https://github.com/bitwarden/sm-ansible
Ansible integration for Secrets Manager
https://github.com/bitwarden/sm-ansible
Last synced: about 1 year ago
JSON representation
Ansible integration for Secrets Manager
- Host: GitHub
- URL: https://github.com/bitwarden/sm-ansible
- Owner: bitwarden
- License: gpl-3.0
- Created: 2023-12-07T16:48:08.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2025-06-25T10:15:26.000Z (about 1 year ago)
- Last Synced: 2025-06-26T07:47:48.672Z (about 1 year ago)
- Language: Python
- Size: 212 KB
- Stars: 10
- Watchers: 14
- Forks: 4
- Open Issues: 12
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- License: LICENSE.txt
- Codeowners: .github/CODEOWNERS
- Security: SECURITY.md
Awesome Lists containing this project
README
# Bitwarden Secrets Manager Collection
Securely retrieve secrets from Bitwarden Secrets Manager and use them in your Ansible playbooks.
## Getting started
### Install dependencies
The Bitwarden Secrets Manager Collection requires the `bitwarden-sdk` package. You can install it by
running the following command:
```bash
pip install bitwarden-sdk
```
### Install the collection
You can install the Bitwarden Secrets Manager Collection by running:
```bash
ansible-galaxy collection install bitwarden.secrets
```
### Update your playbook
Before running your playbook, you need to set the `BWS_ACCESS_TOKEN` environment variable:
```bash
# the line below will prevent lines with leading spaces from being saved to bash history
export HISTCONTROL=ignorespace
# the space in the line below keeps your access token out of bash history
export BWS_ACCESS_TOKEN=
```
Alternatively, you may supply the access token as a parameter to the `bitwarden.secrets.lookup`
plugin:
```yaml
- name: A simple example
hosts: localhost
vars_prompt:
- name: "your_access_token"
prompt: "Enter your Bitwarden access token"
private: yes
vars:
some_secret: "{{ lookup('bitwarden.secrets.lookup', '', access_token=your_access_token) }}"
```
> [!Note]\
> We are using a `vars_prompt` to avoid storing the access token in the playbook. While
> there are many ways to pass the access token to the lookup plugin, we recommend against storing it
> in the playbook itself.
For more information on how to use the Bitwarden Secrets Manager Collection, see the
[documentation](https://bitwarden.com/help/ansible-integration).
### Run your playbook
Once you've updated your playbook to use the Bitwarden Secrets Manager lookup plugin, you can run it
with the `ansible-playbook` command:
```bash
ansible-playbook
```
#### macOS
If your Ansible controller is running macOS, you may need to set the following environment variable
to avoid an error related to fork safety:
```bash
export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
```
See
[running on macos as a control node](https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#running-on-macos-as-a-control-node)
and [this GitHub issue](https://github.com/ansible/ansible/issues/49207) for more details.