24

That is to say: how to evaluate the password lookup only once?

- name: Demo
  hosts: localhost
  gather_facts: False
  vars:
    my_pass: "{{ lookup('password', '/dev/null length=15 chars=ascii_letters') }}"
  tasks:
  - debug:
      msg: "{{ my_pass }}"
  - debug:
      msg: "{{ my_pass }}"
  - debug:
      msg: "{{ my_pass }}"

each debug statement will print out a different value, e.g:

PLAY [Demo] *************

TASK [debug] ************
ok: [localhost] => {
    "msg": "ZfyzacMsqZaYqwW"
}

TASK [debug] ************
ok: [localhost] => {
    "msg": "mKcfRedImqxgXnE"
}

TASK [debug] ************
ok: [localhost] => {
    "msg": "POpqMQoJWTiDpEW"
}  

Using Ansible version 2.3.2.0

2
  • 1
    So which of your questions are you asking? How to generate a password like in the title or how to evaluate value only once? Please edit your question to make it consistent.
    – Mxx
    Oct 14, 2017 at 23:50
  • This appears in console because the debug tasks, that were for demonstration purposes only
    – Danielo515
    Aug 25 at 12:34

4 Answers 4

46

Use set_fact to assign permanent fact:

- name: Demo
  hosts: localhost
  gather_facts: False
  vars:
    pwd_alias: "{{ lookup('password', '/dev/null length=15 chars=ascii_letters') }}"
  tasks:
    - set_fact:
        my_pass: "{{ pwd_alias }}"
    - debug:
        msg: "{{ my_pass }}"
    - debug:
        msg: "{{ my_pass }}"
    - debug:
        msg: "{{ my_pass }}"
2
  • 1
    So there is no way to do this in defaults/vars/etc? To just have a variable within a wider object that you can use? We have to run a task and set_fact?
    – Adam
    Oct 12, 2020 at 8:19
  • Unfortunately, this doesn't seem to work with multiple hosts.
    – iliis
    Nov 2, 2021 at 9:44
15

I've been doing it this way and never had an issue.

- name: Demo
  hosts: localhost
  gather_facts: False 

  tasks:
   - set_fact:
       my_pass: "{{ lookup('password', '/dev/null length=15 chars=ascii_letters') }}"
   - debug:
       msg: "{{ my_pass }}"
   - debug:
       msg: "{{ my_pass }}"
2

The problem is that you are using the password module wrong, or at least according to the latest documentation (maybe this a new feature on 2.5):

Generates a random plaintext password and stores it in a file at a given filepath.

By definition,the lookup password generates a random password AND stores it on the specified path for subsequent lookups. So, first time it checks if the specified path exists, and if not generates a random password and stores it on that path, subsequent lookups will just retrieve it. Because you are using /dev/null as store path, you are forcing ansible to generate a new random password because everytime it checks for existence it finds nothing. If you want to have a random password per host + client or whatever all you need to do to is use some templating and set the store path based on those parameters.

For example:

---
- name: Password test
  connection: local
  hosts: localhost
  tasks:
    - name: create a mysql user with a random password
      ansible.builtin.debug:
        msg: "{{ lookup('password', 'credentials/' + item.host + '/' + item.user + '/mysqlpassword length=15') }}"
      with_items:
        - user: joe
          host: atlanta
        - user: jim
          host: london
    - name: Another task that uses the password of joe
      ansible.builtin.debug:
        msg: "{{ lookup('password', 'credentials/atlanta/joe/mysqlpassword length=15') }}"
    - name: Another task that uses the password of jim
      ansible.builtin.debug:
        msg: "{{ lookup('password', 'credentials/london/jim/mysqlpassword length=15') }}"


And this is the task execution, as you can see, the three tasks are getting the right generated passwords:


TASK [Gathering Facts] ***********************************************************************************************
ok: [localhost]

TASK [create a mysql user with a random password] ********************************************************************
ok: [localhost] => (item={'user': 'joe', 'host': 'atlanta'}) => {
    "msg": "niwPf4tk9HWHhNc"
}
ok: [localhost] => (item={'user': 'jim', 'host': 'london'}) => {
    "msg": "dHJdg,OjOEqdyrW"
}

TASK [Another task that uses the password of joe] ********************************************************************
ok: [localhost] => {
    "msg": "niwPf4tk9HWHhNc"
}

TASK [Another task that uses the password of jim] ********************************************************************
ok: [localhost] => {
    "msg": "dHJdg,OjOEqdyrW"
}

This has the advantage that, even if you play fails and you have to re-execute you will not get the same previous random password,that you can then store on a key-chain or just delete them.

1
  • Just be careful when executing this on hosts that are logging your terminals output :)
    – Ian Smith
    Aug 23 at 20:49
0

The lookup password is nice, but what if you have password specification, like it have to contain specific characters, or must not contain uppercase... the lookup also does not guarantee that the password will have special characters if needed to have...

I have ended with custom jinja filter, that might help somebody ( works fine for me :) )

https://gitlab.privatecloud.sk/vladoportos/custom-jinja-filters

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.