Is it possible to have multi password with vault

Question

I have a deployment project that I share with other teams. I have encrypted my secrets with vault. I would like to encrypt the production file with a password and a staging file with an other password to avoid other teams having access to production secrets.

Is it possible to do that ?

I have done something like that. My secrets :

cat /group_vars/all/vault_production.yml (encrypt with password A)
production_password: 'test1'

cat/group_vars/all/vault_staging.yml (encrypt with password B)
staging_password: 'test2'

My environments :

cat hosts-production
[all:vars]
env_type=production

cat hosts-staging
[all:vars]
env_type=staging

My script :

- copy:
  content: |
    env PASS={{hostvars[inventory_hostname][env_type + '_password']}}
  ...

And I launch the playbook like that.

# for production
ansible-playbook  -i hosts-staging test.yml --vault-password-file .password_a
# for staging
ansible-playbook  -i hosts-staging test.yml --vault-password-file .password_b

But that doesn't work because there is 2 differents passwords (ERROR! Decryption failed). Do you know how to do that ?

Thanks.

BR,

Eric

Answer 1

Sorry, only one vault password allowed per run today. Best way to work around this in the case where you really only need one or the other is to dynamically load a vaulted file based on a var; eg:

- hosts: localhost
  vars_files:
  - secretstuff-{{ env_type }}.yml
  tasks:
  ...

or

- hosts: localhost
  tasks:
  - include_vars: secretstuff-{{ env_type }}.yml
  ...

depending on if you need the vars to survive for one play or the entire run (the latter will bring them in as facts instead of play vars).