20

According the help of ansible-playbook one could use --user=REMOTE_USER to define the ssh user, but one could also define ansible_ssh_user: REMOTE_USER in either the host- or group_vars.

Question

What variable need to be defined in either the group- or host_vars directory to prevent that --vault-password-file has to be defined while running ansible-playbook?

Attempts

  • When ansible_vault_password_file: ~/.vault_pass.txt is defined in the config the decryption fails:

    ERROR! Decryption failed on /path/to/vault
    
  • No associated vault variables was found in this documentation

1

2 Answers 2

15

Here is the definition:

DEFAULT_VAULT_PASSWORD_FILE = get_config(p, DEFAULTS, 'vault_password_file', \
'ANSIBLE_VAULT_PASSWORD_FILE', None, value_type='path')

This means that you either put in ansible.cfg or playbook:

vault_password_file: ~/.vault_pass.txt

Or in your shell defined this variable:

export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt
7
  • @JiriKlouda it does not seem to work although it has been defined in group_vars/all/vars. export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt had to be run.
    – 030
    Mar 30, 2017 at 7:30
  • This is a config variable. It has to be in ansible.cfg or equivalent or in the playbook. Mar 30, 2017 at 11:44
  • Also I have specifically checked the 2.2 version you run and it is there: github.com/ansible/ansible/blob/stable-2.2/lib/ansible/… Mar 30, 2017 at 16:18
  • When I export the variable it works
    – 030
    Mar 31, 2017 at 15:33
  • @JiriKlouda it's best to include the actual answer, not just the link, because links become invalid over time, and a direct answer is more useful too.
    – RichVel
    Jul 28, 2017 at 7:57
3

You can set an environment variable ANSIBLE_VAULT_PASSWORD_FILE storing the path the the vault password file. This way you won't have the always use the --vault-password-file switch when running a playbook.

This is described in Ansible's Vault documentation, available here.

So, add export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt to your ~/.bash_profile, source from it and you're ready to go.

If you need different vault passwords for different groups of hosts, then you should do the following:

Inside of this subdirectory, create two files named vars and vault. Inside of the vars file, define all of the variables needed, including any sensitive ones. Next, copy all of the sensitive variables over to the vault file and prefix these variables with vault_. You should adjust the variables in the vars file to point to the matching vault_ variables and ensure that the vault file is vault encrypted.

This is an example for best practices approach for managing sensitive information on per group basis. More information is available in Ansible's documentation here (The above text is copied from there).

6
  • 1
    This won't allow a different password per hosts
    – Tensibai
    Mar 29, 2017 at 7:44
  • Are you referring to connection password? Because if you do, what does it have in common with Ansible Vault?
    – 13dimitar
    Mar 29, 2017 at 7:51
  • I was referring to the vault password, willing to have different vault password for different groups makes sense (and is the root of the question as far as I understand it).
    – Tensibai
    Mar 29, 2017 at 7:54
  • I didn't understand it that way. I've edited my answer to include that scenario.
    – 13dimitar
    Mar 29, 2017 at 8:01
  • seems better. Btw downvote is not mine
    – Tensibai
    Mar 29, 2017 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.