{"id":13936307,"url":"https://github.com/jhaals/ansible-vault","last_synced_at":"2025-11-12T22:37:13.527Z","repository":{"id":66766672,"uuid":"39492880","full_name":"jhaals/ansible-vault","owner":"jhaals","description":"ansible lookup plugin for secrets stored in Vault(by HashiCorp)","archived":false,"fork":false,"pushed_at":"2018-04-06T08:18:43.000Z","size":66,"stargazers_count":348,"open_issues_count":9,"forks_count":66,"subscribers_count":14,"default_branch":"master","last_synced_at":"2025-05-26T05:09:39.342Z","etag":null,"topics":["ansible","ansible-variables","lookup-plugin","secrets-stored","vault"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jhaals.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2015-07-22T07:46:56.000Z","updated_at":"2025-05-02T00:47:07.000Z","dependencies_parsed_at":"2023-09-09T23:45:08.909Z","dependency_job_id":null,"html_url":"https://github.com/jhaals/ansible-vault","commit_stats":null,"previous_names":[],"tags_count":13,"template":false,"template_full_name":null,"purl":"pkg:github/jhaals/ansible-vault","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jhaals%2Fansible-vault","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jhaals%2Fansible-vault/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jhaals%2Fansible-vault/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jhaals%2Fansible-vault/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jhaals","download_url":"https://codeload.github.com/jhaals/ansible-vault/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jhaals%2Fansible-vault/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":284122919,"owners_count":26951149,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-11-12T02:00:06.336Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","ansible-variables","lookup-plugin","secrets-stored","vault"],"created_at":"2024-08-07T23:02:33.374Z","updated_at":"2025-11-12T22:37:13.509Z","avatar_url":"https://github.com/jhaals.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"# ansible-vault lookup module [![Build Status](https://travis-ci.org/jhaals/ansible-vault.svg?branch=master)](https://travis-ci.org/jhaals/ansible-vault)\nThis is a lookup module for secrets stored in [HashiCorp Vault](https://vaultproject.io/).\nSupports Ansible 1.9.x and 2.x\n\n#### Deprecation notice\nansible-vault has been ***deprecated*** due to lack of personal usage of ansible and vault over the last years. There are other plugins such as [hashivault](https://github.com/TerryHowe/ansible-modules-hashivault) which provide the same functionality and are better maintained. \n\n### Installation\nlookup plugins can be loaded from several different locations similar to `$PATH`, see\n[lookup_plugins](http://docs.ansible.com/ansible/intro_configuration.html#lookup-plugins).\nAn example setup can be found in the [tests](tests) directory.\n\nThe source for the plugin can be pointed to via a _requirements.yml_ file, and\naccessed via [`ansible-galaxy`](http://docs.ansible.com/ansible/galaxy.html).\n\n### Configuration\nThe address to the Vault server:\n\n    export VAULT_ADDR=http://192.168.33.10:8200/\n\nThe plugin supports both Vault auth token and GitHub auth token. To use Vault auth token:\n\n    export VAULT_TOKEN=56f48aef-8ad3-a0c4-447b-8e96990776ff\n\nIf your Vault server is configured to use GitHub auth token:\n\n    export VAULT_GITHUB_API_TOKEN=56f48aef-8ad3-a0c4-447b-8e96990776ff\n\nThe plugin also supports Vault's CA-related environment variables, to\nenable use of a server certificate issued by a not-widely-trusted\nCertificate Authority. Use of this feature in the plugin requires\nPython 2.7.9.\n\n    export VAULT_CACERT=/etc/ssl/certs/localCA.pem\n    export VAULT_CAPATH=/etc/ssl/localCA\n\nThe Vault address, CA certificate, and path can also be set via the Ansible\nvariables `vault_addr`, `vault_cacert`, and `vault_capath`, respectively.