Where Does the Ansible Code You’re Running Come From?
summary
Shows how to ensure only authorized Ansible code runs by adding end-to-end cryptographic signing and verification across the Git-to-controller supply chain. Recommends concrete tools and steps: use git commit -S for signed commits, ansible-sign to GPG-sign and verify playbooks and collections, publish/validate signed Collections via Automation Hub or Galaxy NG, build and sign execution-environment images with podman sign and enforce them with container policy, and validate signatures both in CI and again on the controller while mapping the supply chain.
AI-written summary · about
chapters (9)
- 0:00Ansible code supply chain
- 4:57Supply chain security
- 10:55Ansible code risks
- 13:22Git commit signing
- 15:29Collections signing
- 17:20Container image validation
- 19:29Security limitations
- 20:33Practical recommendations
- 22:24GPG key management Q&A
related talks
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
29mGood Practices and Security for your Ansible Automation Platform 2
35mSecuring Secrets at Scale: Integrating Ansible Automation with Conjur
34mTrust But Verify: Bringing Supply Chain Integrity To CD GitOps
23mMastering Secure Software Supply Chains
23mAutomation with Scalable & Secure SSH
14mAnsible code Bot - The ultimate bot for your git repo
28mNo Compromise: Use Ansible properly or stick to your scripts