ansible-vault-rekey 2.0.1

Roll keys and re-encrypt secrets in any repo using Ansible Vault

ansible-vault-rekey

Roll keys and re-encrypt secrets in any repo using Ansible Vault

• Free software: BSD license

• Documentation: https://ansible-vault-rekey.readthedocs.io.

Usage

WARNING: Very few guardrails present. Running this without options will overwrite data by default.

Known issues / caveats:

• Shows a callous disregard for whitespace and comments

• Assumes it’s in a playbook directory if -r isn’t provided

• Will casually write secrets to STDOUT in –debug mode

$ ansible-vault-rekey --help
Usage: ansible-vault-rekey [OPTIONS]

  (Re)keys Ansible Vault repos.

Options:
  --debug
  --dry-run                 Skip any action that would overwrite an original
                            file.
  -k, --keep-backups        Keep unencrypted copies of files after a
                            successful rekey.
  -r, --code-path TEXT      Path to Ansible code.
  -p, --password-file TEXT  Path to password file. Default: vault-password.txt
  -v, --vars-file TEXT      Only operate on the file specified. Default is to
                            check every YAML file in Ansible role/play dirs
                            for encrypted assets.
  --help                    Show this message and exit.

You can confirm that your secrets were rencryped properly by running debug on an encrypted var or file. eg:

ansible --vault-password-file vault-password.txt -e "@group_vars/all.yml" -i localhost, -c local -m debug -a var=somesecurevar localhost

Installation

pip install ansible-vault-rekey

We have dependencies a couple of layers down which need to compile crypto libraries if you haven’t already got them. On most systems, you’ll need the following:

• libffi-dev / libffi-devel

• libssl-dev / openssl-devel

• gcc

Features

• TODO

Testing

With Docker (recommended):

docker build -t tmp . && docker run --rm -it -w /workspace -v $(pwd):/workspace tmp

Manually:

pip install -r requirements.txt pytest & python -m pytest tests/*.py

Credits

This package was created with Cookiecutter and the audreyr/cookiecutter-pypackage project template.

History

2.0.1 (2020-12-31)

• Fix improper encrypting YAML files

2.0.0 (2020-12-31)

• Fix dependencies errors

• Dropped support for Python2 and Python 3.5

• Added support for Python 3.7, 3.8, 3.9

0.1.0 (2017-10-31)

• First release on PyPI.