{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible/issues/13927","labels_url":"https://api.github.com/repos/ansible/ansible/issues/13927/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible/issues/13927/comments","events_url":"https://api.github.com/repos/ansible/ansible/issues/13927/events","html_url":"https://github.com/ansible/ansible/issues/13927","id":126988146,"number":13927,"title":"Feature Idea: get SSH key from credstash/other lookups","user":{"login":"jagibson","id":5667478,"avatar_url":"https://avatars.githubusercontent.com/u/5667478?v=3","gravatar_id":"","url":"https://api.github.com/users/jagibson","html_url":"https://github.com/jagibson","followers_url":"https://api.github.com/users/jagibson/followers","following_url":"https://api.github.com/users/jagibson/following{/other_user}","gists_url":"https://api.github.com/users/jagibson/gists{/gist_id}","starred_url":"https://api.github.com/users/jagibson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jagibson/subscriptions","organizations_url":"https://api.github.com/users/jagibson/orgs","repos_url":"https://api.github.com/users/jagibson/repos","events_url":"https://api.github.com/users/jagibson/events{/privacy}","received_events_url":"https://api.github.com/users/jagibson/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-01-16T00:52:23Z","updated_at":"2016-01-18T22:36:34Z","closed_at":"2016-01-18T22:36:34Z","body":"Issue Type:\r\nFeature Idea\r\n\r\nSummary:\r\nIt would be very handy to be able to pull SSH private keys from credstash or other lookup providers.\r\n\r\nSome benefits (credstash):\r\n- Keys would no longer have to be permanently stored on the same host that Ansible is run from.\r\n- Don't have to worry about weak vault passwords.\r\n- Versionable\r\n- No need to store keys in source control (via vault)\r\n\r\nCaveats:\r\nOpenSSH requires that a key be loaded from a file whether you are using straight-up ssh or the ssh-agent.  As such, the key should be downloaded to the Ansible temp directory and deleted at the end of the play.  Ideally if the run is cancelled with Ctrl-C there should still be an escape sequence to remove the key file.\r\n\r\nPossible implementation:\r\nProbably the easiest way to do this would be to add a 'ansible_ssh_private_key' host parameter that would take input and write it to a temporary key file for use.  This would also allow flexibility for loading keys from other non-file methods.  The downside is that someone could do something dumb like put their private key directly into a play- but that's not really much different from using ansible_ssh_pass.\r\n\r\nExample play:\r\n```\r\n- hosts:\r\n  vars:\r\n    - ansible_ssh_private_key: {{ lookup('credstash', 'my-other-password', region='us-west-1') }}\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/ansible/ansible/issues/comments/172672476","html_url":"https://github.com/ansible/ansible/issues/13927#issuecomment-172672476","issue_url":"https://api.github.com/repos/ansible/ansible/issues/13927","id":172672476,"user":{"login":"bcoca","id":836171,"avatar_url":"https://avatars.githubusercontent.com/u/836171?v=3","gravatar_id":"","url":"https://api.github.com/users/bcoca","html_url":"https://github.com/bcoca","followers_url":"https://api.github.com/users/bcoca/followers","following_url":"https://api.github.com/users/bcoca/following{/other_user}","gists_url":"https://api.github.com/users/bcoca/gists{/gist_id}","starred_url":"https://api.github.com/users/bcoca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcoca/subscriptions","organizations_url":"https://api.github.com/users/bcoca/orgs","repos_url":"https://api.github.com/users/bcoca/repos","events_url":"https://api.github.com/users/bcoca/events{/privacy}","received_events_url":"https://api.github.com/users/bcoca/received_events","type":"User","site_admin":false},"created_at":"2016-01-18T22:36:34Z","updated_at":"2016-01-18T22:36:34Z","body":"you can already do this, not only with credstash, but with vault and other lookups for secure data."}}