Skip to content

Instantly share code, notes, and snippets.

@toke

toke/ansible-vault-pass.bash

Last active October 24, 2021 21:38
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save toke/ebc49b7dd08d7b87e23921029176d3f5 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save toke/ebc49b7dd08d7b87e23921029176d3f5 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. toke revised this gist Mar 13, 2017. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion ansible-vault-pass.bash
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    #!/bin/bash
    #!/usr/bin/env bash
    set -e

    #
  2. toke revised this gist Nov 1, 2016. 1 changed file with 3 additions and 1 deletion.
    4 changes: 3 additions & 1 deletion ansible-vault-pass.py
    View file
    Original file line number Diff line number Diff line change
    @@ -3,7 +3,9 @@
    ansible_vault_pass
    A small helper script for usage with ansible-vault and ansible-playbook
    together with pass
    together with pass.
    Written by Thomas Kerpe <[email protected]> - Public Domain
    Say you have stored the vault-password for the current ansible playbook in pass
    under the name ansible/demo/vault then either add a .pass_path file with the content
  3. toke revised this gist Nov 1, 2016. No changes.
  4. toke revised this gist Nov 1, 2016. 1 changed file with 5 additions and 1 deletion.
    6 changes: 5 additions & 1 deletion ansible-vault-pass.py
    View file
    Original file line number Diff line number Diff line change
    @@ -21,7 +21,11 @@
    ansible-vault edit --vault-password-file ~/bin/ansible-vault-pass example.yml
    Even more practical: export ANSIBLE_VAULT_PASSWORD_FILE=~/bin/ansible-vault-pass then it will be used by default without specifying it. It is also useful in CI environments.
    Even more practical:
    export ANSIBLE_VAULT_PASSWORD_FILE=~/bin/ansible-vault-pass
    then it will be used by default without specifying it. It is also useful in CI environments.
    Source: https://gist.github.com/toke/ebc49b7dd08d7b87e23921029176d3f5
    """
  5. toke revised this gist Nov 1, 2016. No changes.
  6. toke revised this gist Nov 1, 2016. No changes.
  7. toke revised this gist Oct 31, 2016. 1 changed file with 50 additions and 20 deletions.
    70 changes: 50 additions & 20 deletions ansible-vault-pass.py
    View file
    Original file line number Diff line number Diff line change
    @@ -1,30 +1,60 @@
    #!/usr/bin/env python
    #
    # More robust version of ansible-vault-pass.bash written in python
    #
    #
    #!/usr/bin/env python2
    """
    ansible_vault_pass
    A small helper script for usage with ansible-vault and ansible-playbook
    together with pass
    Say you have stored the vault-password for the current ansible playbook in pass
    under the name ansible/demo/vault then either add a .pass_path file with the content
    ansible/demo/vault or add a entry in the ansible.cfg:
    [pass]
    vault=ansible/demo/vault
    Now you can call ansible-vault-pass to get the password for the vault.
    It is especially useful like this:
    ansible-playbook site.yml --vault-password-file ~/bin/ansible-vault-pass
    or
    ansible-vault edit --vault-password-file ~/bin/ansible-vault-pass example.yml
    Even more practical: export ANSIBLE_VAULT_PASSWORD_FILE=~/bin/ansible-vault-pass then it will be used by default without specifying it. It is also useful in CI environments.
    Source: https://gist.github.com/toke/ebc49b7dd08d7b87e23921029176d3f5
    """

    import os.path
    import subprocess
    import ansible.constants
    from ConfigParser import NoOptionError, NoSectionError


    pass_name = ""
    def get_vault_password():
    """
    The magic happenz
    """

    if os.path.isfile(".pass_path"):
    with open(".pass_path") as f:
    pass_name = f.read()
    elif ansible.constants.CONFIG_FILE:
    try:
    pass_name = ansible.constants.p.get("pass", "vault")
    except NoOptionError:
    pass
    except NoSectionError:
    pass_name = ""

    if os.path.isfile(".pass_path"):
    with open(".pass_path") as f:
    pass_name = f.read()
    elif ansible.constants.CONFIG_FILE:
    try:
    pass_name = ansible.constants.p.get("pass", "vault")
    except NoOptionError:
    pass
    except NoSectionError:
    pass
    else:
    pass
    else:
    pass

    if pass_name:
    c = subprocess.call(["pass", pass_name])
    exit(c)
    if pass_name:
    c = subprocess.call(["pass", pass_name])
    exit(c)

    if __name__ == '__main__':
    get_vault_password()
  8. toke revised this gist Oct 31, 2016. 1 changed file with 30 additions and 0 deletions.
    30 changes: 30 additions & 0 deletions ansible-vault-pass.py
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,30 @@
    #!/usr/bin/env python
    #
    # More robust version of ansible-vault-pass.bash written in python
    #
    #

    import os.path
    import subprocess
    import ansible.constants
    from ConfigParser import NoOptionError, NoSectionError


    pass_name = ""

    if os.path.isfile(".pass_path"):
    with open(".pass_path") as f:
    pass_name = f.read()
    elif ansible.constants.CONFIG_FILE:
    try:
    pass_name = ansible.constants.p.get("pass", "vault")
    except NoOptionError:
    pass
    except NoSectionError:
    pass
    else:
    pass

