What's the recommended approach for passphrase protected SSH keys?

[mathieumd]

Global Credentials allow to define the SSH Private Key, but AFAIK it's incompatible with encrypted keys, right?

[superstes]

Encrypted keys are not supported.
The pk will be stored encrypted inside the DB.
I do not see a benefit in providing a enc-pk and the passphrase for it in the same form.

[ansibleguy]

As I've needed it at work in the last weeks.
Maybe using named pipes could be useful.
Example of how we use it with ansible-vault for read-once files: https://gist.github.com/NiceRath/67d9fd819a0a088ce34eab7a767dff3a

[mathieumd]

Isn't using ssh-agent the most secure choice? That's what ansible-runner does, no? But I'm not sure they are supporting encrypted keys either, and it looks like they write them on disk too.

[ansibleguy]

Yeah.. As far as I've seen it's because the secrets need to be passed to the new Ansible (sub-)processes.
Process-isolation would add another layer of security as Ansible is basically executed inside a temporary container/pod. Thus no other processes of the service-user can (easily) read the file contents.

But I can take some time and look into the pipes for a start..

[ansibleguy]

For reference: #66

[ansibleguy]

For reference: #68