Jenkins pipeline - refering to SSH Keys in ansible and Terraform - azure

Question

I have a ansible playbook which refers to ssh key data for adding the public key to the authorized_host file when it is created, here is an extract.
vars:
vm1:
ssh_key_var: '{{ ssh_key_data }}'
tasks:
- name: Create VM
azure_rm_virtualmachine:
resource_group: '{{ resource_group1.name }}'
name: '{{ vm1.name }}'
vm_size: '{{ vm1.size }}'
admin_username: '{{ vm1.admin_username }}'
ssh_password_enabled: false
ssh_public_keys:
- path: '/home/{{ vm1.admin_username }}/.ssh/authorized_keys'
key_data: '{{ vm1.ssh_key_var }}'
network_interfaces: '{{ network_interface1.name }}'
image: '{{ vm1.image }}'
Normally this is pretty straight forward - I'd run on my laptop and have key locally, maybe get the data referred to as a file.
I tried running the playbook with secret text in a jenkins pipeline as using an environmental variable secret text "AZURE_AUTHORIZED_KEY" for the public key, which I store in credentials:
stage('Deploy server') {
agent {
docker { image 'my_ansible_container:latest' }
}
environment {
AZURE_CLIENT_ID = credentials('AZURE_CLIENT_ID_ANSIBLE')
AZURE_SECRET = credentials('AZURE_SECRET_ANSIBLE')
AZURE_SUBSCRIPTION_ID = credentials('AZURE_SUBSCRIPTION_ID_ANSIBLE')
AZURE_TENANT = credentials('AZURE_TENANT_ANSIBLE')
AUTHORIZED_KEY = credentials('AZURE_AUTHORIZED_KEY')
}
steps {
// deploy server
sh "ansible-playbook playbook.yml --extravars \"ssh_key_data=${AUTHORIZED_KEY}\""
}
}
When I add the public key as a var in the playbook it all works fine, but I dont want to store keys in the repo, even if they are public keys and it's a private repo.
When I import as env_var it does not seem to take the value and 'cascade' it in to the vars as expected. Anyone have a solution to this kind of problem - is my approach wrong?
Thanks

Answer 1

There was nothing wrong, expect typing errors, bit of closing quotes also. Here is the syntax for those who may be interested. Note I am using this as a intermediate solution where I want to move secrets out of jenkins and into something like hashicorp vault.
I also renamed some of my env vars to be a bit more, representative:
}
environment {
AZURE_CLIENT_ID = credentials('AZURE_CLIENT_ID_ANSIBLE')
AZURE_SECRET = credentials('AZURE_SECRET_ANSIBLE')
AZURE_SUBSCRIPTION_ID = credentials('AZURE_SUBSCRIPTION_ID_ANSIBLE')
AZURE_TENANT = credentials('AZURE_TENANT_ANSIBLE')
AUTHORIZED_KEY = credentials('AZURE_AUTHORIZED_KEY')
AUTHORIZED_PASSWORD = credentials('AZURE_AUTHORIZED_PASSWORD')
}
steps {
// deploy a boot strap server
sh "ansible-playbook playbook.yml \
--extra-var 'admin_password_var=${AUTHORIZED_PASSWORD}' \
--extra-var 'ssh_public_key_var=${AUTHORIZED_KEY}'"
}
and an extract of the playbook
vars:
vm1:
admin_password: '{{ admin_password_var }}'
ssh_public_key: '{{ ssh_public_key_var }}'
- name: Create VM
azure_rm_virtualmachine:
resource_group: '{{ resource_group1.name }}'
name: '{{ vm1.name }}'
vm_size: '{{ vm1.size }}'
admin_username: '{{ vm1.admin_username }}'
admin_password: '{{ vm1.admin_password }}'
ssh_password_enabled: false
ssh_public_keys:
- path: '/home/{{ vm1.admin_username }}/.ssh/authorized_keys'
key_data: '{{ vm1.ssh_public_key }}'
network_interfaces: '{{ network_interface1.name }}'
image: '{{ vm1.image }}'
Note I have chosen variables that may appear duplicative, but I prefer the approach given it allows me to trace back the source and not get confused which one is being used.
There may be other approaches, but this is a working one, and simple as well; which strikes me as an attractive combination!