How to properly configure ssh authorization for pipeline in gitlab ci to run ansible-playbook?

Question

linux

Task: installing\updating the application on a group of linux servers.

gitlab-runner is only installed on one server for ansible from which the playbook is running.

gitlab-ci.yml is something like this:

stages:
  - install_zabbix_agent

install_zabbix_agent:
  stage: install_zabbix_agent
  script:
    - 'ansible-playbook playbooks/zabbix-agent-linux.yml  -i environments/inventory'
  tags:
    - zabbix

Ideas so far are:

1. Create a key for the gitlab-runner user, roll it out to all servers, add it to variables
   
2. Or create a common account with a username \ password and register everything in inventory
   

How to do it correctly and safely so as not to burn the private key or password?

Answer 1

Gitlab has secrets where, among other things, you can put SSH keys.
But in general, since you already have runners running on your hosts, it means that you already have access and it is enough to add the gitlab-runnernecessary rights to the user, for example, via sudo.

Answer 2

3. Give access to the user from which the ansible script is executed on other machines. Just scatter the public key on the rest of the servers.