Menu
I want to automate the decryption of ansible vault and not to have to specify the vault location or password from the command line.
Mainly, I am looking for a solution what would work in a way that similar to how ~/.netrc works. When you put credentials there the tools (like curl, wget,...) will know to load them.
If you don't it the execution will have.
That's quite important because I need to be able to automate the execution of these ansible playbooks, so prompt for password is clearly not an option.
Also, I do not want to have to add --vault-password-file parameter to each playbook. Any ideas?
890
If you have an encrypted file that you no longer want to keep encrypted, you can permanently decrypt it by running the ansible-vault decrypt command. This command will save the file unencrypted to the disk, so be sure you do not want to edit it instead.
The $ANSIBLE_VAULT;1.1;AES256 header at the top of the file indicates that the file is encrypted with Ansible Vault using the AES256 cipher. The Advanced Encryption Standard(AES) is a symmetric-key algorithm that uses the same key to encrypt and decrypt data.
Running a Playbook With VaultThe password should be a string stored as a single line in the file. You can also set ANSIBLE_VAULT_PASSWORD_FILE environment variable, e.g. ANSIBLE_VAULT_PASSWORD_FILE=~/. vault_pass. txt and Ansible will automatically search for the password in that file.
To enable this feature, a command line tool - ansible-vault - is used to edit files, and a command line flag ( --ask-vault-pass , --vault-password-file or --vault-id ) is used. Alternately, you may specify the location of a password file or command Ansible to always prompt for the password in your ansible.
Much like the inventory, if vault-password-file has the executable bit set, Ansible will run it and use stdout as the password.
That allows you to write a script that wraps the password in PGP encryption, sits in a limited-access S3 bucket, uses AWS KMS, or whatever strikes your fancy.
105
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
