如何在 Ansible 的剧本中加密变量？

Question

I am running a playbook where I am passing in a password from an external hashicorp vault. The problem is that when I run the playbook, the password is displayed in plain text in the output provided by ansible.

I want the logs to be visible so I do not prefer no_logs as a solution

Example

changed: [Server IP] => {
    "changed": true,
    "cmd": "config.cmd --windowsLogonPassword **Password is passed here but displayed in plain text** ,
    "delta": "0:00:06.218698",
    "end": "2021-07-16 05:32:07.845560"...

Is there a way to encrypt the password directly in the playbook so plain text is not displayed on this output?

Answer 1

Put

no_log: true

on either the task or the whole playbook. This inhibits information that can be useful for debug when you are writing the playbook, but should be on production playbooks where needed IMO.