ansible-galaxy fails to pull roles in gitlab-ci pipeline

Question

ansible-lint step in gitlab-ci pipeline is failing because of authentication error while running the ansible-galaxy install -r requirements.yml that pulls the roles dependency defined in the requirements.yml and clone the roles from git.

I tried passing the authentication token via CICD variables but it doesn’t like that.

requirements.yml

- src: git+https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/../ansible/roles/ansible-role-s3-yumrepo.git
  version: master
  scm: git

But it fails with below error

Starting galaxy role install process

[WARNING]: - ansible-role-s3-yumrepo was NOT installed successfully: -
command /usr/bin/git clone https://gitlab-ci-
token:${CI_JOB_TOKEN}@gitlab.com/../ansible/roles/ansible-role-s3-yumrepo.git
ansible-role-s3-yumrepo failed in directory /root/.ansible/tmp/ansible-local-526mx2pctt4/tmp2n3_tp7_
(rc=128) - Cloning into 'ansible-role-s3-yumrepo'... remote: HTTP Basic:
Access denied fatal: Authentication failed for 'https://gitlab-ci-
token:${CI_JOB_TOKEN}@gitlab.com/../ansible/roles/ansible-role-s3-yumrepo.git/'

Anyone faced this issue before or know a better way to handle this (edited)

Answer 1

The problem is that ansible-galaxy does not support environment variable substitution. One possible solution could be manual variable substitution using envsubst:

cat requirements.template|envsubst > requirements.yml

Depending on the environment setup it may be necessary to delete this file later (after the run), as it will contain all the passwords / tokens as plain text.

Another hint how to debug (confirm) that your user and deploy-token is really working, is to temporarily hardcode deploy-token-user and deploy-token

src: 'https://<GITLAB_DEPLOY_USER>:<GITLAB_DEPLOY_TOKEN>@mycompany.com/gitlab/prj/my-ansible-role.git'

and test it manually.

Answer 2

for gitlab-ci you need to edit the requirements.yml

- src: git+https://[email protected]/../ansible/roles/ansible-role-s3-yumrepo.git
  version: master
  scm: git

need to use in job

sed -i "s/token/token:${CI_JOB_TOKEN}/g" ./requirements.yml

we get

- src: git+https://gitlab-ci-token:[email protected]/../ansible/roles/ansible-role-s3-yumrepo.git
  version: master
  scm: git

this working for ansible-galaxy install in gitlab-ci just need allow access to this project with a CI_JOB_TOKEN in gitlab