Chapter 5. Multi-Credential Assignment Automation controller provides support for assigning zero or more credentials to a job template. 5.1. Background Before automation controller v3.3, job templates had the following requirements with respect to credentials: All job templates (and jobs) were required to have exactly one Machine/SSH or Vault credential (or one of both). All job templates (and jobs) could have zero or more "extra" credentials. Extra credentials represented "Cloud" and "Network" credentials that could be used to provide authentication to external services through environment variables, for example, AWS_ACCESS_KEY_ID . This model required a variety of disjoint interfaces for specifying credentials on a job template and it lacked the ability to associate multiple Vault credentials with a playbook run, a use case supported by Ansible core from Ansible 2.4 onwards. This model also poses a stumbling block for certain playbook execution workflows, such as having to attach a "dummy" Machine/SSH credential to the job template to satisfy the requirement. 5.2. Important Changes All automation controller 4.4 Job templates have a single interface for credential assignment. From the API endpoint: GET /api/v2/job_templates/N/credentials/ You can associate and disassociate credentials using POST requests, similar to the behavior in the deprecated extra_credentials endpoint: POST /api/v2/job_templates/N/credentials/ {'associate': true, 'id': 'X'} POST /api/v2/job_templates/N/credentials/ {'disassociate': true, 'id': 'Y'} With this model, a job template is considered valid even when there are no credentials assigned to it. This model also provides users the ability to assign multiple Vault credentials to a job template. 5.3. Launch Time Considerations Before automation controller v3.3, job templates used a configurable attribute, ask_credential_on_launch . This value was used at launch time to determine which missing credential values were necessary for launch. This was a way to specify a Machine or SSH credential to satisfy the minimum credential requirement. Under the unified credential list model, this attribute still exists, but it no longer requires a credential. Now when ask_credential_on_launch is true , it signifies that you can specify a list of credentials at launch time to override those defined on the job template. For example: POST /api/v2/job_templates/N/launch/ {'credentials': [A, B, C]}` If ask_credential_on_launch is false , it signifies that custom credentials provided in the POST /api/v2/job_templates/N/launch/ are ignored. Under this model, the only purpose for ask_credential_on_launch is to signal API clients to prompt the user for (optional) changes at launch time. 5.4. Multi-Vault Credentials Because you can assign multiple credentials to a job, you can specify multiple Vault credentials to decrypt when your job template runs. This functionality mirrors the support for Managing vault passwords . Vault credentials now have an optional field, vault_id , which is similar to the --vault-id argument of ansible-playbook . Use the following procedure to run a playbook which makes use of multiple vault passwords: Procedure Create a Vault credential in automation controller for each vault password. Specify the Vault ID as a field on the credential and input the password (which is encrypted and stored). Assign multiple vault credentials to the job template using the new credentials endpoint: POST /api/v2/job_templates/N/credentials/ { 'associate': true, 'id': X } Alternatively, you can perform the same assignment in the automation controller UI in the Create Credential page: In this example, the credential created specifies the secret to be used by its Vault Identifier ("first") and password pair. When this credential is used in a Job Template, as in the following example, it only decrypts the secret associated with the "first" Vault ID: If you have a playbook that is set up the traditional way with all the secrets in one big file without distinction, then leave the Vault Identifier field blank when setting up the Vault credential. 5.4.1. Prompted Vault Credentials For passwords for Vault credentials that are marked with Prompt on launch , the launch endpoint of any related Job Templates communicate necessary Vault passwords using the passwords_needed_to_start parameter: GET /api/v2/job_templates/N/launch/ { 'passwords_needed_to_start': [ 'vault_password.X', 'vault_password.Y', ] } Where X and Y are primary keys of the associated Vault credentials: POST /api/v2/job_templates/N/launch/ { 'credential_passwords': { 'vault_password.X': 'first-vault-password' 'vault_password.Y': 'second-vault-password' } } 5.4.2. Linked credentials Instead of uploading sensitive credential information into automation controller, you can link credential fields to external systems and use them to run your playbooks. For more information, see Secret Management System in the Automation controller User Guide.

Commands:
GET /api/v2/job_templates/N/credentials/
POST /api/v2/job_templates/N/credentials/ {'associate': true, 'id': 'X'} POST /api/v2/job_templates/N/credentials/ {'disassociate': true, 'id': 'Y'}
POST /api/v2/job_templates/N/launch/ {'credentials': [A, B, C]}`
POST /api/v2/job_templates/N/credentials/ { 'associate': true, 'id': X }
GET /api/v2/job_templates/N/launch/ { 'passwords_needed_to_start': [ 'vault_password.X', 'vault_password.Y', ] }
POST /api/v2/job_templates/N/launch/ { 'credential_passwords': { 'vault_password.X': 'first-vault-password' 'vault_password.Y': 'second-vault-password' } }