Try SpotterLoad sops-encrypted variables from files, dynamically within a task
| "added in version" 0.1.0 of community.sops"
Authors: Felix Fontein (@felixfontein)
This plugin has a corresponding action plugin.
Install with ansible-galaxy collection install community.sops:==1.6.7
collections:
- name: community.sops
version: 1.6.7Loads sops-encrypted YAML/JSON variables dynamically from a file during task runtime.
To assign included variables to a different host than C(inventory_hostname), use C(delegate_to) and set C(delegate_facts=true).
- name: Include variables of stuff.sops.yaml into the 'stuff' variable
community.sops.load_vars:
file: stuff.sops.yaml
name: stuff
expressions: evaluate-on-load # interpret Jinja2 expressions in stuf.sops.yaml on load-time!
- name: Conditionally decide to load in variables into 'plans' when x is 0, otherwise do not
community.sops.load_vars:
file: contingency_plan.sops.yaml
name: plans
expressions: ignore # do not interpret possible Jinja2 expressions
when: x == 0
- name: Load variables into the global namespace
community.sops.load_vars:
file: contingency_plan.sops.yaml
file:
description:
- The file name from which variables should be loaded.
- If the path is relative, it will look for the file in C(vars/) subdirectory of a
role or relative to playbook.
type: path
name:
description:
- The name of a variable into which assign the included vars.
- If omitted (V(null)) they will be made top level vars.
type: str
age_key:
description:
- One or more age private keys that can be used to decrypt encrypted files.
- Will be set as the E(SOPS_AGE_KEY) environment variable when calling sops.
type: str
version_added: 1.4.0
version_added_collection: community.sops
keyservice:
description:
- Specify key services to use next to the local one.
- A key service must be specified in the form C(protocol://address), for example C(tcp://myserver.com:5000).
- This corresponds to the sops C(--keyservice) option.
elements: str
type: list
version_added: 1.0.0
version_added_collection: community.sops
age_keyfile:
description:
- The file containing the age private keys that sops can use to decrypt encrypted
files.
- Will be set as the E(SOPS_AGE_KEY_FILE) environment variable when calling sops.
- By default, sops looks for C(sops/age/keys.txt) inside your user configuration directory.
type: path
version_added: 1.4.0
version_added_collection: community.sops
aws_profile:
description:
- The AWS profile to use for requests to AWS.
- This corresponds to the sops C(--aws-profile) option.
type: str
version_added: 1.0.0
version_added_collection: community.sops
config_path:
description:
- Path to the sops configuration file.
- If not set, sops will recursively search for the config file starting at the file
that is encrypted or decrypted.
- This corresponds to the sops C(--config) option.
type: path
version_added: 1.0.0
version_added_collection: community.sops
expressions:
choices:
- ignore
- evaluate-on-load
default: ignore
description:
- This option controls how Jinja2 expressions in values in the loaded file are handled.
- If set to V(ignore), expressions will not be evaluated, but treated as regular strings.
- If set to V(evaluate-on-load), expressions will be evaluated on execution of this
module, in other words, when the file is loaded.
- Unfortunately, there is no way for non-core modules to handle expressions "unsafe",
in other words, evaluate them only on use. This can only achieved by M(ansible.builtin.include_vars),
which unfortunately cannot handle sops-encrypted files.
type: str
sops_binary:
description:
- Path to the sops binary.
- By default uses C(sops).
type: path
version_added: 1.0.0
version_added_collection: community.sops
aws_access_key_id:
description:
- The AWS access key ID to use for requests to AWS.
- Sets the environment variable E(AWS_ACCESS_KEY_ID) for the sops call.
type: str
version_added: 1.0.0
version_added_collection: community.sops
aws_session_token:
description:
- The AWS session token to use for requests to AWS.
- Sets the environment variable E(AWS_SESSION_TOKEN) for the sops call.
type: str
version_added: 1.0.0
version_added_collection: community.sops
aws_secret_access_key:
description:
- The AWS secret access key to use for requests to AWS.
- Sets the environment variable E(AWS_SECRET_ACCESS_KEY) for the sops call.
type: str
version_added: 1.0.0
version_added_collection: community.sops
enable_local_keyservice:
default: false
description:
- Tell sops to use local key service.
- This corresponds to the sops C(--enable-local-keyservice) option.
type: bool
version_added: 1.0.0
version_added_collection: community.sops
ansible_facts:
description: Variables that were included and their values.
returned: success
sample:
variable: value
type: dict
ansible_included_var_files:
description: A list of files that were successfully included
elements: str
returned: success
sample:
- /path/to/file.sops.yaml
type: list