3

In my previous question, I discovered that I can put options into a local ansible.cfg file. But can I override them?

I have an ansible.cfg file that contains

[defaults]
vault_password_file = /home/hymie/ansible/foo

And I can use this file automatically:

$ echo "hi there" |  ansible-vault encrypt_string
Reading plaintext input from stdin. (ctrl-d to end input)
!vault |
          $ANSIBLE_VAULT;1.1;AES256
          64386133613865366565336365333166623538613239636464303931646330323061376239363639
          3136376163613132613130306630626365643133366664310a353030303434346336396233616363
          62323464313737663135303636646264373737393930326132386231363561653865646436313439
          3231353132643364340a316431626332626633646135613064353133633038356434323537326633
          3035
Encryption successful

But now, I am unable to use/select a different password:

$ echo "hi there" |  ansible-vault encrypt_string --ask-vault-pass
New Vault password:
Confirm New Vault password:
ERROR! Only one --vault-id can be used for encryption. This includes passwords from configuration and cli.

$ echo "hi there" |  ansible-vault encrypt_string --vault-password-file=/tmp/foo
ERROR! Only one --vault-id can be used for encryption. This includes passwords from configuration and cli.

$ echo "hi there" |  ansible-vault encrypt_string --vault-id=@prompt
New vault password (default):
Confirm vew vault password (default):
ERROR! Only one --vault-id can be used for encryption. This includes passwords from configuration and cli.

This seems like the Wrong Behavior.

Why isn't my command-line option (either to prompt for a password or to select a different password file) overriding the configuration-file option to use a specific predefined password file? Am I doing something wrong? Or is ansible just like this, no overriding configuration file variables?

5
  • The error seems clear to me. You can only assign a single valid-id to be used for encryption. Where else have you assigned the vault-id? – Ramhound Jan 19 '18 at 14:28
  • The error clearly indicates this was intentional. You are requesting a new feature / change, you should do it on GitHub, not SuperUser. – techraf Jan 21 '18 at 12:27
  • @techraf So is this a standard ansible thing, that once a setting is defined in ansible.cfg , it cannot be overridden by a command-line option? – hymie Jan 21 '18 at 16:16
  • That error is thrown because /tmp/foo is not an executable bash script that should echo ${VAULT_PASS} – Daniel Andrei Mincă Sep 19 '18 at 8:40
  • @MincăDanielAndrei You are mistaken. docs.ansible.com/ansible/2.5/user_guide/… clearly says "To specify a vault password in a text file, use the --vault-password-file option", as does the help text from ansible-vault --help . – hymie Sep 19 '18 at 12:23
0

I had a similar issue yesterday with the same error thrown and your configuration.

Apparently that error was thrown because my ansible.cfg from CWD was poiting to a vault_password_file and I was also passing the --vault-password-file in the CLI as argument, so referencing the Vault Password File twice throws that error: ERROR! Only one --vault-id can be used for encryption. This includes passwords from configuration and cli.

Which is exactly what the error says, the fact that you're passing that param twice, but in a different way.

So, a way to fix this is either remove the vault_password_file= reference from ansible.cfg and only pass it through the cli --vault-password-file, or just leave it in the ansible.cfg thus avoiding to type --vault-password-file in the cli again, it's up to you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.