Ansible-vault不适用于--vault-password-file

Question

for some kind of yml files that we have to store passwords (of MySQL users) we use ansible-vault encrypt to maintain some security.

The problem is every time we have to edit we are forced to input the password.

I was looking how to fix this and seems is pretty easy but I couldn't make it work yet.

I've created a file in my home directory called:

.vault_pass.txt

inside of that, I have the password. And in the ansible.cfg in my repository I have the variable:

vault_password_file = ~/.vault_pass.txt

Didn't work as expected. So I tried to force ansible-vault command to read the file with this parameter

# ansible-vault decrypt --vault-password-file ~/.vault_pass.txt vars/vars-mysql-config.yml

Output error:

ERROR! input is not vault encrypted data for vars/vars-mysql-config.yml

It seems I forgot something here but I wasn't able to find the right info.

Anyone has any idea about that?

Thanks guys!

Answer 1

I guess you misuse decrypt command instead of view .

To view encrypted file use view :

ansible-vault view --vault-password-file ~/.vault_pass.txt vars/vars-mysql-config.yml

If you want to decrypt the file and leave it in plain text, use decrypt :

ansible-vault decrypt --vault-password-file ~/.vault_pass.txt vars/vars-mysql-config.yml

If you try to run decrypt command second time, it will give you expected error:

ERROR! input is not vault encrypted data for vars/vars-mysql-config.yml

because file is already plain-texted.