3 ms·
Of course if you're putting the encryption password in ansible.cfg you might as well just leave the original file unencrypted.
by ams6110 9y ago
Of course if you're putting the encryption password in ansible.cfg you might as well just leave the original file unencrypted.
- finnh 9y agoThat's not what GP said. "vault-password-file" != "vault-password".
- Johnny555 9y agoEven if you do put a plaintext password into ansible.cfg, encrypting secrets in the playbook is still worthwhile so you don't commit them to your source code repository or accidentally share the secrets with the world when you publish your playbooks.
- linsomniac 9y agoThe parent's recommendation was to put a filename into the ansible.cfg, and that file could contain either the password, or a script that is then run which prints the password to stdout. For example, we have the script pull the password from a gpg-encrypted file.