Skip to content

README.md

Latest commit

 

History

History
120 lines (78 loc) · 6.4 KB

README.md

File metadata and controls

120 lines (78 loc) · 6.4 KB
Raw

Apache 2.0 License Community Supported CyberArk Certificate Manager, Self-Hosted 17.3+ & CyberArk Certificate Manager, SaaS
To report a problem or share an idea, use Issues; and if you have a suggestion for fixing the issue, please include those details, too. In addition, use Pull Requests to contribute actual bug fixes or proposed enhancements. We welcome and appreciate all contributions. Got questions or want to discuss something with our team? Join us on Slack!

Venafi Collection for Ansible

This collection, called machine_identity, uses CyberArk Certificate Manager, Self-Hosted or CyberArk Certificate Manager, SaaS to provide keys and certificates to Ansible solutions that require machine identity management.

If you like this collection, please give us a rating on Ansible Galaxy.

Requirements

Review the CyberArk prerequisites, and depending on the source:

Ansible Automation Platform

pip install vcert --upgrade

Ansible Galaxy

  • Install both Ansible and VCert-Python (v0.18.0 or higher) using pip:
pip install ansible vcert --upgrade

Python version compatibility

This collection depends on vcert-python. Due to this, collection requires Python 3.6 or greater.

CyberArk has also announced the end of support for Python less than 3.6. As such support for Python less than 3.6 by this collection has been deprecated.

Ansible version compatibility

This collection has been tested against the following Ansible versions: >= 2.13

Installing this collection

You can install the venafi.machine_identity collection with the Ansible Galaxy CLI:

ansible-galaxy collection install venafi.machine_identity

You can also include it in a requirements.yml file and install it with ansible-galaxy collection install -r requirements.yml, using the format:

---
collections:
  - name: venafi.machine_identity

A specific version of the collection can be installed by using the version keyword in the requirements.yml file:

---
collections:
  - name: venafi.machine_identity
    version: 0.10.0

The python module dependencies are not installed by ansible-galaxy. They can be manually installed using pip:

pip install --require-hashes -r requirements.txt

requirements.txt is a generated lockfile. Do not edit it directly. To change or upgrade a dependency, edit requirements.in and run make lock (requires Docker) to regenerate it.

or:

pip install vcert ansible cryptography

Collection Contents

Roles

Security Considerations

Remote Execution Mode

WARNING: The certificate_remote_execution, ssh_remote_execution, and ssh_ca_remote_execution options are disabled by default for security reasons. When enabled, these options cause Ansible to transmit your Venafi platform credentials (url, user, password, access_token, token, and the NGTS service-account credentials client_id, client_secret, token_url, tsg_id) to every managed host in your inventory. These credentials are not scoped to individual hosts—they can request certificates for any name allowed by the Venafi zone.

Risk: If any managed host is compromised, an attacker can extract these zone-wide credentials from temporary files and use them to request trusted certificates for all servers in your infrastructure.

Recommendations:

  • Only enable remote execution in highly trusted environments where all managed hosts are secured to the same level as your Ansible controller.
  • Consider using the default local execution mode (*_remote_execution: false), which keeps credentials on the Ansible controller and only copies certificate artifacts to managed hosts.
  • If remote execution is required, implement additional controls such as per-host credentials with narrowly-scoped policies.

Version History

Check version history here

Support

Only the latest release of this collection is supported.

As Red Hat Ansible Certified Content, this collection is entitled to support through the Ansible Automation Platform (AAP) using the Create issue button in the top right corner. If a support case cannot be opened with Red Hat and the collection has been obtained either from Galaxy or GitHub, you can raise a GitHub Issue directly with the developers here or get community help available on the Ansible Forum.

License

Copyright © Venafi, Inc. and CyberArk Software Ltd. ("CyberArk")

This solution is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.

Please direct questions/comments to mis-opensource@cyberark.com