On Sat, 11 Jul 2020 17:06:46 -0700
Tony Wong <
tdub...@gmail.com> wrote:
> How do I not have to enter my vault password?
>
> I can only get this playbook to work with
> ansible-playbook httpd.yml --ask-vault-pass
> and entering my vault password
> When I run the playbook with
> -vault-password-file
>
> I get
> [WARNING]: Error in vault password file loading (default): A vault password
> must be specified to decrypt data
> ERROR! A vault password must be specified to decrypt data
"--vault-password-file" should work. Is it the leading double dash missing
which causes the problem?
See "Providing Vault Passwords"
https://docs.ansible.com/ansible/latest/user_guide/vault.html#providing-vault-passwords
For example, export the environment variable ANSIBLE_VAULT_PASSWORD_FILE
shell> cat ~/.vault_pass
my secret vault password
shell> export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass
shell> cat vault.yml
test_var: my decrypted test variable
shell> ansible-vault encrypt vault.yml
Encryption successful
shell> cat vault.yml
$ANSIBLE_VAULT;1.1;AES256
31396664626266393563666663383564396130373763666461353063393663306661363237323936
6531356261303835356538386635623232353765393935620a626438303433323139613331303461
38393263613166383935633065613931386330313138346434343234346439643865343062663230
3034316462633364630a353639373438633630376536373964346162353438373832326139633330
33393963383139653930363364393664373638356266663038343961393665636634666433326535
3462326364393361636232306130393138343635396438383661
shell> cat playbook.yml
- hosts: localhost
vars_files:
- vault.yml
tasks:
- debug:
var: test_var
shell> ansible-playbook playbook.yml
...
ok: [localhost] =>
test_var: my decrypted test variable
The same decryption shall also work with "--vault-password-file". Let's unset
the environment variable first
shell> unset ANSIBLE_VAULT_PASSWORD_FILE
shell> set | grep ANSIBLE
shell> ansible-playbook playbook.yml --vault-password-file ~/.vault_pass
...
ok: [localhost] =>
test_var: my decrypted test variable
Last option is to configure the path to the file with the vault password in
the configuration file. See "vault_password_file"
https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-vault-password-file
HTH,
-vlado
--
Vladimir Botka