👋 Introduction
Another aspect of building an execution environment is not adding authentication tokens to your ansible.cfg file for security purposes.
In this challenge, we will use an ansible.cfg file that doesn’t have tokens and instead use environment variables in the EE definition to download the collections.
A quick note before we dive in — the editor we are using is VS Code and it may be unfamiliar for some folks.
We will keep the instructions simple enough and gradually build upon what we are doing in each challenge.
If you are confused at any time, there is a folder called solution-definition adjacent to execution-environment.yml which will have the solution for each challenge.
You can copy and replace content for your current definition file if you are unable to solve any YAML errors.
|
☑️ Task - Definition file from last challenge
On the VS Code tab on the left side, you will see that we have a directory opened called minimal-downstream-from-hub-certs and this directory has a file called execution-environment.yml.
This is the same file from the last challenge when we pulled the collection from Automation Hub after fixing the certificate error. This will be the starting point for this challenge.
For this task:
- Verify the content of the definition file to ensure it matches what we learned in the last challenge.
- Also verify that the ansible.cfg file in the challenge does not include any tokens now.
☑️ Task - Add an ARG to prepend_galaxy section
Add a line above or below the following line:
- COPY _build/configs/ansible.cfg /etc/ansible/ansible.cfg
Add this line:
- ARG ANSIBLE_GALAXY_SERVER_RH_CERTIFIED_REPO_TOKEN
We are telling ansible-builder to pick this token from the local machine.
To do so, we will need to first populate this token on the local machine — let’s do that in the next task.
☑️ Task - Populate local machine with the hub token
Go to the Automation Hub tab and log in using the credentials below:
Username:
adminPassword:ansible123!
Navigate to Collections → API token management, then click on Load token.
Once loaded, copy the token to your clipboard:
Now, return to the VS Code tab and open a new terminal. Once done, type the following command to populate the token locally:
export ANSIBLE_GALAXY_SERVER_RH_CERTIFIED_REPO_TOKEN=<paste_token_here>
Make sure to paste the token after the = sign in the above command.
|
☑️ Task - Let’s build the EE
Now that you have populated the token locally, let’s try rebuilding our execution environment.
Run the following command:
ansible-builder build -v 3 --build-arg ANSIBLE_GALAXY_SERVER_RH_CERTIFIED_REPO_TOKEN
The above command will pass the local token to the definition file and make the token available to the build process.
Hopefully, if you have done everything correctly, you should have your new execution environment.
This way, you didn’t have to save the token inside your ansible.cfg file — which is advantageous when saving the EE definition to source control systems like Git, as you won’t be exposing your Automation Hub token.
Try the next tasks yourself: - Change the name of the EE - Push it to your Automation Hub
This was the final challenge, and hopefully this lab has helped you understand the changes in ansible-builder v3 and its benefits.