CODEWITHSUNDEEP
encryptionansibleansible-vault
Petr
Petr

Reputation: 63379

How to check if an encrypted variable is decrypted?

I have an Ansible encrypted variable. Now I'd like to be able to run my playbook even when I don't unlock the variable (with --ask-vault-pass) and just skip the tasks that depend on it. Ideally with a warning saying that the task was skipped.

Now when I run my playbook without --ask-vault-pass, it fails with an error:

fatal: [...]: FAILED! => {"changed": false, "msg": "AnsibleError: An unhandled exception occurred while templating '{{ (samba_passwords | string | from_yaml)[samba_username] }}'. Error was a <class 'ansible.parsing.vault.AnsibleVaultError'>, original message: Attempting to decrypt bu t no vault secrets found"}

Is there a way how to check in the when: clause that an encrypted variable is not decrypted and thus inaccessible?

Upvotes: 1

Views: 1391

Answers (2)

Vladimir Botka
Vladimir Botka

Reputation: 68074

Q: "Check if an encrypted variable is decrypted. Skip the tasks that depend on it. Ideally with a warning saying that the task was skipped."

A: For example, given the file with the variable

shell> cat vars-test.yml
test_var1: test var1

Encrypt the file

shell> ansible-vault encrypt vars-test.yml
New Vault password: 
Confirm New Vault password: 
Encryption successful

shell> cat vars-test.yml
$ANSIBLE_VAULT;1.1;AES256
61373230346437306135303463393166323063656561623863306333313837666561653466393835
3738666532303836376139613766343930346263633032330a323336643061373039613330653237
30666364376266396633613162626536383161306262613062373239343232663935376364383431
6335623366613834360a336531656537626662376166323766376433653232633139383636613963
64356632633863353534323636313231633866613635343962383463636565303032

Then the playbook

shell> cat pb.yml
- hosts: test_01
  tasks:
    - include_vars: vars-test.yml
      ignore_errors: true
    - set_fact:
        test_var1: "{{ test_var1|default('default') }}"
    - name: Execute tasks if test_var1 was decrypted
      block:
        - debug:
            msg: Execute task1
        - debug:
            msg: Execute task2
      when: test_var1 != 'default'

gives (abridged)

shell> ansible-playbook pb.yml --ask-vault-pass

TASK [include_vars] ****
ok: [test_01]

TASK [set_fact] ****
ok: [test_01]

TASK [debug] ****
ok: [test_01] => 
  msg: Execute task1

TASK [debug] ****
ok: [test_01] => 
  msg: Execute task2

If you don't provide the command with the password the playbook gives (abridged)

shell> ansible-playbook pb.yml

PLAY [test_01] ****

TASK [include_vars] ****
fatal: [test_01]: FAILED! => changed=false 
  ansible_facts: {}
  ansible_included_var_files: []
  message: Attempting to decrypt but no vault secrets found
...ignoring

TASK [set_fact] ****
ok: [test_01]

TASK [debug] ****
skipping: [test_01]

TASK [debug] ****
skipping: [test_01]

Upvotes: 4

gary lopez
gary lopez

Reputation: 1954

I've researched but I haven't found anything to do that. The easy way to solve this case would be used ignore_errors: yes in the task.

Upvotes: 1

Related Questions