Is it possible to reference a vault secret as a variable?

[Br4v3St4rr]

As above is it possible to reference a vault secret as a variable in a playbook?

e.g.

      Credential_username: '{{ some_user }}'
      Credential_password: '{{ some_pass }}'

Where some_pass is in the vault?

[fiftin]

No, currently not. I planning to implement passing secrets via variables.

[coreyman2000]

Hi just wounder when its would be planned, trying deploy some VMs from vmware, and it looks like variable for the password, which i dont really want to use :(

[nuuantoine]

Yes it is possible
Create a var file like that :

---
var1: value1
var2: value2
var3: value3

Then encrypted it using ansible-vault encrypt yourfile.yml, your file will be encrypted and look like this :

$ANSIBLE_VAULT;1.1;AES256
35303934343462646664663661613832366264623038333638336165663633333532643532616663
3964363565353264393762363934343164316337306461650a306139643534323163383335636565
64323231666563343630323635666665636331373832626436633964326234393130653836656563
3533383034616664610a646666393738663935666131613935303434666430396336663032366364
32313261313332383637646366373838363863613237393961343366323630363730363935306265
64636262626438623735633066386236393331373638366630626531393263336138303439323838
65653632623736613031663731643032353261666166336639663463386461383065633462346636
62643766653063386661356631613566343130373637616433323931363931343433316165336135
3538

You can either integrate that part to your playbook or use ansible.builtin.include_vars to load your encrypted var file.

Then you put your file password (the one you used to encrypt your file) in semaphore vault without login information and your file will be decrypted at runtime and will replace your variable {{ var1 }} {{ var2 }} {{ var3 }}

I don't know if it helps but that's how I solve my issue.

[coreyman2000]

thanks pwd is clear text when you debug tho :(

[nuuantoine]

nothing ain't perfect.
At the moment it is the only way I know and it works almost flawlesly.
But the more I dig the less I think I will rely on semaphore it feels too young to be production ready.

[laurentchades]

you can prevent logs for some tasks if you want to avoid this. use no_log: True where relevant.

see at the end f this page for an example : https://www.redhat.com/sysadmin/ansible-playbooks-secrets?utm_source=pocket_saves