6

Context

In my company, we have a shared repository containing our ansible script for our servers. I would like to introduce vault variables to handle services password in the near future. For now, we use encrypted password prompts at the beginning of our playbooks. This solution is annoying (it asked for 3 passwords on some playbooks).

Need

As most of our ansible users are no experts, I would like them to be able to run playbooks smoothly. It means ansible-playbook commands should be short and work without any mandatory parameters (e.g. no --ask-sudo-pass and whatnot). It also means I prefer prompting for vault password at the beginning of a playbook only when it’s needed. Moreover, I do not want to use ansible password file, because it is not easily shareable and I don’t like the idea of having a cleartext password file on all our ansible users computers.

Problem

Adding --ask-vault-pass for every concerned playbooks is not an option. Our ansible users will not understand why sometimes this parameter is needed and why sometimes it’s not. On the contrary, asking the vault password for every playbook is a burden, because we have a lot of playbooks and sudo password is already asked each time too.

I tried to achieve the following solution, using prompts and various options. Nothing seems to work. Documentation does not explain how to do this:

The best solution (according to me)

Let’s look at this main.yml file:

- import_tasks: foo.yml
  tags: always

- import_tasks: bar.yml
  tags: bar

# Only this tasks uses a vault encrypted variable
- import_tasks: baz.yml
  tags: [baz, vault]

Now, there’s a playbook.yml, importing this main.yml file.

In a perfect world, I would like this to happen:

example1:

ansible-playbook -i prod playbook.yml

Vault password:

example2:

ansible-playbook -i prod playbook.yml --tags baz

Vault password:

example3:

ansible-playbook -i prod playbook.yml --tags foo

# it runs without asking for vault password, because no tasks needing vault
# password will be run

Question

How can I configure ansible to ask for vault password only when it is needed (meaning: every time a vault encrypted variable is encountered)? Is it even possible? If not, what workaround would be viable given my situation?

Thanks.

1 Answer 1

5

I found a workaround.

The idea is to always load all passwords (including sudo) from an ansible vault file, needing only the vault password for each playbook. It means all machines should have the same deployer user password. This is even simpler than before, because there’s a single master password (the vault password) to control them all.

This is how it’s done:

ansible.cfg:

[privilege_escalation]
become_ask_pass = False
become = True

[defaults]
ask_vault_pass = True

vars/vault/env:

_vault:
  sudo: !vault |
        $ANSIBLE_VAULT;1.1;AES256
        BLAHBLAHBLAH
  another_pass: !vault |
                $ANSIBLE_VAULT;1.1;AES256
                ANOTHERENCRYPTEDPASSWORD

And for each playbook:

# Playbook stuff
# [...]

vars:
  ansible_become_pass: "{{ _vault.sudo }}"
vars_files:
  # env var is set dynamically in inventory file, so I can have different password per env.
  # If the file is not found, it loads an empty null file
  - [ "vars/vault/{{ env }}", "vars/null"]

# [...] Loading other var files

Now, a simple ansible-playbook -i env/prod myPlayBook.yml will only ask for the vault password, no prompt for sudo or anything else. It’s consistent and easy to share (only the encrypted password file and the vault password must be shared).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.