How does Ansible determine which vault to use when there are multiple vaults?

user_10821378 0
Viewed 29

I have scoured through the web and the ansible documentation, but I have not been able to find an answer for this question.

Say the structure is as follows:

./playbooks/foo.yml
./hosts/HOST_NAME (Contains IP for a specific host)
./hosts/host_vars/HOST_NAME/vault1
./hosts/host_vars/HOST_NAME/vault2

When I run the command:

ansible-playbook -i hosts/HOST_NAME playbooks/foo.yml

  1. Will ansible use vault1 or vault2 per default?
  2. If it looks in both, what happens if both vaults have defined the same variable? That is:
    • vault1 -> username: user1
    • vault2 -> username: user2
  3. If it looks in both, will the command fail if one of the vaults fail the decryption?
ansible
1 Answers

Q1: "Will Ansible use vault1 or vault2 per default?"

A: Both. In the sort order.

Q2: "What happens if both vaults have defined the same variable?"

A: The last one wins.

Q3: "Will the command fail if one of the vaults fails the decryption?"

A: Yes.

Examples

Given the tree

shell> tree ../test-915
../test-915
├── ansible.cfg
├── hosts
├── host_vars
│   └── test_11
│       ├── vault1
│       └── vault2
└── pb.yml

the unencrypted vaults

shell> cat host_vars/test_11/vault1 
username: user1
key1: val1
shell> cat host_vars/test_11/vault2
username: user2
key2: val2

and the playbook

shell> cat pb.yml 
- hosts: test_11
  tasks:
    - debug:
        msg: |
          username: {{ username }}
          key1: {{ key1 }}
          key2: {{ key2 }}

gives

shell> ansible-playbook pb.yml 

PLAY [test_11] **********************************************************************************

TASK [debug] ************************************************************************************
ok: [test_11] => 
  msg: |-
    username: user2
    key1: val1
    key2: val2

(Feel free to test the encryption/decryption on your own.)

user_64825610
Related