do

• vmware.user
• vmware.password
• vmware.host, port, ...

just use them as variables

but sometimes you want to choose the credential name from within the form, so you can then make a text field or expression or enum field and its value will be the credential name. simply add the property asCredential to the field.

name: vmware
type: enum
asCredential: true
default: __auto__
values:
- vcenter1
- vcenter2
- vcenter3
# will make a dropdown box to choose a credential 

name: vcenter_number
type: number
minValue: 1
maxValue: 3

name: vmware2
hide: true
type: expression
runLocal: true
asCredential: true
expression: "'vcenter$(vcenter_number)'"
#will inject credential vcenter1, vcenter2 or vcenter3 based on the number chosen before

and note that most form properties can also come from a field in the form (credentials, ansibleCredentials, playbook, tags, inventory,..).
simply make a field with that property name prefixed and suffixed by double underscores

example

name: __playbook__
type: text
default: myplaybook.yaml

name: __inventory__
type: enum
values:
- inventory1.yaml
- inventory2.yaml

[slekkus75]

Thanks so much for helping out. You rock!

[slekkus75]

Is there a future plan to add ssh keys as credentials?

[ansibleguy76]

i am not sure if you understand the concepts op private/public key.

generally you don't share your private key. but you mutually trust each other's public keys. the remote machines trust your public key and visa versa. your public key can be found in settings. and you can add known hosts (remote public keys) there as well.

whenever you engage ssh protocol, the keys will do its job.

[slekkus75]

Hi, I confused myself and you maybe. I now have the private key I use in the Linux VM templates set in "AF/ssh settings".

These VM templates contain the user "builder" which has a .ssh/authorized_keys containing the public key paired with the private one mentioned above.

In AF credentials I set "ansible_deploy" credential (which is user builder).

I use this in the AF form:
ansibleCredentials: ansible_deploy

Password authentication is still attempted:

TASK [Add VM as host to inventory] *********************************************
task path: /app/dist/persistent/playbooks/prov_vm_local.yml:72
creating host via 'add_host': hostname=testkey 2024-07-08 07:36:52
changed: [localhost] => changed=true 
  add_host:
    groups:
    - vmware_vms
    host_name: testkey
    host_vars:
      ansible_host: 172.16.0.224

PLAY [Configure the VM] ********************************************************

TASK [include_vars] ************************************************************
task path: /app/dist/persistent/playbooks/prov_vm_local.yml:87
ok: [testkey] => changed=false  2024-07-08 07:36:52
  ansible_facts:
    etc_hosts_values: |-
      127.0.0.1       localhost
      127.0.1.1       {{ vm_name }}
      {{ vm_ipv4_addr }}   {{ vm_name }}.{{ domainname }} {{ vm_name }}
  
      # The following lines are desirable for IPv6 capable hosts
      ::1     localhost ip6-localhost ip6-loopback
      ff02::1 ip6-allnodes
      ff02::2 ip6-allrouters
    etc_resolv_conf_values: |-
      domain {{ domainname }}
      search {{ domainname }}
      nameserver {{ vm_dns1_addr }}
      nameserver {{ vm_dns2_addr }}
  ansible_included_var_files:
  - /app/dist/persistent/playbooks/vars/baseconf_vars.yml

TASK [Generate /etc/cloud/cloud-init.disabled] *********************************
task path: /app/dist/persistent/playbooks/prov_vm_local.yml:143
<172.16.0.224> ESTABLISH SSH CONNECTION FOR USER: builder 2024-07-08 07:36:53
<172.16.0.224> SSH: EXEC sshpass -d10 ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o 'User="builder"' -o ConnectTimeout=10 -o 'ControlPath="/root/.ansible/cp/3b284ab648"' 172.16.0.224 '/bin/sh -c '"'"'echo ~builder && sleep 0'"'"''
fatal: [testkey]: FAILED! => 
  msg: Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this.  Please add this host's fingerprint to your known_hosts file to manage this host.

[ansibleguy76]

you have remote key checking enabled. either disable it or use the "known hosts" to specifically say you trust the remote host.

[ansibleguy76]

Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this. Please add this host's fingerprint to your known_hosts file to manage this host.

in your ssh command the user builder is passed so it explicitly wants to auth with username.
i would try to authenticate without username. it will then attempt the public key instead.

[slekkus75]

Been a while. Your suggestion worked. Learning here and its steep..
And still think this project is awesome :)