Ansible: Add public key to bitbucket and checkout the repo

I'm trying to develop an Ansible script that will checkout a repo from bitbucket to a host. I have a key, I have a repo and prepared module git in Ansible that will checkout the repo.

If I go to Bitbucket-> settings->ssh key and add the key from the host manually then the script will checkout the repo.

- name: Download the repository     git:     key_file: /home/{{ device_user }}/.ssh/id_rsa     repo: '{{ my_repo }}'     dest: /home/{{ device_user }}/my_repo     depth: '1'     force: yes     accept_hostkey: yes 

So it's working, so far.

The issue here is how to add automatically via Ansible to Bitbucket? It would be great if Ansible Controller could do that because it already has the key there. But if there are other ways I'm open to them.

I tried community.general.bitbucket_access_key But it fails on "Failed to retrieve access token..." and there is not too much hints on the internet. I failed to solved this.

Edit:

I installed the module as the documentation says. On the Bitbucket, workspace settings I created OAuth consumer name: device and for Account, workspace, projests set to read and for repositories permission reads and admin, as the docs says.

- name: Create access key   community.general.bitbucket_access_key:     repository: 'my_repo'     client_id: xxxxxxxxx # Key generated by Bitbucket     client_secret: xxxxxxxxxxxxxx # Secret generated by Bitbucket     username: my_name.admin     key: '{{lookup("file", "/home/{{ device_user }}/.ssh/device.pub") }}'     label: 'device'     state: present 

And the error is following:

fatal: [169.254.155.9]: FAILED! => {"changed": false, "msg": "Failed to retrieve access token: {'url': 'https://bitbucket.org/site/oauth2/access_token', 'status': 400, 'content-security-policy-report-only': "script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: *; connect-src bitbucket.org *.bitbucket.org bb-inf.net *.bb-inf.net id.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net sentry.io bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; object-src about:; base-uri 'self'", 'server': 'nginx', 'vary': 'Accept-Language, Cookie', 'cache-control': 'no-cache, no-store, must-revalidate, max-age=0', 'content-type': 'application/json', 'x-b3-traceid': '05a9d3c28cad6147', 'x-dc-location': 'ash2', 'strict-transport-security': 'max-age=31536000; includeSubDomains; preload', 'date': 'Mon, 22 Feb 2021 07:02:34 GMT', 'expires': 'Mon, 22 Feb 2021 07:02:34 GMT', 'x-served-by': 'app-3012', 'content-language': 'en', 'x-static-version': 'd4819e0e263d', 'x-render-time': '0.0134270191193', 'connection': 'close', 'x-version': 'd4819e0e263d', 'x-request-count': '2373', 'x-frame-options': 'SAMEORIGIN', 'content-length': '198', 'msg': 'HTTP Error 400: Bad Request', 'body': b'{"error_description": "Cannot use client_credentials with a consumer marked as \\"public\\". Calls for auto generated consumers should use urn:bitbucket:oauth2:jwt instead.", "error": "invalid_grant"}'}"} 

I guess the important message is: Cannot use client_credentials with a consumer marked as \"public\".

So I made the consumer private:

And I got following error:

fatal: [169.254.155.9]: FAILED! => {"changed": false, "msg": "Failed to retrieve access token: {'url': 'https://bitbucket.org/site/oauth2/access_token', 'status': 400, 'content-security-policy-report-only': "script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: *; connect-src bitbucket.org *.bitbucket.org bb-inf.net *.bb-inf.net id.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net sentry.io bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; object-src about:; base-uri 'self'", 'server': 'nginx', 'vary': 'Accept-Language, Cookie', 'cache-control': 'no-cache, no-store, must-revalidate, max-age=0', 'content-type': 'application/json', 'x-b3-traceid': '859f3c3a6f0cdf50', 'x-dc-location': 'ash2', 'strict-transport-security': 'max-age=31536000; includeSubDomains; preload', 'date': 'Mon, 22 Feb 2021 07:11:20 GMT', 'expires': 'Mon, 22 Feb 2021 07:11:20 GMT', 'x-served-by': 'app-3015', 'content-language': 'en', 'x-static-version': 'd4819e0e263d', 'x-render-time': '0.0334351062775', 'connection': 'close', 'x-version': 'd4819e0e263d', 'x-request-count': '3514', 'x-frame-options': 'SAMEORIGIN', 'content-length': '98', 'msg': 'HTTP Error 400: Bad Request', 'body': b'{"error_description": "No callback uri defined for the OAuth client.", "error": "invalid_request"}'}"} 

And here the importatnt message is No callback uri defined for the OAuth client.

I know that this could be set in the consumer settings but I failed to solve this.