HashiCorp and Google: easing secret and infrastructure management

Re:HashiCorp and Google: easing secret and infrastructure ma... by thinkmassive on Tuesday September 19, 2017 @03:10PM (#15287869)

> you need to supply the password when you run the playbook

You can also specify vault-password-file in ansible.cfg [1] It can be a shell script rather than plaintext, so you can use it to call the CLI password manager "pass"[2] for instance. This is handy for automation.

[1] http://docs.ansible.com/ansible/latest/intro_configuration.h... [2] https://www.passwordstore.org/

[ Parent | on HN ]

Re:HashiCorp and Google: easing secret and infrastructure ma... by ams6110 on Tuesday September 19, 2017 @03:39PM (#15288095)

Of course if you're putting the encryption password in ansible.cfg you might as well just leave the original file unencrypted.

[ Parent | on HN ]

Re:HashiCorp and Google: easing secret and infrastructure ma... by linsomniac on Tuesday September 19, 2017 @06:02PM (#15289209)

The parent's recommendation was to put a filename into the ansible.cfg, and that file could contain either the password, or a script that is then run which prints the password to stdout. For example, we have the script pull the password from a gpg-encrypted file.

[ Parent | on HN ]

Re:HashiCorp and Google: easing secret and infrastructure ma... by finnh on Tuesday September 19, 2017 @03:52PM (#15288201)

That's not what GP said. "vault-password-file" != "vault-password".

[ Parent | on HN ]

Re:HashiCorp and Google: easing secret and infrastructure ma... by Johnny555 on Tuesday September 19, 2017 @03:56PM (#15288234)

Even if you do put a plaintext password into ansible.cfg, encrypting secrets in the playbook is still worthwhile so you don't commit them to your source code repository or accidentally share the secrets with the world when you publish your playbooks.

[ Parent | on HN ]