Specify vault secret using variables

Archives Ansible Project
1

Hi all,

I’m new to Ansible and use it to add servers deployed using vRealize Automation 8 to AD domain. When the user deploys a new server they select which domain the server belongs to. Based on the domain selected I need to select the correct ad credential to join the server to the domain.

I’ve created a vault that contains the passwords for the account with permission to add the server to the domain:
vault_domain1.com: password1
vault_domain2.com: password2

If I in the playbook specifies one of the vault secrets it works for that domain:
domain_admin_password: “{{ vault_domain1.com }}”

But I need that the vault secret used in the playbook is dependent on the domain the user selects. If the user selects domain2.com, the vault secret used in the playbook should be “vault_domain2.com”.

In the vRA blueprint I’ve added a host variable that sets the vault secret based on the domain that the user selects:
domain_join_password: vault_${input.domain}

I’ve verified that the value for domain_join_password is vault_domain1.com or vault_domain2.com depending on what the user selects. The problem I’ve not been able to solve is how to get this in the playbook as a variable. I’ve tried the following that doesn’t work.
domain_admin_password: “{{ domain_join_password }}”
domain_admin_password: “{{ {{ domain_join_password }} }}”

I’ve searched for a solution to this but my search skills are failing me. Is it possible to achieve what I’m trying to do? Any help will be greatly appreciated.

Thanks.

2

domain_join_password: “{{ lookup(‘vars’, ‘vault_’ ~ input.domain) }}”

3

Thanks for replying.

I change the host variable in vRA to "domain_join_password: “{{ lookup(‘vars’, ‘vault_’ ~ ${input.domain}) }}”. After doing it it fails with this error:
Failed to run Ansible Ad hoc command - sudo ansible localhost -m lineinfile -a dest=/opt/ansible/vra/host_vars/sditest9/vra_user_host_vars_f6f19a39-6433-496f-93c0-85230e40ceb4.yml line='domain: domain1.com
dns1: 8.8.8.8
domain_ou: ou=servers,DC=domain1,DC=com
servername: sditest9
domain_join_password: “{{ lookup(‘vars’, ‘vault_’ ~ domain1.com) }}”
ansible_user: Administrator
ansible_password: password
ansible_winrm_transport: ntlm
ansible_winrm_port: 5985
’ create=yes insertafter=EOF state=present --connection=local. Refer to logs at var/tmp/vmware/provider/user_defined_script/f6f19a39-6433-496f-93c0-85230e40ceb4 on Ansible Control Machine for more details.

I guess that vRA might confuse things a bit from “standard” Ansible. As you can see, the domain_join_password does get the correct but playbooks does not run.

onsdag 2. februar 2022 kl. 17:39:22 UTC+1 skrev uto...@gmail.com: