ansible-collections/community.general
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2025-07-28 23:51:23 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Support multiple vault passwords (#22756)

Browse source 
Fixes #13243

** Add --vault-id to name/identify multiple vault passwords

Use --vault-id to indicate id and path/type

 --vault-id=prompt  # prompt for default vault id password
 --vault-id=myorg@prompt  # prompt for a vault_id named 'myorg'
 --vault-id=a_password_file  # load ./a_password_file for default id
 --vault-id=myorg@a_password_file # load file for 'myorg' vault id

vault_id's are created implicitly for existing --vault-password-file
and --ask-vault-pass options.

Vault ids are just for UX purposes and bookkeeping. Only the vault
payload and the password bytestring is needed to decrypt a
vault blob.

Replace passing password around everywhere with
a VaultSecrets object.

If we specify a vault_id, mention that in password prompts

Specifying multiple -vault-password-files will
now try each until one works

** Rev vault format in a backwards compatible way

The 1.2 vault format adds the vault_id to the header line
of the vault text. This is backwards compatible with older
versions of ansible. Old versions will just ignore it and
treat it as the default (and only) vault id.

Note: only 2.4+ supports multiple vault passwords, so while
earlier ansible versions can read the vault-1.2 format, it
does not make them magically support multiple vault passwords.

use 1.1 format for 'default' vault_id

Vaulted items that need to include a vault_id will be
written in 1.2 format.

If we set a new DEFAULT_VAULT_IDENTITY, then the default will
use version 1.2

vault will only use a vault_id if one is specified. So if none
is specified and C.DEFAULT_VAULT_IDENTITY is 'default'
we use the old format.

** Changes/refactors needed to implement multiple vault passwords

raise exceptions on decrypt fail, check vault id early

split out parsing the vault plaintext envelope (with the
sha/original plaintext) to _split_plaintext_envelope()

some cli fixups for specifying multiple paths in
the unfrack_paths optparse callback

fix py3 dict.keys() 'dict_keys object is not indexable' error

pluralize cli.options.vault_password_file -> vault_password_files
pluralize cli.options.new_vault_password_file -> new_vault_password_files
pluralize cli.options.vault_id -> cli.options.vault_ids

** Add a config option (vault_id_match) to force vault id matching.

With 'vault_id_match=True' and an ansible
vault that provides a vault_id, then decryption will require
that a matching vault_id is required. (via
--vault-id=my_vault_id@password_file, for ex).

In other words, if the config option is true, then only
the vault secrets with matching vault ids are candidates for
decrypting a vault. If option is false (the default), then
all of the provided vault secrets will be selected.

If a user doesn't want all vault secrets to be tried to
decrypt any vault content, they can enable this option.

Note: The vault id used for the match is not encrypted or
cryptographically signed. It is just a label/id/nickname used
for referencing a specific vault secret.
This commit is contained in:
Adrian Likins 2017-07-28 15:20:58 -04:00 • committed by GitHub
commit 934b645191
34 changed files with 1922 additions and 345 deletions
Download patch file Download diff file Expand all files Collapse all files

1
test/integration/targets/vault/encrypted_file_encrypted_var_password Normal file
View file

@ -0,0 +1 @@
test-encrypted-file-password

1
test/integration/targets/vault/example1_password Normal file
View file

@ -0,0 +1 @@
example1

1
test/integration/targets/vault/example2_password Normal file
View file

@ -0,0 +1 @@
example2

1
test/integration/targets/vault/example3_password Normal file
View file

@ -0,0 +1 @@
example3

6
test/integration/targets/vault/format_1_2_AES256.yml Normal file
View file

@ -0,0 +1,6 @@
$ANSIBLE_VAULT;1.2;AES256;test_vault_id
30383835613535356232333534303264656530633664616233386138396563623939626136366537
3635323530646538626138383136636437616637616430610a386661346563346136326637656461
64393364343964633364336666333630383164643662343930663432316333633537353938376437
6134656262373731390a363166356461376663313532343733326438386632623930313366643038
6133

33
test/integration/targets/vault/password-script.py Executable file
View file

@ -0,0 +1,33 @@
#!/usr/bin/env python
#
# Ansible is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# Ansible is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
#
# ansible-vault is a script that encrypts/decrypts YAML files. See
# http://docs.ansible.com/playbooks_vault.html for more details.
from __future__ import (absolute_import, division, print_function)
__metaclass__ = type
import sys
PASSWORD = 'test-vault-password'
def main(args):
print(PASSWORD)
return 0
if __name__ == '__main__':
sys.exit(main(sys.argv[:]))

29
test/integration/targets/vault/roles/test_vault_embedded_ids/tasks/main.yml Normal file
View file

