Separate secure vaults for different environments?

Question

I use Ansible to handle endpoint differences for different environments. This is done using variables and the ansible-xml extension.

For example, I have a task named "endpoints.yml" in a role called "myapp". This task sets many configuration parameters in the configuration files, replacing the variables.

/roles/myapp/tasks/endpoints.yml

—> set value in app config file to: {{ db_user }} —> set value in app config file to: {{ db_password }} 

Since my non-prod environments use one endpoint, the values ​​for these variables are set in the default role file:

/roles/myapp/defaults/main.yml

  —> db_user: myuser_ro —> db_passwordd: some_password 

For the prod environment, I overwrite the default with group_variable (as this takes precedence):

/ environments / prod / group_vars / myapp_servers

  —> db_user: produser_ro —> db_password: some_other_password 

All this works great and allows us to use a single playbook / role for all environments. However, I want to move to take advantage of the hidden storage to move the password values ​​from these files to an encrypted file.

However, there will still be different values ​​for prod and non-prod. I can create a new "vars" file in the role of "pass.yml", encrypt it using hidden storage and then reference it using the "include_vars: pass.yml" task.

But this does not explain how I take into account the need to use different (encrypted) variables for different environments.

Any suggestions?

Answer 1

It looks like you are using a framework with multiple environments, like this . In this case, you can create a storage file for each environment.

 environments ├── dev │  └── group_vars │  └── all │  └── secrets └── prod └── group_vars └── all └── secrets 

Each secrets file can have its own password.

Answer 2

Multiple vault passwords in the same available configuration are not currently supported with hidden vault. You must use the same vault password to encrypt both prod and non-prod product files.

Answer 3

Time has passed since the previous answers, Ansible 2.2 restricts the use of one storage password for the entire playback on the Playbook, but this does not stop you from having different files encrypted using different storage passwords if they are not used in the same one.

In a few words, you can have a test environment with a storage password that is different from production.

I made PoC, you can check it here:

https://github.com/brianmori/ansible-poc