Search code examples
ansibleansible-inventory

Can ansible vault encrypt values in plugin configuration files?

I'm writing a dynamic inventory plugin for ansible which pulls off device info from an API and adds it to the inventory. To configure my plugin, I need a username and password for the service which I retrieve from my plugin configuration yaml file

plugin_conf.yaml:

plugin: my_inventory_plugin
host_location: api.example.com
port: 443
user: some_user
password: some_pass

Since storing credentials in a file under version control is bad, does ansible vault support capabilities to encrypt values stored in a plugin configuration file?

i.e can the user of my plugin do something like

plugin: my_inventory_plugin
host_location: api.example.com
port: 443
user: !vault|
          $FOO;1.1;AES256
          blah blah
password: !vault|
          $BAR;1.1;AES256
          something else

and regardless if they use insecure plaintext or the ansible vault, my plugin can still get the values using the self.get_option('user') method?

Solution

  • I tested it out myself and the answer is yes. If the user encrypts a string using ansible vault setting the name of the secret using -n, they can use the variable name into my config file. There are no special handling cases required in my plugin to handle plaintext credentials or ansible vault credentials.