@ -0,0 +1,29 @@
---
- name: set a fact from vault_encrypted_example1_releases
set_fact:
example1_releases: "{{ vault_encrypted_example1_releases }}"
- name: Assert that a embedded vault of a multiline string with a vault id works
assert:
that:
- "vault_encrypted_example1_releases is defined"
- "example1_releases is defined"
- "example1_releases.startswith('Ansible Releases')"
# - '"{{ vault_encrypted_example1_releases }}" == "Setec Astronomy"'
- name: Assert that a embedded vault with a different vault id works
assert:
that:
- "vault_encrypted_example2_hello == 'Hello world'"
- name: Assert that a embedded vault with no vault id and format 1.2 works
assert:
that:
- "vault_encrypted_example3_foobar == 'Foobar'"
#- name: Assert that a multi line embedded vault works, including new line
# assert:
# that:
# - vault_encrypted_var == "Setec Astronomy\n"
# TODO: add a expected fail here
# - debug: var=vault_encrypted_one_line_var_with_embedded_template

194
test/integration/targets/vault/roles/test_vault_embedded_ids/vars/main.yml Normal file
View file

@ -0,0 +1,194 @@
vault_encrypted_example2_hello: !vault |
$ANSIBLE_VAULT;1.2;AES256;example2
30383930326535616363383537613266376364323738313835353566633533353364363837383638
3737633764613862343666346337353964613138653036610a313663393231386139343835626436
66633336303866323335616661366363333463616530326635383836656432396665313338313737
6539616630663262650a383762303362356438616261646564303230633930336563373566623235
3566
vault_encrypted_example1_releases: !vault |
$ANSIBLE_VAULT;1.2;AES256;example1
63643833646565393535303862343135326261343362396234656137313731313864316539616462
3333313439353638393963643535633835643035383331340a393639386166313838326336363032
65396565616531663839316132646230316561613865333437653666323034396337626431663931
3339363233356438350a363734616337306136376139346162376334343537613032633563666361
36386437356463616563646336393064626131363963643434376439346331663836663961353533
62343663623863663830663531663930636532653165636238636433373835623435313632313030
33333734343566393739393661383430623063323132303132306361666433386166633564626434
62666361653465616636646335353230373961393863373261633461303233313965346565643434
63383633303131643730366233383264373865376562623962636562343732343266636535356362
62396635613231336162393630343136663731366665623835303762636161393163373361383634
65333739326264346136333337363666396336353065366161316130653738356133646364316130
32346636386665633131376662356238386161373565336430623263353036323561633235303135
35333031316366373636326665656230343934383334303863643364613364663436383030373237
35323964376564313636643633303262633033363633663966393535613064343364313161383061
66393733366463393936663033633038653465636539356266353936373162303661613962393662
61313534643064366432333166666130663730653333613964316130363135646532303531376537
63313339623337363464343637323431336438636337386264303961333139326666306365363937
36386437343036346165366439636533666237393535316536333966376536623030643663343561
64626362363736316234356639663039396634653766646237376636653062383530366562323138
61343537616263373137613232393731363866653038633932643163633732326463656365346535
63316337346636326631326134633339363133393337393035333730663133646332343536636337
36626566633162333463613735656564393764356337346535646539373536363933326139626239
35386434663636343366303830663531616530616563343737653761616232303865626634646537
38383430366131396133636530383865356430343965633062373366383261383231663162323566
30373061366533643938383363333266636463383134393264343662623465323164356464666364
35636135316333636266313038613239616638343761326332663933356164323635653861346430
65616661353162633765666633393139613830626535633462633166376563313236623465626339
38663138633664613738656166356431343438653833623132383330656637343661616432623362
66643466343663306434353237343737633535343233653765356134373739316234353836303034
37336435376135363362323130316338316135633633303861303665393766616537356666653238
63366461383334356666633134616436663731633666323261393761363264333430366234353732
66333732373236303338333862626537326638393964363965303532353465613638393934313538
66323366353064666334626461313933333961613637663332656131383038393264636537643730
35626265346363393665663431663036633461613362343330643133333232326664623833626336
65353363373962383561396163653361663736383235376661626132386131353137303764623231
63326538623231396366356432663537333331343335633531326331616531313039393335313139
65376461323434383065383834626535393063363432326233383930626437343961313538303135
39386561623662333335313661636637656336353537313466386239613166396436626630376337
36633739326336366530643733393962633737343035346536366336643266346162333931633235
66643966626262343862393832663132356435343561646634373835306130623637633836633166
30313732333963383565373261306232663365363033376431313437326366656264346532666561
63386231636634613235333363326166616238613734643739343237303963663539633535356232
66393365616165393130356561363733313735336132336166353839303230643437643165353338
39663138313130366635386365663830336365646562666635323361373362626339306536313664
32383934623533373361666536326131316630616661623839666137656330306433326637386134
34393162343535633438643036613831303265646632383231306239646132393338663564653939
63613232646230616338316434376663613266303362386631353733623335643034356631383139
62613932396132636339393337383065613061306162633831386236323163633439303263393663
38616237313761306533636361386161666264333839616463386631633233343132373732636639
61326239383961656437646236656336303638656665316633643630393063373964323534643961
39383538303234343438363736373136316464643165383361336262303231353937316432366639
36613662393736386433356532626162643462313234316230643639333535653064303830373166
31393332336539313362373136326639386566343637623633396134643533393839353934613064
65396233353363393763363231633462663537626165646666633937343733653932633733313237
31323633326463333938343062626361313761646133633865623130323665336634356364366566
31626562373662313064306239356336376136306336643961323839313964393734343265306137
62663563306665636463356465663432346331323832666163623530666265393164336466383936
64653831316162313861373462643264373965623632653430373439656535636365383066643464
61366436613631386161306631386331656632636337653864343261643433363438396361373831
37363532346564343562356132306432303933643431636539303039306638356537353237323036
63366334623438393838383561383937313330303832326330326366303264303437646666613638
37653266633362636330656666303437323138346666373265663466616635326366313233323430
62616165626239363833613565326264373063376232303837363062616663333461373062323266
32626636316465666230626634396431323032323962313437323837336562313438346634656335
33613566636461663334623966646465623531653631653565333836613261633534393439613738
66356364383637666465336666333962393735643766633836383833396533626635633734326136
65656562366337326161303466336232646533346135353332643030383433643662363465633931
63323761623537383438333837333733363263663630336264376239336234663866633131376463
66663438313439643565316138383439353839366365393238376439626537656535643739373237
66666266366533393738363138613437666435366163643835383830643333323730303537313139
32313436663932633933353265356431336138306437353936363638643539383236323232326630
62323963626138633865376238666264666531613237636232373938303030393632643230336138
38663237646637616232343664396136376534313533613364663062356535313766343331616431
36616237336532333239386663643538643239613866393631393364306463303131643863363533
31356436373062666266656431643038323766383632613939616539663637623164323161633464
39666663353339383164363534616330323936333865663564646334373438303061656662656331
37633530663666323834383333623136633164326632313938643234326235616461323734353638
63393365313334646538373631643266383936333533383630623861343764373863346161316333
38356466626234653336326433353234613430623135343739323433326435373663363237643531
36626238613832633661343263383962373536353766653631323431393330623634656166333437
66376537643836626264383961303465363035336666306165316631316661366637303361656332
36616463626135653235393562343464353262616331326539316361393036623134623361383635
39383565313433653139663963306362373233313738613933626563333230656239613462363164
65396539333833633137313163396635373433303164633463383935663939343266396366666231
30353434323837343563613662643632386662616363646630353530386466643939623866626331
63613266366135646562653064333166356561626138343364373631376336393931313262323063
32653938333837366231343865656239353433663537313763376132613366363333313137323065
31666663656539333438343664323062323238353061663439326333366162303636626634313037
38366631306438393333356138393730316161336233656239626565366134643535383536613034
37343733663631663863643337373462633462666234393063336330306465366637653136393533
63336535316438303564613366343565363831666233626466623161356635363464343634303136
61616561393861393036353433356364376533656334326433323934643236346133363535613334
32626332653362313731643035653335383164303534616537333132356535376233343566313736
39353037636530376338383739366230346134643738313037386438613461323934663537666164
66353330303730336435313735343333316364373432313030396361343061343632653765646336
39666537366537343635396235373433363438393637663166666530356339316334313834363938
33393837336265353265303635663363353439343062316363643637623564353261643637306434
36393662363737316234323461373763663364356535313165656661613137396366386464663866
63653562313539313839613436653137663262346233626464616237373737373736306231383265
35323532373631613762616234386162643035613838376264343532396263626562623262363532
36303530353137616134346262646464633462646662323262633366393736383834616665666466
34393363353135616437346332386634396635363130623337653230666334303630653738633334
33316162326335373838643261656561303736363331316134363736393362313734346236306638
65343163646264643539643635633761393665623039653232623435383062363462346336613238
38306138353832306263356265316236303065626566643134373836303933323130303634393931
31633334373064353263353135656433623863636261633664646439336539343636656464306531
36373364323637393634623666353730626532613534343638663966313332636437383233303864
33356432613638303936653134373338626261353662653930333534643732656130653636316433
33653364373636613739353439383066646530303565383432356134396436306134643030643034
63323433396238636330383836396364613738616338356563633565613537313138346661636164
34333566393738343661663062346433396532613032663331313566333161396230343336346264
66333935316630653936346336366336303363376633623034346536643731313136363835303964
37346537373236343832306637653563386435363435333537393733333966643461623064316639
65323363343338326435633631303037623234303334353366303936373664383762316364663036
61353638376335333663343066303961616234336664313732366630343331613537633336316534
31656561626430383338353231376263383362333966666363316435373533613138323039363463
33363031373035316431353930626632666165376538303638353631303931326262386363376330
36333531303235306532363763313233616165646234343235306332383262663261366164623130
66613232636264636336313230303261626639316465383265373762346434616362383562633533
64346438653161306266663634623666646239383363313862383563386461626264383165373561
64383431653061393132623833653337643266663462666462366339363233353335386264383936
38396264373833343935653264373631626662653962353438313262633339316537306463663930
31613634613535346364643930613739383035336164303064653736663031633135613966656463
64333539643534376662666539653766666532333832333430346333613236356534643964383135
38326235626164663364366163353434613530306531343735353761396563326536636335326336
34613835333362346363623235316564363934333732646435373033613863346565353034306333
33643763363838656339396435316162616539623764366163376438656266353137633262613464
31393434646435623032383934373262666430616262353165343231666631666238653134396539
32323137616639306262366638366536366665633331653363643234643238656338316133613166
38343566623137353566306538616639363935303766633732633638356362373463616563663438
66346133636562373031316363616662663132636263653037343962313630313535396563313230
34613735663838613130346461343166663830623861393634353438376336363961326263333634
34646465326238636630316164316339333961333939363139623262396531303665383230363562
63626431333365663337323430653230613837396133636431303863366239303531653966653932
65363139366637623531306333363465386636366334383734353330626566346532653263633238
39383434346665323730366261316433303739313032653638636232666432323930653837643831
63393565306538663365616364326334306333346463343330316161616362323063666666373035
66383938383238353134386333343437623030363032303531643736353636643165373362363666
31363037613064633164346638306231663161626265663535363634336665656163636637393161
64313363373965396262386337613533393639353332316234643666613065343939393336366633
64303637323531393936386365316366656432346230653066306334626431366335353130663233
62303961663362623637303535333432313635303936363462336438663232333862303934383166
31626438623963346262376135633434643533316162376633353661356463616538363733346464
65646563626139356264363132616161303438653133353961636135333833376364333138353263
36613437373365666665643664343666366234636164626437396139393864653031396331303938
35323839646265393232326434616233323535396134346465363131366165373163353932363538
39353764623463393732346134656539353966643366653765663038323631373432663839396239
35623665623661326231643734346134623961663539363436323134333630306663653039653062
36623730663538666166363436616131363233643739393966333437643637303737383733356138
34343733623137326265343332326437316365346439316137663361373066333166383032396636
35623561626139666264373363363965383633653633656464393932666634353962623637643262
32323663303861376166656266653962643166326535363237316333663631323235333833636361
31633038353265386439313766313966633536346230646566633333646632383938363761373363
38353931343136633062303366643930323034616265653030643062333461616637366666336437
36346330636666313833346534363461336366393533346338653061356333653839623364336266
32373965346363613165383639366365396665353966393262393562353664623231326132363735
38386238336135306464366332353035613938313262323739326638623733663030656533383438
38316364393030376436313031613936363435633562633862323063643035383030313865396666
66646338316262653734633431393862626633643163313732343638313066646163353264653531
64346265656363323666656239333466313666373234626261633630653133316639313233303466
62353735626634616661396238356138343064386332366361643530613364366365663764393037
31613730313234393263653964376262373131383064393133636533656534343431613964663634
65656365393439306433313333346234333332346230666462633132313863623765306665306461
65633862656637646134353030393637353339646265613731646564333561313431346135626532
66646363383932636562343731626164633138386463356634353062323965376235383130633231
61623537333030383130623064356662356463646532613339303336666631366539613835646364
37636634353430386632656331313936393261643638326162376238326139643939636333366364
31626163376436336631
vault_encrypted_example3_foobar: !vault |
$ANSIBLE_VAULT;1.1;AES256
37336431373836376339373763306436396334623061366266353763363766313063363230636138
3665663061366436306232323636376261303064616339620a333365323266643364396136626665
62363862653134623665326635396563643832636234386266616436626334363839326434383431
3330373333366233380a363431386334636164643936313430623661633265346632343331373866
3732
# We dont have a secret for this vaulttext, but nothing references it
# so nothing should ever try to decrypt it. So this is testing that
# we dont require all vaulted vars to be decrypted.
vault_encrypted_example4_unknown_password: !vault |
$ANSIBLE_VAULT;1.1;AES256
64316436303566666563393931613833316533346539373635663031376664366131353264366132
3637623935356263643639313562366434383234633232660a353636666134353030646539643139
65376235333932353531356666363434313066366161383532363166653762326533323233623431
3934393962633637330a356337626634343736313339316365373239663031663938353063326665
30643339386131663336366531663031383030313936356631613432336338313962

1
test/integration/targets/vault/roles/test_vault_file_encrypted_embedded/README.md Normal file
View file

@ -0,0 +1 @@
file is encrypted with password of 'test-encrypted-file-password'

13
test/integration/targets/vault/roles/test_vault_file_encrypted_embedded/tasks/main.yml Normal file
View file

@ -0,0 +1,13 @@
---
- name: Assert that a vault encrypted file with embedded vault of a string with no newline works
assert:
that:
- '"{{ vault_file_encrypted_with_encrypted_one_line_var }}" == "Setec Astronomy"'
- name: Assert that a vault encrypted file with multi line embedded vault works, including new line
assert:
that:
- vault_file_encrypted_with_encrypted_var == "Setec Astronomy\n"
# TODO: add a expected fail here
# - debug: var=vault_encrypted_one_line_var_with_embedded_template

76
test/integration/targets/vault/roles/test_vault_file_encrypted_embedded/vars/main.yml Normal file
View file

@ -0,0 +1,76 @@
$ANSIBLE_VAULT;1.1;AES256
31613535653961393639346266636234373833316530373965356161373735666662613137386466
3365303539306132613861646362396161323962373839640a653030376530316136643961623665
65643665616338363432383264363730386538353635663339633932353933653132343430613332
6136663837306333370a643139336230663465346637663032613231656364316533613235623532
65643738663735636662363565313561646162343865393733663838393239646634633936336262
39626235616537663934363932323831376539666331353334386636663738643932306239663265
64646664616331643663326561386638393764313737303865326166373031336665663533373431
35353736346264616135656164636337363966323935643032646138366166636537333565306230
65646533623134393633623663336263393533613632663464653663313835306265333139646563
35393061343266343138333936646364333735373930666262376137396562356231393330313731
36363164623939393436363564353162373364626536376434626463343161646437316665613662
38343534363965373735316339643061333931666264353566316235616433666536313065306132
31623933633533366162323961343662323364353065316235303162306635663435663066393865
64356634363761333838326331343865653633396665353638633730663134313565653166656131
33366464396532313635326237363135316230663838393030303963616161393966393836633237
30333338343031366235396438663838633136666563646161363332663533626662663531653439
63643435383931663038613637346637383365336431646663366436626333313536396135636566
31373133363661636338376166356664353366343730373164663361623338383636336464373038
36306437363139346233623036636330333664323165636538666138306465653435666132623835
30363266333666626363366465313165643761396562653761313764616562666439366437623766
33343666623866653461376137353731356530363732386261383863666439333735666638653533
38393430323961356333383464643036383739663064633461363937336538373539666662653764
36376266333230666232396665616434303432653562353131383430643533623932363537346435
33326335663561643564663936323832376634336363373531363666333732643363646130383464
30656366633863643966656134653833343634383136363539366330336261313736343838663936
39333835353035386664633331303264356339613933393162393037306565636563386436633532
34376564343237303166613461383963353030383166326538643932323130643830376165366564
30366432623761623366653966313865653262363064316130393339393366323539373338306265
31626564393065303032383161343137636432353061333964613935363865356139313766303039
32333863353465306265653237396232383330333438303866316362353161383266316633663364
66353130326237376331656334633965633339303138656263616239323261663864666236323662
33643463303965313264396463333963376464313838373765633463396534363836366132653437
30303132633232623265303966316639373664656262636166653438323534326435363966616133
33663463626536643930623034343237613933623462346635306565623834346532613539383838
39356339303930663739333236316234666633623961323362323537313833383538363132636165
31396433386664356532383432666464613137376561396534316665386134333665626430373064
30626561363731326635393334633837303934653062616461303732316239663764633565353633
33336161623332383064376538353531343534333836313139376439316564313436623462396134
31643831656135653234396362653861643933346433646633383130323139353465616430383061
34623164376436326466333765353037323630356662646364366265303534313764393862653238
66376365323561643030343534636263386338333566613436383630613561646639616265313465
66336239303432666361383038323038383663346561356664626634333037313838363732643463
33373734663933373238363635623336323232313161353861306430323334353836616265623639
65613436323939643932383537666530306134633435373331623963633436386162306565656433
35383962633163643837343436383664313565656134646633393237353065666535316561613266
64653234366462623764313438666466616664303138656565663036376230323763393135323330
35383861306262356430656531343938643763306663323031636638383762626564616366393434
33373035363633396230396161623433336530326432343666346332613262376338313731626462
63616463363831333239643535383936646264336466616635353063383163306564373263656265
65383466653162626132633463613037343865316639653931633965323637373733653131666233
35643831646638383232616538656265663365306136343733633535323537653165636665383832
65303162656238303665346232353136346639316263636264346533356263353066353438323535
36303236326663303763653137656264336566646161663538383361306138323064336235616438
32373731643331373239383339326365366337646237643836373238656339646362366239623533
33306531353863653834666361393161366465626632643061363266353465653964363263613430
32323132613866343733376437643239316661313330323661633234343630626132383434343461
61663765383134666330316237633963323463363762383666323866386336316438373461306138
38613266346532313134386236386131626262663534313935623635343533383831386332343534
65333963353861656232383134396438613034663333633661346465636436373533346561306661
33656535613963663938313233333736343036393734373363316236373765343736633635386336
30323036393431363636316466393561626365366333623431353435633963613935346239666534
33623037306334343464633932313430616666633631313366356532643938333835333231313039
65363734336630303861626636613139663130616362333662616532313734393636353963643032
39626162623933616561383736636466316331346135613063383261373865366232376562316237
65393563633131653761646365313831646265316233343833653363626465363863363936316664
63363863363761353264316662643338656432356336326339623961396538643838666330303934
62343537653262353737316266366134623961323637613338303164383734613034383964623135
35646130363038356530383638663431663238336337313034303631366538326361646530626138
34653533383964353866653562666463333961313434373063333163346537636631393138316465
62656361613365366137346337363830356263633162623466373564346437653036386136333333
32323863393866373932353534343133306333303265336564383132616365363439393364336562
62333130343664343436356338623336643735373164373962313762333763343137626238316536
36376539666331376162376361646631396231306165316362343164616232393864656161393735
63313439643865346231346363376137306464396637356539353139343932333438323964323035
326532383066643037653036333166346238

