50

While doing clone, push or pull of a private git repository hosted internally (e.g. on a GitLab instance) with Ansible's Git module, how do I specify username and password to authenticate with the Git server?

I don't see any way to do this in the documentation.

6
  • did you try with github's https link, it will not ask for username and password.
    – BMW
    Jun 16, 2016 at 0:12
  • What for -1 is I don't get it, anyway i clearly mentioned in the question i'm speaking about "private repository" [like gitlab] hosted internally.
    – karthik v
    Jun 16, 2016 at 4:23
  • Is it just ssh credentials? Just perform ssh-copy-id then.
    – vp_arth
    Jun 16, 2016 at 4:31
  • If it's BasicAuth, you can to pass credentials as part of url.
    – vp_arth
    Jun 16, 2016 at 4:32
  • It is not me to vote your ticket down. For your questions, did you try to upload your ssh private key to gitlab?
    – BMW
    Jun 16, 2016 at 5:06

5 Answers 5

67

You can use something like this:

---
- hosts: all 
  gather_facts: no
  become: yes
  tasks:
    - name: install git package
      apt:
        name: git

    - name: Get updated files from git repository 
      git: 
        repo: "https://{{ githubuser | urlencode }}:{{ githubpassword | urlencode }}@github.com/privrepo.git"
        dest: /tmp

Note: {{ githubpassword | urlencode }} is used here, if your password also contains special characters @,#,$ etc

Then execute the following playbook:

ansible-playbook -i hosts github.yml -e "githubuser=arbabname" -e "githubpassword=xxxxxxx"

Note: Make sure you put the credentials in ansible vaults or pass it secure way

7
  • 3
    This doesn't work if there are certain special characters, e.g. ! in the password.
    – StockB
    Jul 15, 2016 at 19:15
  • 3
    @StockB I have updated the answer please check it now with urlencode filter Jul 16, 2016 at 15:49
  • 5
    BTW you can generate token and use it instead of password. You can create token without admin rights and you can revoke it at any time. And token never contains symbols which you need to urlencode.
    – Vadym
    Apr 27, 2017 at 9:00
  • 1
    @Vadym you are right but here questioner ask about that how he/she can pass the username/password not the token. Thanks Apr 27, 2017 at 11:27
  • 1
    As pointed out by the answer of @marco-eckstein, this approach results in the password being stored in plain text in the .git/config file of the working copy. Use a different method if you do not want to leak your credentials to the target machine. Sep 19, 2022 at 13:33
40

Improving on Arbab Nazar's answer, you can avoid exposing your password in the terminal by prompting for the credentials.

playbook.yml

--- 
- name: ANSIBLE - Shop Installation 
  hosts: '{{ target }}' 

  vars_prompt: 
    - name: "githubuser" 
      prompt: "Enter your github username" 
      private: no 
    - name: "githubpassword" 
      prompt: "Enter your github password" 
      private: yes 

  [...] 

And in the task reference the variables.

task.yml

- name: Get updated files from git repository 
  git:
    repo=https://{{ githubuser | urlencode }}:{{ githubpassword | urlencode }}@github.com/privrepo.git
    dest=/tmp

This will save the password as clear text in .git/config as url of remote "origin". The following task can be used to remove it.

- name: Ensure remote URL does not contain credentials
  git_config:
    name: remote.origin.url
    value: https://github.com/privrepo.git
    scope: local
    repo: /tmp

Taken from: Clone a private git repository with Ansible (using password prompt)

2
16

While Arbab's and F. Santiago's answers are correct, there is an important caveat: With https://{{ githubuser | urlencode }}:{{ githubpassword | urlencode }}@github.com/privrepo.git as the checkout URL, Git will store your password in plaintext inside the .git/ folder. This has been mentioned in a comment, but I think it deserves more attention. You might want to do away the Git module and use raw Git, e.g.:

vars_prompt: 
  - name: "githubuser" 
    prompt: "Enter your github username" 
    private: no 
  - name: "githubpassword" 
    prompt: "Enter your github password" 
    private: yes
tasks:
  - name: Git clone
    expect:
      command: git clone https://github.com/privrepo.git /tmp
      responses:
        Username: "{{ githubuser }}" # Username is a regex
        Password: "{{ githubpassword }}" # Password is a regex
    no_log: true
3
  • What do you mean by username/password "is a regex"?
    – trebor
    Dec 14, 2020 at 2:14
  • @trebor By "Username is a regex" he means that where you see "Username:" at the start of the line he is supplying a regular expression that the expect module will match against stdout to determine whether to respond by supplying the corresponding value to stdin.
    – Will
    Feb 22, 2021 at 3:41
  • It's for sure important to be aware that Git will store your password in plaintext. but for me is not that critical because I have I use a deploy token that is read-only that I can frequently change. Thank you
    – Rizerzero
    Jan 31, 2022 at 13:12
4

All of the answers here made it a bit too easy to leak the username/password into a log or error message, which seemed undesirable even if in my case it's a read-only deployment token.

Here's an alternative:

    - name: Configure Git credential storage
      command: "git config --global credential.helper store"
    - name: Populate the Git credential store
      template:
        src: files/git_credentials.j2
        dest: /home/appuser/.git-credentials
        owner: appuser
        group: appuser
        mode: u=rw,g=,o=
      no_log: true

The template looks like this:

https://{{ gitlab_username|urlencode }}:{{ gitlab_password|urlencode }}@gitlab.example.org
2

If you prefer non-interactive mode, there are (at least) two options:

  1. Temporarily upload .netrc
$ cat ~/.netrc
machine github.com login martin.pilka password PASSWORD

$ cat playbook.yaml
...
    - name: Temporarily copy .netrc so "git clone" below works without asking for password
      ansible.builtin.copy:
        src: ~/.netrc
        dest: ./
        mode: "u=rw,g=rw,o="

    - name: Clone repo so remote changes can be easily committed
      ansible.builtin.git:
        repo: https://[email protected]/dNationCloud/kubernetes-monitoring
        dest: git/kubernetes-monitoring/
        clone: yes
        update: yes

    - name: Securely delete .netrc
      command: shred --iterations=1 --remove ~/.netrc
      args:
        removes: ~/.netrc

  1. Use Ansible Vault
$ cat playbook.yaml
...
    - name: Clone repo so remote changes can be easily committed
      vars:
        # Encrypted URL including password:
        # https://martin.pilka:[email protected]/dNationCloud/kubernetes-monitoring
        repo: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          ...
      ansible.builtin.git:
        repo: "{{ repo }}"
        dest: git/kubernetes-monitoring/
        clone: yes
        update: yes

    - name: Remove credentials from GIT URL
      ansible.builtin.git_config:
        name: remote.origin.url
        value: https://[email protected]/dNationCloud/kubernetes-monitoring
        scope: local
        repo: git/kubernetes-monitoring/

Notes:

  • Option 1 is simpler - no need to use Ansible Vault related commands/parameters (when encoding secret and playing book)
  • Unfortunately both options temporarily store password on remote side in plain text (in .netrc or .git/config) - same is true for all other solutions listed here

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.