Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Ansible vault decryption #160

Open
Bleizo opened this issue Nov 1, 2023 · 0 comments
Open

Add Ansible vault decryption #160

Bleizo opened this issue Nov 1, 2023 · 0 comments

Comments

@Bleizo
Copy link

Bleizo commented Nov 1, 2023

Environment

  • Python version: 3.10.12
  • schema-enforcer version: 1.2.2

It would be great if schema-enforcer ansible could handle inventory files with vaulted variables in them. At the moment part of the stack trace when doing so is:

__init__.py", line 640, in decrypt
    plaintext, vault_id, vault_secret = self.decrypt_and_get_vault_id(vaulttext, filename=filename, obj=obj)
  File "/home/bp/gitlab/framestore/systems/monitoring/fop/venv/lib/python3.10/site-packages/ansible/parsing/vault/__init__.py", line 678, in decrypt_and_get_vault_id
    raise AnsibleVaultError('Attempting to decrypt but no vault secrets found')

Proposed Functionality

I propose the command be extended to provide vault IDs in a similar way to what ansible-inventory provides. The invocation would look something like this:

schema-enforcer ansible --inventory inventory/ --vault-id testid@/tmp/vault_secret.txt

Use Case

This is useful when validating host/group vars that contain secrets. Those can be anything ranging from BGP peering passwords (8 character length limit) or validating that passwords adhere to certain requirements or even validating YAML files that are completely encrypted.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant