Integrate Red Hat Ansible Automation Platform (AAP) with HashiCorp Vault Enterprise for dynamic SSH credential management. Use when: (1) Configuring Vault SSH secrets engine with AppRole auth for AAP, (2) Creating AAP credentials backed by Vault signed SSH certificates, (3) Provisioning infrastructure with Terraform/Ansible for AAP-Vault integration, (4) Setting up multi-tenant credential management, (5) Configuring golden images to trust Vault SSH CA, (6) Implementing credential rotation strategies. Based on HashiCorp validated pattern.
The English summary is being prepared. Showing the original description.
Review the instructions the agent will receive before you install.
Dynamically signed SSH credentials replacing static key management.
AAP Job → AppRole Auth → Vault SSH CA → Signed Certificate → Target Host
# Enable SSH secrets engine
resource "vault_mount" "ssh" {
path = "ssh"
type = "ssh"
}
resource "vault_ssh_secret_backend_ca" "ssh" {
backend = vault_mount.ssh.path
generate_signing_key = true
}
# AppRole for AAP
resource "vault_approle_auth_backend_role" "aap" {
backend = "approle"
role_name = var.tenant
token_policies = ["aap-ssh"]
}
# SSH signing role
resource "vault_ssh_secret_backend_role" "aap" {
backend = vault_mount.ssh.path
name = var.tenant
key_type = "ca"
allow_user_certificates = true
default_user = "aap"
allowed_users = "aap,ansible"
ttl = "7200"
default_extensions = { "permit-pty" = "" }
}
Full Terraform config: See references/vault-config.md
# Vault SSH credential
- name: Create Vault SSH Credential
ansible.controller.credential:
name: "vault_ssh_{{ tenant }}"
credential_type: "HashiCorp Vault Signed SSH"
inputs:
url: "{{ vault_url }}"
role_id: "{{ role_id }}"
secret_id: "{{ secret_id }}"
default_auth_path: "approle"
# Machine credential linked to Vault
- name: Create Machine Credential
ansible.controller.credential:
name: "machine_{{ tenant }}"
credential_type: "Machine"
inputs:
username: "aap"
register: machine_cred
- name: Link to Vault Source
ansible.controller.credential_input_source:
input_field_name: "ssh_public_key_data"
target_credential: "{{ machine_cred.id }}"
source_credential: "vault_ssh_{{ tenant }}"
metadata:
role: "{{ tenant }}"
secret_path: "ssh"
Full AAP config: See references/aap-config.md
Target hosts must trust Vault's SSH CA:
- name: Download Vault SSH CA
ansible.builtin.get_url:
url: "{{ vault_url }}/v1/ssh/public_key"
headers:
X-Vault-Namespace: "{{ vault_namespace }}"
dest: /etc/ssh/trusted-user-ca-keys.pem
- name: Configure SSH CA Trust
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config
line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
notify: Restart SSH
Full image config: See references/golden-image.md
Map tenants across both platforms:
| AAP | Vault |
|---|---|
| Organization | Namespace |
| Credential | AppRole + SSH Role |
| Team | Entity/Group |
Policy templating for dynamic paths:
path "ssh/sign/{{identity.entity.name}}" {
capabilities = ["read", "update"]
}
AAP job rotates its own secret_id daily:
# Vault policy allowing self-rotation
path "auth/approle/role/{{ tenant }}/secret-id" {
capabilities = ["update"]
}
Schedule AAP job template to run rotation playbook.
| Issue | Check |
|---|---|
| Auth failure | Verify role_id/secret_id, check namespace |
| Signing failure | Verify allowed_users includes target user |
| SSH rejected | Verify TrustedUserCAKeys on target, check CA fingerprint |
| Certificate expired | Check TTL settings (default 2hr) |
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
The English summary is being prepared. Showing the original description.
Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project
The English summary is being prepared. Showing the original description.
Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable quality criteria. This should trigger for requests such as Create ADR for Non-functional requirements; Document Non-functional requirements; Capture Non-functional requirements; Generate Non-functional requirements in an ADR. Part of cursor-rules-java project
The English summary is being prepared. Showing the original description.
Run a health check on an existing project: dependency audit, security scan, test runner detection, CI/CD evaluation, and missing configuration analysis. Maps the three execution gates (pre/in/post) from /10x-bootstrapper to an assessment framework for existing codebases. Reads optional context/foundation/stack-assessment.md from /10x-stack-assess to focus checks on identified gaps. Writes context/foundation/health-check.md with findings, prioritized fixes, and an agent-readiness verdict. Use when the user has an existing project and wants to verify its health before working with an agent. Trigger phrases: "health check", "check my project", "audit my project", "is my project healthy", "sprawdź projekt", "audyt projektu", "health-check", "project health". Use AFTER /10x-stack-assess (brownfield chain), BEFORE agent onboarding (m1-l4).
The English summary is being prepared. Showing the original description.
You MUST use this when building projects end-to-end. Orchestrates all 12 team roles — automatically switches between CTO, architect, PM, engineers, SRE, security, DBA, QA, and EM based on the current phase of work. Starts with brainstorming before any implementation.
The English summary is being prepared. Showing the original description.
Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need. This should trigger for requests such as Add Maven plugins in pom.xml; Improve Maven plugins in pom.xml. Part of cursor-rules-java project
The English summary is being prepared. Showing the original description.