    if pass_name:
    c = subprocess.call(["pass", pass_name])
    exit(c)
  9. toke revised this gist Oct 31, 2016. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions ansible-vault-pass.bash
    View file
    Original file line number Diff line number Diff line change
    @@ -27,11 +27,11 @@ if [ -e .pass_path ] ; then
    elif [ -e ansible.cfg ] ; then
    p=$(git config -f ansible.cfg --get pass.vault)
    else
    exit 1
    exit 0
    fi

    if [ ! -z "$p" ] ; then
    exec pass "$p"
    else
    exit 0
    exit 1
    fi
  10. toke revised this gist Oct 31, 2016. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion ansible-vault-pass.bash
    View file
    Original file line number Diff line number Diff line change
    @@ -33,5 +33,5 @@ fi
    if [ ! -z "$p" ] ; then
    exec pass "$p"
    else
    exit 1
    exit 0
    fi
  11. toke revised this gist Oct 29, 2016. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion ansible-vault-pass.bash
    View file
    Original file line number Diff line number Diff line change
    @@ -18,7 +18,7 @@ set -e
    # like this:
    # `ansible-playbook site.yml --vault-password-file ~/bin/ansible-vault-pass`
    # or `ansible-vault edit --vault-password-file ~/bin/ansible-vault-pass example.yml`
    # Even more practival: `export ANSIBLE_VAULT_PASSWORD_FILE=~/bin/ansible-vault-pass` then it will
    # Even more practical: `export ANSIBLE_VAULT_PASSWORD_FILE=~/bin/ansible-vault-pass` then it will
    # be used by default without specifying it.


  12. toke revised this gist Oct 29, 2016. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion ansible-vault-pass.bash
    View file
    Original file line number Diff line number Diff line change
    @@ -1,11 +1,12 @@
    #!/bin/bash
    set -e

    #
    # Written by Thomas Kerpe <[email protected]> - Public Domain
    #
    # Small helper script for usage with ansible-vault and ansible-playbook
    # together with [pass](https://www.passwordstore.org/)
    #
    #
    # Say you have stored the vault-password for the current ansible playbook in pass
    # under the name `ansible/demo/vault` then either add a .pass_path file with the content
    # `ansible/demo/vault` or add a entry in the ansible.cfg:
  13. toke revised this gist Oct 29, 2016. 1 changed file with 0 additions and 4 deletions.
    4 changes: 0 additions & 4 deletions ansible-vault-pass.bash
    View file
    Original file line number Diff line number Diff line change
    @@ -34,7 +34,3 @@ if [ ! -z "$p" ] ; then
    else
    exit 1
    fi




  14. toke revised this gist Oct 29, 2016. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion ansible-vault-pass.bash
    View file
    Original file line number Diff line number Diff line change
    @@ -12,7 +12,7 @@
    # ```
    # [pass]
    # vault=ansible/demo/vault
    #
    # ```
    # Now you can call ansible-vault-pass to get the password for the vault. It is especially useful
    # like this:
    # `ansible-playbook site.yml --vault-password-file ~/bin/ansible-vault-pass`
  15. toke revised this gist Oct 29, 2016. No changes.
  16. toke revised this gist Oct 29, 2016. No changes.
  17. toke revised this gist Oct 29, 2016. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion ansible-vault-pass.bash
    View file
    Original file line number Diff line number Diff line change
    @@ -3,7 +3,8 @@
    #
    # Written by Thomas Kerpe <[email protected]> - Public Domain
    #
    # Small helper script for usage with ansible-vault and ansible-playbook together with pass
    # Small helper script for usage with ansible-vault and ansible-playbook
    # together with [pass](https://www.passwordstore.org/)
    #
    # Say you have stored the vault-password for the current ansible playbook in pass
    # under the name `ansible/demo/vault` then either add a .pass_path file with the content
  18. toke revised this gist Oct 29, 2016. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion ansible-vault-pass.bash
    View file
    Original file line number Diff line number Diff line change
    @@ -16,7 +16,8 @@
    # like this:
    # `ansible-playbook site.yml --vault-password-file ~/bin/ansible-vault-pass`
    # or `ansible-vault edit --vault-password-file ~/bin/ansible-vault-pass example.yml`
    #
    # Even more practival: `export ANSIBLE_VAULT_PASSWORD_FILE=~/bin/ansible-vault-pass` then it will
    # be used by default without specifying it.


    if [ -e .pass_path ] ; then
  19. toke created this gist Oct 29, 2016.
    38 changes: 38 additions & 0 deletions ansible-vault-pass.bash
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,38 @@
    #!/bin/bash

    #
    # Written by Thomas Kerpe <[email protected]> - Public Domain
    #
    # Small helper script for usage with ansible-vault and ansible-playbook together with pass
    #
    # Say you have stored the vault-password for the current ansible playbook in pass
    # under the name `ansible/demo/vault` then either add a .pass_path file with the content
    # `ansible/demo/vault` or add a entry in the ansible.cfg:
    # ```
    # [pass]
    # vault=ansible/demo/vault
    #
    # Now you can call ansible-vault-pass to get the password for the vault. It is especially useful
    # like this:
    # `ansible-playbook site.yml --vault-password-file ~/bin/ansible-vault-pass`
    # or `ansible-vault edit --vault-password-file ~/bin/ansible-vault-pass example.yml`
    #


    if [ -e .pass_path ] ; then
    p=$(cat .pass_path)
    elif [ -e ansible.cfg ] ; then
    p=$(git config -f ansible.cfg --get pass.vault)
    else
    exit 1
    fi

    if [ ! -z "$p" ] ; then
    exec pass "$p"
    else
    exit 1
    fi