SOPS Ansible Execution Image

Introduction #

Today, I am excited to share how to set up an Ansible execution environment to control SOPS secrets. The Ansible execution image is a pre-built container containing all the necessary components for decrypting SOPS secrets in Ansible playbooks.

Ansible Builder #

Ansible Builder is a tool that can help with building the image

Create a working directory #

Let’s start by creating a new working directory

mkdir custom-ansible-execution; cd custom-ansible-execution

Builder definition #

Create an execution-environment.yml file. ansible-builder build container images with the definition file execution-environment.yml

In Ansible Builder, the `additional_build_steps`` configuration allows you to specify additional commands or steps to be executed during the build process. This can be useful for performing custom tasks, installing specific dependencies, or executing scripts as part of the Ansible collection build.

Highlighted code block shows how to add SOPS rpm package via additional build steps

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

version: 1
build_arg_defaults:
  EE_BASE_IMAGE: 'registry.redhat.io/ansible-automation-platform-22/ee-supported-rhel8:latest'
additional_build_steps:
  prepend: |
    RUN rpm -i https://github.com/mozilla/sops/releases/download/v3.7.3/sops-3.7.3-1.x86_64.rpm && \
      sops -v && \
      mkdir -p /home/runner/.config/sops/age    
dependencies:
  galaxy: requirements.yml

Ansible collections #

Create and add the SOPS collection to the requirements.yml

collections:
  - community.sops

Create context files #

ansible-buidler create Creates a build context, which can be used by podman to build an image.

ansible-builder create
Complete! The build context can be found at: custom-ansible-execution/context

Build and push image #

Build the container image using Podman and push to a registry

podman build -f context/Containerfile -t localhost/custom-ee:1.0 context
podman push ...

Execution environments in jobs #

Follow this guide to add an execution environment in Jobs

Mount options #

Mount the SOPS keys to decrypt using Execution environment mount options

Copy sops keys #

Finally, SSH into the ansible controller and change to awx user to copy the key into the appropriate directory

ssh aap-controller
sudo su - awx
sudo mkdir -p /var/lib/awx/.sops-key
sudo mv keys.txt /var/lib/awx/.sops-key 

Thank you for taking the time to read my blog post. Until next time, take care!