Lint vault files

[ThomasSteinbach]

I'd like to lint whole Ansible playbooks including vault files. An idea would be to provide ansible-lint the vault-pass parameter. Currently linting a vault file leads to a (correct) error:

ansible.errors.AnsibleError: ERROR! Decryption failed

[willthames]

Sure, implementations welcome

[willthames]

The approach in willthames/ansible-inventory-grapher#19 could likely be used here too.

[gersilex]

The problem still persists in ansible-lint 3.4.7. It does not seem to respect the settings from ansible.cfg, where the path to the vault password file is saved:

 ansible-lint roles/foo.bar/vars/main.vault.yml
Decryption failed on roles/foo.bar/vars/main.vault.yml

[thuandt]

Latest version and still return "Decryption failed"

[willthames]

Well, it would do, no one has actually implemented this yet. I've pointed to how one might go about this - and will favourably review pull requests implementing such a change.

[willthames]

I've removed the v3.2 milestone, it will get in the next version after someone has implemented it.

[tdmalone]

I know this hasn't been implemented, but just adding that the current error appears to be:

A vault password must be specified to decrypt data

I know ansible-lint can't take a password directly, so I've tried both ANSIBLE_VAULT_PASSWORD_FILE and ANSIBLE_VAULT_PASSWORD approaches, to no avail.

This means I'm choosing at the moment between linting, or committing secrets :(

I haven't really used Python before so I'm a bit lost on how to implement this, but taking the example in https://github.com/willthames/ansible-inventory-grapher/pull/19/files would it be adding:

• the parser.add_option calls to main, and
• the usage of the CLI library somewhere around the bottom of utils.py?

Having said that... utils.py also has this:

    # ansible-lint doesn't need/want to know about encrypted secrets, but it needs
    # Ansible 2.3+ allows encrypted secrets within yaml files, so we pass a string
    # as the password to enable such yaml files to be opened and parsed successfully.
    DEFAULT_VAULT_PASSWORD = 'x'

the DEFAULT_VAULT_PASSWORD is referenced elsewhere in the file twice.
Given this... is this actually already implemented and meant to be working?

[willthames]

@tdmalone what version are you running - 3.4.23 was released a couple of days ago which may or may not have included a fix (it definitely had a vault fix, just not sure if it's this vault fix)

This issue could use a minimal test case.

[tdmalone]

Thanks for the response! Yes I'm on 3.4.23.

I should be able to put a test case together. I just realised however my specific problem is with an inline string rather than a file - does this need a separate issue? (Only just started using Ansible Vault, and trying to get my head around it!)

[tdmalone]

Actually, I apologise - turns out it wasn't the vault strings I added... those are working fine. It was vault files someone else had added to the repo that I didn't know about. I actually don't need to be linting those, and have made my linting script a bit more targeted.

So, having said all that, I'm still happy to try to put a test case together if it would help! Is it just complete vault files which the problem is with?