Lookup vault in memory

[Quentin Aveno]

Hi, 

I have a question about lookup and memory:

When I use a lookup with vault, is the pass is store in memory when I use it directly in a task or pass it through a variable in an inventory ? Is there a significant difference ? 

Have a nice day. 

[Quentin Aveno]

For more information :

I'm concerned about security issue in my company where the continous delivery is share between many teams. I would like to not store secret in memory or at least the shortest possible time. I supposed that if I use my lookup directly in task and not in a variable I was safer. Am I right ? 

[Vladimir Botka]

On Wed, 20 Nov 2019 05:09:01 -0800 (PST)
Quentin Aveno <aori...@gmail.com> wrote:

> > When I use a lookup with vault, is the pass is store in memory when I use
> > it directly in a task or pass it through a variable in an inventory ? Is
> > there a significant difference ?

There is no difference because of "Lazy Evaluation" ("Ansible evaluates any
variables in playbook content at the last possible second."), I think. See
https://docs.ansible.com/ansible/latest/reference_appendices/glossary.html

(Is this hashi_vault plugin?)

Cheers,

-vlado

[Quentin Aveno]

Yes It is. 

I mean if I don't use it as a variable but directly in a task as a parameter. 

As example:

Is there a difference between 

- shell: check.sh {{ lookup('hashi_vault', 'secret=secret1') }} 

And 

- shell: check.sh {{ password 1}} 

Where password1 is defined in an inventory

It seems logical to me than the first one is safer and evaluate later

[Vladimir Botka]

On Wed, 20 Nov 2019 05:54:21 -0800 (PST)
Quentin Aveno <aori...@gmail.com> wrote:

> Yes It is.
> I mean if I don't use it as a variable but directly in a task as a
> parameter.
> As example:
> Is there a difference between
> - shell: check.sh {{ lookup('hashi_vault', 'secret=secret1') }}
> And
> - shell: check.sh {{ password 1}}
> Where password1 is defined in an inventory
>
> It seems logical to me than the first one is safer and evaluate later

I can only assume that "password1 is defined in an inventory" means a
similar line can be found in an inventory

password1: "{{ lookup('hashi_vault', 'secret=secret1') }}"

(Otherwise the comparison does not make much sense).

I can only repeat that both arguments below will be decrypted at the same
time because of the "Lazy Evaluation" ("Ansible evaluates any variables in

playbook content at the last possible second.")

- shell: "check.sh {{ lookup('hashi_vault', 'secret=secret1') }}"

- shell: "check.sh {{ password1 }}"

Cheers,

-vlado

[Quentin Aveno]

Thanks vlado for your responses.

Yes, sorry for not being clear, password1 was defined in an inventory.

It's almost clear now.
Does it mean that if i use a variable from inventory twice It will be evaluate twice or the variable will be store in memory ? Same question for lookup directly in task.

By the way, have you any advice in order to not store vault secret in memory.

And sorry for bad english (plus I write from a phone)

Have a nice day and thanks once again)

[Vladimir Botka]

On Wed, 20 Nov 2019 07:45:29 -0800 (PST)
Quentin Aveno <aori...@gmail.com> wrote:

> Does it mean that if i use a variable from inventory twice It will be
> evaluate twice or the variable will be store in memory ? Same question for
> lookup directly in task.

It will be evaluated twice. In general the expansions "{{ }}" will be "lazy"
evaluated when referenced.

> By the way, have you any advice in order to not store vault secret in memory.

As described, the value is not stored in memory for longer time than needed, I
think.

You're welcome. Cheers,

-vlado

[Quentin Aveno]

Ok, thank you very much for your explanation.
Have a nice day !