183
test/integration/targets/vault/runme.sh
View file

@ -9,6 +9,9 @@ trap 'rm -rf "${MYTMPDIR}"' EXIT
TEST_FILE="${MYTMPDIR}/test_file"
echo "This is a test file" > "${TEST_FILE}"
TEST_FILE_1_2="${MYTMPDIR}/test_file_1_2"
echo "This is a test file for format 1.2" > "${TEST_FILE_1_2}"
TEST_FILE_OUTPUT="${MYTMPDIR}/test_file_output"
# old format
@ -38,13 +41,111 @@ set -eux
# new format, view
ansible-vault view "$@" --vault-password-file vault-password format_1_1_AES256.yml
# new format, view with vault-id
ansible-vault view "$@" --vault-id=vault-password format_1_1_AES256.yml
# new format, view, using password script
ansible-vault view "$@" --vault-password-file password-script.py format_1_1_AES256.yml
# new format, view, using password script with vault-id
ansible-vault view "$@" --vault-id password-script.py format_1_1_AES256.yml
# new 1.2 format, view
ansible-vault view "$@" --vault-password-file vault-password format_1_2_AES256.yml
# new 1.2 format, view with vault-id
ansible-vault view "$@" --vault-id=test_vault_id@vault-password format_1_2_AES256.yml
# new 1,2 format, view, using password script
ansible-vault view "$@" --vault-password-file password-script.py format_1_2_AES256.yml
# new 1.2 format, view, using password script with vault-id
ansible-vault view "$@" --vault-id password-script.py format_1_2_AES256.yml
# new 1.2 format, view, ENFORCE_IDENTITY_MATCH=true, should fail, no 'test_vault_id' vault_id
ANSIBLE_VAULT_ID_MATCH=1 ansible-vault view "$@" --vault-password-file vault-password format_1_2_AES256.yml && :
WRONG_RC=$?
echo "rc was $WRONG_RC (1 is expected)"
[ $WRONG_RC -eq 1 ]
# new 1.2 format, view with vault-id, ENFORCE_IDENTITY_MATCH=true, should work, 'test_vault_id' is provided
ANSIBLE_VAULT_ID_MATCH=1 ansible-vault view "$@" --vault-id=test_vault_id@vault-password format_1_2_AES256.yml
# new 1,2 format, view, using password script, ENFORCE_IDENTITY_MATCH=true, should fail, no 'test_vault_id'
ANSIBLE_VAULT_ID_MATCH=1 ansible-vault view "$@" --vault-password-file password-script.py format_1_2_AES256.yml && :
WRONG_RC=$?
echo "rc was $WRONG_RC (1 is expected)"
[ $WRONG_RC -eq 1 ]
# new 1.2 format, view, using password script with vault-id, ENFORCE_IDENTITY_MATCH=true, should fail
ANSIBLE_VAULT_ID_MATCH=1 ansible-vault view "$@" --vault-id password-script.py format_1_2_AES256.yml && :
WRONG_RC=$?
echo "rc was $WRONG_RC (1 is expected)"
[ $WRONG_RC -eq 1 ]
# new 1.2 format, view, using password script with vault-id, ENFORCE_IDENTITY_MATCH=true, 'test_vault_id' provided should work
ANSIBLE_VAULT_ID_MATCH=1 ansible-vault view "$@" --vault-id=test_vault_id@password-script.py format_1_2_AES256.yml
# encrypt it
ansible-vault encrypt "$@" --vault-password-file vault-password "${TEST_FILE}"
ansible-vault view "$@" --vault-password-file vault-password "${TEST_FILE}"
# view with multiple vault-password files, including a wrong one
ansible-vault view "$@" --vault-password-file vault-password --vault-password-file vault-password-wrong "${TEST_FILE}"
# view with multiple vault-password files, including a wrong one, using vault-id
ansible-vault view "$@" --vault-id vault-password --vault-id vault-password-wrong "${TEST_FILE}"
# And with the password files specified in a different order
ansible-vault view "$@" --vault-password-file vault-password-wrong --vault-password-file vault-password "${TEST_FILE}"
# And with the password files specified in a different order, using vault-id
ansible-vault view "$@" --vault-id vault-password-wrong --vault-id vault-password "${TEST_FILE}"
# And with the password files specified in a different order, using --vault-id and non default vault_ids
ansible-vault view "$@" --vault-id test_vault_id@vault-password-wrong --vault-id test_vault_id@vault-password "${TEST_FILE}"
ansible-vault decrypt "$@" --vault-password-file vault-password "${TEST_FILE}"
# encrypt it, using a vault_id so we write a 1.2 format file
ansible-vault encrypt "$@" --vault-id test_vault_1_2@vault-password "${TEST_FILE_1_2}"
ansible-vault view "$@" --vault-id vault-password "${TEST_FILE_1_2}"
ansible-vault view "$@" --vault-id test_vault_1_2@vault-password "${TEST_FILE_1_2}"
