How to diff ansible vault changes?

Question

I'd like to see the actual git commit changes in the ansible vault file.

Is there an easy way how to achieve this?

Answer 1

You can do this very neatly, so that the normal git tools like git log and git diff can see inside the vaulted files, using a custom git diff driver and .gitattributes.

• Make sure that your vault password is in .vault_password and that that file is not committed - you should also add it to .gitignore.

• Add a .gitattributes file that matches any files in your repository that are encrypted with ansible-vault and give them the attribute diff=ansible-vault. For example, I have:

  env_vars/production.yml diff=ansible-vault merge=binary
  env_vars/staging.yml diff=ansible-vault merge=binary
  

  You can also use wildcarded patterns - the first element of each line, the pattern, follows the same rules as .gitignore files. The merge=binary option tells git not to attempt to do a three-way merge of these files.

• Then you have to set the diff driver for files with attribute diff=ansible-vault to ansible-vault view:

  git config --global diff.ansible-vault.textconv "ansible-vault view"
  

And that should be it - when git is calculating diffs of the files your pattern matches, it'll decrypt them first.

Answer 2

So after some digging I constructed the non-trivial solution.

First of all store your vault password into the (.gitignored) .vault_password file.

In the following example a HEAD and HEAD~2 versions of the file inventory/group_vars/xyz/vault.yml are vimdiff-ed:

vimdiff \
  <(ansible-vault view --vault-password-file=.vault_password \
    <(git show HEAD:inventory/group_vars/xyz/vault.yml)) \
  <(ansible-vault view --vault-password-file=.vault_password \
    <(git show HEAD~2:inventory/group_vars/xyz/vault.yml))