I've been using a lot of Ansible lately and while almost everything has been great, finding a clean way to implement ansible-vault wasn't immediately apparent.
What I decided on was the following: put your secret information into a vars file, reference that vars file from your task, and encrypt the whole vars file using ansible-vault encrypt.
Let's use an example: You're writing an Ansible role and want to encrypt the spoiler for the movie Aliens.
| #!/usr/bin/env bash | |
| # | |
| # Get the value of a tag for a running EC2 instance. | |
| # | |
| # This can be useful within bootstrapping scripts ("user-data"). | |
| # | |
| # Note the EC3 instance needs to have an IAM role that lets it read tags. The policy | |
| # JSON for this looks like: | |
| # | |
| # { |
| from suds.sudsobject import asdict | |
| def recursive_asdict(d): | |
| """Convert Suds object into serializable format.""" | |
| out = {} | |
| for k, v in asdict(d).iteritems(): | |
| if hasattr(v, '__keylist__'): | |
| out[k] = recursive_asdict(v) | |
| elif isinstance(v, list): | |
| out[k] = [] |
| #!/bin/bash | |
| # | |
| # Pre-commit hook that verifies if all files containing 'vault' in the name | |
| # are encrypted. | |
| # If not, commit will fail with an error message | |
| # | |
| # Original author: @ralovely | |
| # https://www.reinteractive.net/posts/167-ansible-real-life-good-practices | |
| # | |
| # File should be .git/hooks/pre-commit and executable |
Deploy key is a SSH key set in your repo to grant client read-only (as well as r/w, if you want) access to your repo.
As the name says, its primary function is to be used in the deploy process in replace of username/password, where only read access is needed. Therefore keep the repo safe from the attack, in case the server side is fallen.
| #!/bin/bash | |
| ##################################################################### | |
| ## IMPORTANT ## | |
| # Run this script with root (sudo su -), wont work if run as sudo. | |
| # Change the variables as needed. | |
| ###################################################################### | |
| USER=youruser # User that will have ownership (chown) to /usr/local/bin and /usr/local/lib | |
| USERHOME=/home/${USER} # The path to the users home, in this case /home/youruser | |
| PYSHORT=3.6 # The Python short version, e.g. easy_install-${PYSHORT} = easy_install-3.6 | |
| PYTHONVER=3.6.1 # The actual version of python that you want to download from python.org |
| #!/usr/bin/env python | |
| # encoding: utf-8 | |
| import imp | |
| import os | |
| import pdb | |
| import pip | |
| import readline | |
| from pip.commands.search import SearchCommand | |
| import sys |
Jon Warbrick, July 2014, V3.2 (for Ansible 1.7)
First one found from of
| import logging | |
| from logging import handlers | |
| import traceback | |
| import sys | |
| import re | |
| import os | |
| import json | |
| import socket # Used for IP Address validation | |
| from splunk.appserver.mrsparkle.lib.util import make_splunkhome_path |