# view with multiple vault-password files, including a wrong one
ansible-vault view "$@" --vault-id vault-password --vault-id wrong_password@vault-password-wrong "${TEST_FILE_1_2}"
# And with the password files specified in a different order, using vault-id
ansible-vault view "$@" --vault-id vault-password-wrong --vault-id vault-password "${TEST_FILE_1_2}"
# And with the password files specified in a different order, using --vault-id and non default vault_ids
ansible-vault view "$@" --vault-id test_vault_id@vault-password-wrong --vault-id test_vault_id@vault-password "${TEST_FILE_1_2}"
ansible-vault decrypt "$@" --vault-id test_vault_1_2@vault-password "${TEST_FILE_1_2}"
# multiple vault passwords
ansible-vault view "$@" --vault-password-file vault-password --vault-password-file vault-password-wrong format_1_1_AES256.yml
# multiple vault passwords, --vault-id
ansible-vault view "$@" --vault-id test_vault_id@vault-password --vault-id test_vault_id@vault-password-wrong format_1_1_AES256.yml
# encrypt it, with password from password script
ansible-vault encrypt "$@" --vault-password-file password-script.py "${TEST_FILE}"
ansible-vault view "$@" --vault-password-file password-script.py "${TEST_FILE}"
ansible-vault decrypt "$@" --vault-password-file password-script.py "${TEST_FILE}"
# encrypt it, with password from password script
ansible-vault encrypt "$@" --vault-id test_vault_id@password-script.py "${TEST_FILE}"
ansible-vault view "$@" --vault-id test_vault_id@password-script.py "${TEST_FILE}"
ansible-vault decrypt "$@" --vault-id test_vault_id@password-script.py "${TEST_FILE}"
# new password file for rekeyed file
NEW_VAULT_PASSWORD="${MYTMPDIR}/new-vault-password"
echo "newpassword" > "${NEW_VAULT_PASSWORD}"
@ -55,6 +156,18 @@ ansible-vault rekey "$@" --vault-password-file vault-password --new-vault-passwo
ansible-vault view "$@" --vault-password-file "${NEW_VAULT_PASSWORD}" "${TEST_FILE}"
# view with old password file and new password file
ansible-vault view "$@" --vault-password-file "${NEW_VAULT_PASSWORD}" --vault-password-file vault-password "${TEST_FILE}"
# view with old password file and new password file, different order
ansible-vault view "$@" --vault-password-file vault-password --vault-password-file "${NEW_VAULT_PASSWORD}" "${TEST_FILE}"
# view with old password file and new password file and another wrong
ansible-vault view "$@" --vault-password-file "${NEW_VAULT_PASSWORD}" --vault-password-file vault-password-wrong --vault-password-file vault-password "${TEST_FILE}"
# view with old password file and new password file and another wrong, using --vault-id
ansible-vault view "$@" --vault-id "tmp_new_password@${NEW_VAULT_PASSWORD}" --vault-id wrong_password@vault-password-wrong --vault-id myorg@vault-password "${TEST_FILE}"
ansible-vault decrypt "$@" --vault-password-file "${NEW_VAULT_PASSWORD}" "${TEST_FILE}"
# reading/writing to/from stdin/stdin (See https://github.com/ansible/ansible/issues/23567)
@ -66,6 +179,10 @@ ansible-vault encrypt_string "$@" --vault-password-file "${NEW_VAULT_PASSWORD}"
ansible-vault encrypt_string "$@" --vault-password-file "${NEW_VAULT_PASSWORD}" --name "blippy" "a test string names blippy"
ansible-vault encrypt_string "$@" --vault-id "${NEW_VAULT_PASSWORD}" "a test string"
ansible-vault encrypt_string "$@" --vault-id "${NEW_VAULT_PASSWORD}" --name "blippy" "a test string names blippy"
# from stdin
ansible-vault encrypt_string "$@" --vault-password-file "${NEW_VAULT_PASSWORD}" < "${TEST_FILE}"
@ -85,3 +202,69 @@ ansible-playbook test_vault_embedded.yml -i ../../inventory -v "$@" --vault-pass
ansible-playbook test_vault_embedded.yml -i ../../inventory -v "$@" --vault-password-file vault-password
ansible-playbook test_vaulted_inventory.yml -i vaulted.inventory -v "$@" --vault-password-file vault-password
ansible-playbook test_vaulted_template.yml -i ../../inventory -v "$@" --vault-password-file vault-password
# test with password from password script
ansible-playbook test_vault.yml -i ../../inventory -v "$@" --vault-password-file password-script.py
