# Pass custom credential values to dynamic yaml inventory

**URL:** <https://forum.ansible.com/t/pass-custom-credential-values-to-dynamic-yaml-inventory/8396>\
**Category:** Get Help\
**Tags:** awx\
**Created:** [September 10, 2024, 12:41pm UTC](https://forum.ansible.com/t/pass-custom-credential-values-to-dynamic-yaml-inventory/8396 "2024-09-10T12:41:07Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![jen.wirth](https://avatars.discourse-cdn.com/v4/letter/j/3ab097/32.png) [@jen.wirth](https://forum.ansible.com/u/jen.wirth)\
**Post date:** [September 10, 2024, 12:41pm UTC](https://forum.ansible.com/t/pass-custom-credential-values-to-dynamic-yaml-inventory/8396/1 "2024-09-10T12:41:07Z")

</div>

I made a custom credential `Vault-Token`

For the Injector configuration it has

```yaml
extra_vars:
  ansible_hashi_vault_url: '{{ vault_address }}'
  ansible_hashi_vault_token: '{{ secret_id }}'

```

Inside my inventory source i am trying to use a [vault lookup](https://docs.ansible.com/ansible/latest/collections/community/hashi_vault/hashi_vault_lookup.html#examples)

```yaml
plugin: community.hrobot.robot
hetzner_user: …
hetzner_password: "{{ lookup('community.hashi_vault.hashi_vault', 'cloud/hetzner/hrobot/webservice_password) }}"

```

However it seems the execpted vars are not set (the vault lookup supports vars such as ` ansible_hashi_vault_url`, but i don’t think these are set.

The error is **Required option url was not set… Required option url was not set**

i also tried `"{{ lookup('community.hashi_vault.hashi_vault', 'cloud/hetzner/hrobot/webservice_password',url=extra_vars.ansible_hashi_vault_url, token=extra_vars.ansible_hashi_vault_token) }}"`, which also did not work.

Using `env` in the custom credential does not work either, because i am not allowed to use `ANSIBLE_*` env vars.

How does one use custom credentials in an inventory yaml file?

tx.,

---

<div class="post-metadata">

**Author:** ![jen.wirth](https://avatars.discourse-cdn.com/v4/letter/j/3ab097/32.png) [@jen.wirth](https://forum.ansible.com/u/jen.wirth)\
**Post date:** [September 10, 2024, 1:27pm UTC](https://forum.ansible.com/t/pass-custom-credential-values-to-dynamic-yaml-inventory/8396/2 "2024-09-10T13:27:45Z")

</div>

~~something is happening, not sure what yet, but i a getting a " **401 UNAUTHORIZED (Unauthorized)**"~~

EDIT: Please ignore, this was an unrelated syntax related error

---

<div class="post-metadata">

**Author:** ![jen.wirth](https://avatars.discourse-cdn.com/v4/letter/j/3ab097/32.png) [@jen.wirth](https://forum.ansible.com/u/jen.wirth)\
**Post date:** [September 10, 2024, 1:33pm UTC](https://forum.ansible.com/t/pass-custom-credential-values-to-dynamic-yaml-inventory/8396/3 "2024-09-10T13:33:04Z")

</div>

~~no, because to test if the vars are passed on, i set the URL to a bogus one, and i still got a 401 and not a 404.~~

EDIT: Please ignore, this was an unrelated syntax related error

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [September 10, 2024, 1:53pm UTC](https://forum.ansible.com/t/pass-custom-credential-values-to-dynamic-yaml-inventory/8396/4 "2024-09-10T13:53:44Z")

</div>

It looks like a bug in the inventory plugin. It does not use the extra vars. Changing [this line](https://github.com/ansible-collections/community.hrobot/blob/main/plugins/inventory/robot.py#L131) from `self.templar = Templar(loader=loader)` to `self.templar = Templar(loader=loader, variables=self._vars)` may fix it (untested).

