Hashicorp Vault weirdness explained

 Posted on December 25, 2023  |  2 min  |  423 words  |  Ton Kersten

A couple of days ago we where debugging an Ansible AAP problem, when a co-worker mentioned something weird in our Hashicorp Vault.
Nothing major, just weird.

He told me that sometimes and not with all entries he only could see the JSON blob of the entry and the switch to go back to normal was greyed out.

Searching Github it turned out that this is related to pull-request 4913 (https://github.com/hashicorp/vault/pull/4913), when an entry is not a string, Vault switches to the display of the JSON blob. (Thanks Chris) But, the main problem is, what is not a string??

[Read More]
Categories: Vault  Tags: vault 

Ansible with multiple vault ID's

 Posted on July 22, 2019  |  3 min  |  629 words  |  Ton Kersten

In our work environment we have role-based access for passwords (of course). But as we deploy all systems with Ansible, we could end up that someone with only deploy permission ends up with access to all passwords. It’s obvious that we don’t want that, so I started checking in to Ansible’s ability to have multiple vault passwords.

Ansible Vault IDs

Starting with Ansible 2.4 and above, vault IDs are supported.

Vault IDs help in encrypting different files with different passwords to be referenced inside a playbook. Prior to Ansible 2.4, only one vault password could be used in each Ansible run, forcing to encrypt all files using the same vault password.

First and foremost, Vault IDs need to be pre-created and referenced (best practice) inside your ansible.cfg file

[defaults]
vault_identity_list = apple@prompt, pear@prompt

In this example there are two vault IDs, called apple and pear and in this configuration Ansible will prompt for the needed passwords.

It’s also possible to supply the vault password files, like

[defaults]
vault_identity_list = apple@~/.vault_apple, pear@~/.vault_pear

As we are using Team Password Manager (TPM) with a heavily modified TPM lookup plugin (we can retrieve passwords with a certificate/key combination, without supplying passwords), we just need to decrypt the certificate and key to a certain location and depending on the certificate/key combination the TPM user has rights to retrieve a certain set of passwords.

[Read More]
Categories: Automation Configuration Management Ansible  Tags: ansible sysadm vault