ansible-playbook test_vault_embedded.yml -i ../../inventory -v "$@" --vault-password-file password-script.py
# with multiple password files
ansible-playbook test_vault.yml -i ../../inventory -v "$@" --vault-password-file vault-password --vault-password-file vault-password-wrong
ansible-playbook test_vault.yml -i ../../inventory -v "$@" --vault-password-file vault-password-wrong --vault-password-file vault-password
ansible-playbook test_vault_embedded.yml -i ../../inventory -v "$@" --vault-password-file vault-password --vault-password-file vault-password-wrong --syntax-check
ansible-playbook test_vault_embedded.yml -i ../../inventory -v "$@" --vault-password-file vault-password-wrong --vault-password-file vault-password
# test that we can have a vault encrypted yaml file that includes embedded vault vars
# that were encrypted with a different vault secret
ansible-playbook test_vault_file_encrypted_embedded.yml -i ../../inventory "$@" --vault-id encrypted_file_encrypted_var_password --vault-id vault-password
# with multiple password files, --vault-id, ordering
ansible-playbook test_vault.yml -i ../../inventory -v "$@" --vault-id vault-password --vault-id vault-password-wrong
ansible-playbook test_vault.yml -i ../../inventory -v "$@" --vault-id vault-password-wrong --vault-id vault-password
ansible-playbook test_vault_embedded.yml -i ../../inventory -v "$@" --vault-id vault-password --vault-id vault-password-wrong --syntax-check
ansible-playbook test_vault_embedded.yml -i ../../inventory -v "$@" --vault-id vault-password-wrong --vault-id vault-password
# test with multiple password files, including a script, and a wrong password
ansible-playbook test_vault_embedded.yml -i ../../inventory -v "$@" --vault-password-file vault-password-wrong --vault-password-file password-script.py --vault-password-file vault-password
# test with multiple password files, including a script, and a wrong password, and a mix of --vault-id and --vault-password-file
ansible-playbook test_vault_embedded.yml -i ../../inventory -v "$@" --vault-password-file vault-password-wrong --vault-id password-script.py --vault-id vault-password
# test with multiple password files, including a script, and a wrong password, and a mix of --vault-id and --vault-password-file
ansible-playbook test_vault_embedded_ids.yml -i ../../inventory -v "$@" \
--vault-password-file vault-password-wrong \
--vault-id password-script.py --vault-id example1@example1_password \
--vault-id example2@example2_password --vault-password-file example3_password \
--vault-id vault-password
# with wrong password
ansible-playbook test_vault.yml -i ../../inventory -v "$@" --vault-password-file vault-password-wrong && :
WRONG_RC=$?
echo "rc was $WRONG_RC (1 is expected)"
[ $WRONG_RC -eq 1 ]
# with multiple wrong passwords
ansible-playbook test_vault.yml -i ../../inventory -v "$@" --vault-password-file vault-password-wrong --vault-password-file vault-password-wrong && :
WRONG_RC=$?
echo "rc was $WRONG_RC (1 is expected)"
[ $WRONG_RC -eq 1 ]
# with wrong password, --vault-id
ansible-playbook test_vault.yml -i ../../inventory -v "$@" --vault-id vault-password-wrong && :
WRONG_RC=$?
echo "rc was $WRONG_RC (1 is expected)"
[ $WRONG_RC -eq 1 ]
# with multiple wrong passwords with --vault-id
ansible-playbook test_vault.yml -i ../../inventory -v "$@" --vault-id vault-password-wrong --vault-id vault-password-wrong && :
WRONG_RC=$?
echo "rc was $WRONG_RC (1 is expected)"
[ $WRONG_RC -eq 1 ]
# with multiple wrong passwords with --vault-id
ansible-playbook test_vault.yml -i ../../inventory -v "$@" --vault-id wrong1@vault-password-wrong --vault-id wrong2@vault-password-wrong && :
WRONG_RC=$?
echo "rc was $WRONG_RC (1 is expected)"
[ $WRONG_RC -eq 1 ]

4
test/integration/targets/vault/test_vault_embedded_ids.yml Normal file
View file

@ -0,0 +1,4 @@
- hosts: testhost
gather_facts: False
roles:
- { role: test_vault_embedded_ids, tags: test_vault_embedded_ids}

4
test/integration/targets/vault/test_vault_file_encrypted_embedded.yml Normal file
View file

@ -0,0 +1,4 @@
- hosts: testhost
gather_facts: False
roles:
- { role: test_vault_file_encrypted_embedded, tags: test_vault_file_encrypted_embedded}