Skip to main content

Allows ansible-vault to use the system keyring for storing vault passwords

Project description

ansible-vault-keyring

A simple tool to get and set passwords for ansible vaults using the system keyring.

Installation

Install ansible-vault-keyring using your favorite package manager / method.

For me, using uv I use.

uv tool install ansible-vault-keyring

Usage

Setting a password.

$ ansible-vault-keyring --vault-id my_vault_id --set
Enter password   : foo 
Confirm password : foo

Getting a password.

$ ansible-vault-keyring --vault-id my_vault_id
foo

Recommend usage.

If for example, you want to use the ansible-vault-keyring tool to get two passwords from your keyring, one for a global vault-id, and one for a personal vault-id, you can add this to your ansible.cfg file.

[defaults]
vault_identity_list = global@/path/to/ansible_vault_keyring, personal@/path/to/ansible_vault_keyring

If like me you install with uv, you will find the binary in whatever bbin directory it uses, and you should refer to that uv documentation to find the path to the standalone executable. For me this is ~/.local/bin/ansible-vault-keyring, and I have ~/.local/bin in my PATH environment variable.

Now when a password is needed by ansible, it will invoke the ansible-vault-keyring tool to get the password from the keyring.

How Ansible finds config files

Ansible will load settings from the first ansible.cfg file it finds from :-

  1. The file in the ANSIBLE_CONFIG environment variable.
  2. The file ansible.cfg file in the current working directory.
  3. The file ~/.ansible.cfg file (in the user's home directory).
  4. The file /etc/ansible/ansible.cfg file (in the system ansible config directory).

Security Considerations.

The file is stored in the system keyring, for example gnome-keyring or OSX-Keychain. It does this using the keyring python package.

This means that the password is stored in plain text in the system keyring, and can be read by anyone with access to the system keyring, but this is true for all passwords stored in a system keyring.

Additionally, the password is passed through the python process running the ansible-vault-keyring tool.

However in reality this is likely to be at least as secure as copying+pasting the passwords from a password manager, and will certainly be better than reusing a password, or writing it on a post it note stuck to your monitor.

Credits

This tool was heavily inspired by vault-keyring-client.py from ansible-community's contrib scripts.

It is either a rewrite or a fork depending on your take, and thus I consider it a derivative work. See the LICENSE file for details of the original authors of vault-keyring-client.py.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

ansible_vault_keyring-0.1.1.tar.gz (34.5 kB view details)

Uploaded Source

Built Distribution

ansible_vault_keyring-0.1.1-py3-none-any.whl (17.0 kB view details)

Uploaded Python 3

File details

Details for the file ansible_vault_keyring-0.1.1.tar.gz.

File metadata

File hashes

Hashes for ansible_vault_keyring-0.1.1.tar.gz
Algorithm Hash digest
SHA256 b59affdc0cf46e5c16baa1dc1bd09a9d9a79a42ae62110b1d1d6a74f81682002
MD5 cfffffc67758230e85a1eb250074a5e3
BLAKE2b-256 c7f643d36e38b5c3695ace5c17ebc240c5ba6f306ce2e595534de0812986e733

See more details on using hashes here.

File details

Details for the file ansible_vault_keyring-0.1.1-py3-none-any.whl.

File metadata

File hashes

Hashes for ansible_vault_keyring-0.1.1-py3-none-any.whl
Algorithm Hash digest
SHA256 f416aca8800385410765ddfaee2876ead1065e3d44eb08b3d2fc5975994d8298
MD5 fec74c0a5e0ed5a60f7fee91832a4382
BLAKE2b-256 82e5e8a1c25a5a521d71b2b83ffa1c69ed30571c7703b9967a0bd1eb47af27b4

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page