Inject Secrets in Ansible Playbook Using Bitwarden Secrets Manager

This is a short post on how you can host your secrets in Bitwarden Secrets Manager and inject them into your Ansible Playbook during deployment.

Store your secrets in Bitwarden

Bitwarden’s personal free account offers their Secrets Manager tooling with few limits like 3 projects and 2 machine accounts.

Adding secrets is really easy. Head over to your secrets manager dashboard, create a new project, then on top right corner select New > Secret. Enter in your secrets and their call name, select a project and click Save.

Install Bitwarden SDK and Ansible plugin

Install Bitwarden SDK (delivered through Python’s pip package manager) and bitwarden.secrets ansible plugin on a workstation where you’ll run your Ansible playbook.

pip install bitwarden-sdk

ansible-galaxy collection install bitwarden.secrets

Let’s fetch the secrets

1. Generate a machine access token for your workstation:

2. Save that Machine Access Token to an environment variable in your active ansible deployment shell like below:

   export BWS_ACCESS_TOKEN=<ACCESS_TOKEN_VALUE>

3. Head back to the Secrets tab and copy the Secret ID values of your secrets

4. Supply the Secret IDs copied from above into the lookup plugin as seen below. The lookup plugin will pull the secrets and feed them into your playbook variables.

   Below is a snippet from my playbook of how I supplied the credentials for my NextCloud’s mysql database:

   # these are not my actual secret ID.. infact you'd still need my access token to retrieve
   - name: Install NextCloud on appserver02
   hosts: appserver02
   vars:
   	mysql_user: "{{ lookup('bitwarden.secrets.lookup', '<Secret ID>') }}" 
   	mysql_user: "{{ lookup('bitwarden.secrets.lookup', '<Secret ID>') }}"

5. Save and run your Ansible playbook as always.