lvillani / ansible-tools Goto Github PK

If I checkout a project with already vaulted secrets to a new machine and try to provision:

$ ansible-playbook -i inventory/production machine.yml
Unable to find a password with name myvaultname.

Call myvaultname --set to save a password inside the keyring.
Unable to run ansible-vault-helper. Cannot continue.

However:

$ ansible-vault-helper myvaultname --set
usage: ansible-vault-helper [-h] [-u]
ansible-vault-helper: error: unrecognized arguments: jugu --set

At this point I am a bit confused, what binary should I call withmyvaultname --set parameters?

Looks like ansible-vault-helper -u fixes the situation but I am unsure whether that is actually the right command here?

It also gives a warning about changing the vault PW – my first thought on that was that it would actually change the encryption PW of the secret and re-encrypt them. But it actually changes (or creates) the PW used to access the vaulted secret file(s) to MacOS keychain. This is a tad confusing as well.

My ansible.cfg has:

[vault]
name = myvaultname

Ansible-vault syntax has changed and is incompatible with ansible-tools. Nowadays it expects the syntax ansible-vault edit --vault-password-file=/usr/local/bin/ansible-vault-helpers secret.yml. vaultify in ansible-tools tries to use the old format ansible-vault --vault-password-file=/usr/local/bin/ansible-vault-helper edit secret.yml, which causes this error:

usage: ansible-vault [-h] [--version] [-v] {create,decrypt,edit,view,encrypt,encrypt_string,rekey} ...
ansible-vault: error: unrecognized arguments: --vault-password-file=/usr/local/bin/ansible-vault-helper --vault-password-file=/usr/local/bin/ansible-vault-helper

Other commands like ansible-playbook still work.