Ansible Vault Environment Variable

README.md

Ansible Vault Environment Variable

Per http://docs.ansible.com/ansible/playbooks_vault.html you can set an environment variable to use a password file for vault access. We can use this to create an environment variable to hold the password.

Password Script

Copy vault-env from this project to ~/bin. Then add this to your ~/.bashrc:

export ANSIBLE_VAULT_PASSWORD_FILE=~/bin/vault-env

Usage

Now just export your password in your shell as needed. Don't be a douche and put this in your profile though.

export ANSIBLE_VAULT_PASSWORD=<password>

vault-env

#!/bin/bash

echo $ANSIBLE_VAULT_PASSWORD

Contrary to the comment above, this does still work. And while using a custom env var is nice, the real power lies in using the script to fetch the vaultpass directly from OpenBao, Hashicorp Vault, or your password manager.

Contrary to the comment above, this does still work. And while using a custom env var is nice, the real power lies in using the script to fetch the vaultpass directly from OpenBao, Hashicorp Vault, or your password manager.

Quite correct. I failed to make the file executable when I started working with vault passwords. The documentation can be misleading in that it does not clarify how password files work in all references. So, depending on where you come into the docs, there can be some misunderstanding.

• For example, in "Storing passwords in files" the --vault-password-file option of ansible-playbook is described as identifying the file the password is stored in. There is nothing about executable permissions.

• The docs for the ANSIBLE_VAULT_PASSWORD_FILE environment variable say "If executable, it will be run and the resulting stdout will be used as the password." It does not say the file contents will otherwise be used.

• I have found, only in "Setting a default password source" is it clearly stated that the file "can be either a file containing the password (in plain text), or it can be a script (with executable permissions set) that returns the password."

This applies to ALL password file references. The --vault-id and --vault-password-file options, DEFAULT_VALUE_IDENTITY_LIST, DEFAULT_VAULT_PASSWORD_FILE and ANSIBLE_VAULT_PASSWORD_FILE environment variables, and the vault_identity_list configuration option all identify files as the password source. If the file is executable, the password is the output of the executed script. If not, the password is the file content.