---

<div class="post-metadata">

**Author:** ![jen.wirth](https://avatars.discourse-cdn.com/v4/letter/j/3ab097/32.png) [@jen.wirth](https://forum.ansible.com/u/jen.wirth)\
**Post date:** [September 11, 2024, 7:54am UTC](https://forum.ansible.com/t/pass-custom-credential-values-to-dynamic-yaml-inventory/8396/5 "2024-09-11T07:54:20Z")

</div>

Thanks for your reply.

We have been trying the patch you mentioned. However, the vars such as `ansible_hashi_vault_addr` are still not available in the yaml file. We tried prefixing with `extra_vars.` (such as `extra_vars.ansible_hashi_vault_addr`), but that also resulted in **undefined** -errors.

---

<div class="post-metadata">

**Author:** ![jen.wirth](https://avatars.discourse-cdn.com/v4/letter/j/3ab097/32.png) [@jen.wirth](https://forum.ansible.com/u/jen.wirth)\
**Post date:** [September 11, 2024, 9:05am UTC](https://forum.ansible.com/t/pass-custom-credential-values-to-dynamic-yaml-inventory/8396/6 "2024-09-11T09:05:50Z")

</div>

A colleague of mine found a workable solution using env vars.

The custom credential uses the following for its **Injector configuration** :

```yaml
env:
  VAULT_URL: '{{ vault_address }}'
  VAULT_ADDR: '{{ vault_address }}'
  VAULT_ROLE_ID: '{{ role_id }}'
  VAULT_SECRET_ID: '{{ secret_id }}'
  VAULT_AUTH_METHOD: approle

```

The inventory file then uses nested lookups:

```yaml
hetzner_password: |
  "{{ lookup('community.hashi_vault.hashi_vault',
       'cloud/hetzner/hrobot/webservice_password', 
       url=lookup('env', 'VAULT_URL'), 
       role_id=lookup('env', 'VAULT_ROLE_ID'), 
       secret_id=lookup('env', 'VAULT_SECRET_ID'), 
       auth_method=lookup('env', 'VAULT_AUTH_METHOD') ) }}"

```

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [September 11, 2024, 12:09pm UTC](https://forum.ansible.com/t/pass-custom-credential-values-to-dynamic-yaml-inventory/8396/7 "2024-09-11T12:09:56Z")

</div>

Glad you found a solution. I’d still consider that the plugin doesn’t support extra vars a bug, here’s an example of how it should work (using a different inventory plugin, which has an option to enable --extra-vars).

```yaml
# test_constructed.yml 
plugin: ansible.builtin.constructed
strict: true # give an error for undefined variables
compose:
  test_var: extra_vars.foo
use_extra_vars: true

```

```yaml
# extra_vars.yml 
extra_vars:
  foo: bar

```

File-based extra vars need to be passed to `--extra-vars` with a `@` prefix:

```auto
$ ansible-inventory -i host1, -i test_constructed.yml --list --extra-vars @extra_vars.yml
{
    "_meta": {
        "hostvars": {
            "host1": {
                "extra_vars": {
                    "foo": "bar"
                },
                "test_var": "bar"
            }
        }
    },
    "all": {
        "children": [
            "ungrouped"
        ]
    },
    "ungrouped": {
        "hosts": [
            "host1"
        ]
    }
}

```

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [September 11, 2024, 3:18pm UTC](https://forum.ansible.com/t/pass-custom-credential-values-to-dynamic-yaml-inventory/8396/8 "2024-09-11T15:18:31Z")

</div>

Another issue is that most configuration items in inventory do not support templating (constructed derivatives being the exception). [config options templatable by bcoca · Pull Request #79244 · ansible/ansible · GitHub](https://github.com/ansible/ansible/pull/79244)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [October 11, 2024, 3:18pm UTC](https://forum.ansible.com/t/pass-custom-credential-values-to-dynamic-yaml-inventory/8396/9 "2024-10-11T15:18:54Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.