\n\n    export VAULT_CAHOSTVERIFY=\"no\"\n\nThis avoid the hostname check for Vault certificate (useful with self-signed certicates).\nThis option can also be set via the Ansible variable `vault_cahostverify`.\n\n    export VAULT_SKIP_VERIFY=1\n\nThis will disable ssl certs validation. `VAULT_CACERT`, `VAULT_CAPATH` and `VAULT_CAHOSTVERIFY` have to be unset.\nCan also be set via Ansible variable `vault_skip_verify: \u003cbool\u003e`.\n\nFor more information on setting variables in Ansible, see the\n[variables docs](http://docs.ansible.com/ansible/playbooks_variables.html).\n\nThe Vault token intentionally can **not** be set via an Ansible variable, as\nthis is generally checked into revision control and would be a bad security\npractice somewhat defeating the purpose of using Vault. The token can be read\nfrom the file `$HOME/.vault-token`, as documented at\n[Vault environment variables](https://www.vaultproject.io/docs/commands/environment.html).\n\nIf any such parameter is set by both an environment variable and an\nalternative means, the environment variable takes precedence.\n\n### Caching\n\nBy default secrets fetched from Vault will be cached in memory, unless you specify\n\n    export ANSIBLE_HASHICORP_VAULT_USE_CACHE=no\n\nNote that secrets will be fetched once per fork (defaults to 5). If you turn off\nthis feature by toggling above variable, all lookups will be done per node instead.\n\n### [`Approle`](https://www.vaultproject.io/docs/auth/approle.html) support\n\nIf you want to use the Approle auth backend, you can do this by setting the follwing\nenvironment variables. If those vars are set, it is tried to get an approle token. If\ncaching is enabled, the token is stored in the cache, so that it can be reused.\n\n    export ANSIBLE_HASHICORP_VAULT_ROLE_ID=ba78195c-12c9-557f-f8e2-75705b9b52ec\n    export ANSIBLE_HASHICORP_VAULT_SECRET_ID=5a4d079b-e6aa-ad54-8b0c-09dd35b740ee\n\nPer default the authentication will be done against ${YOUR_HOST}/v1/auth/approle/login\nYou can change this to fit your layout by setting the following var to your value:\n\n    export ANSIBLE_HASHICORP_VAULT_ROLE_PATH=v1/auth/my/role/path/approle/login\n\n### Usage\nansible-vault works as any other lookup plugin.\n\n```yaml\n- debug: msg=\"{{ lookup('vault', 'secret/foo', 'value') }}\"\n```\n\n```yaml\n# templates/example.j2\n\n# Generic secrets\n{{ lookup('vault', 'secret/hello').value }} # world\n# Generic secrets with parameters\n{{ lookup('vault', 'pki/issue/example-dot-com common_name=foo.example.com format=pem_bundle').certificate }}\n# Specify field inside lookup\n{{ lookup('vault', 'secret/hello', 'value') }} # world\n# This syntax for Ansible 1.9.x\n{{ lookup('vault', ['secret/hello', 'value']) }} # world\n\n# Dynamic secrets\n{% set aws = lookup('vault', 'aws/creds/deploy') %}\naccess_key = {{ aws.access_key }} # AKSCAIZSFSYHFGA\nsecret_key = {{ aws.secret_key }} # 4XSLxDUS+hyXgoIHEhCKExHDGAJDHFiUA/adi\n```\n\nIf the desired value is stored within Vault with the key 'value' (like\n'value=world' shown above), within a task, the lookup can be performed with:\n\n```yaml\nwith_vault:\n- secret/hello\n```\n\nAnd then referenced with `\"{{ item.value }}\"`\n\nAlternatively, the lookup can be performed with:\n\n```yaml\nwith_vault:\n- secret/hello\n- value\n```\n\nAnd then referenced with `\"{{ item }}\"`\n\nBoth of these forms work with both Ansible 1.9.x and 2.x. They only work\nwithin tasks, though. You can **not** use the `with_vault:` syntax within a\nvariable definition file.\n\n### Troubleshooting\n\nIf you use the version of Ansible shipped with Ubuntu 16.04 (2.0.0.2-2ubuntu1) and get the error ```Error was sequence item 0: expected string, dict found``` then you should [install Ansible from the PPA](http://docs.ansible.com/ansible/latest/intro_installation.html#getting-ansible) instead. Related to [this Ansible PR](https://github.com/ansible/ansible/pull/14591)\n\n\n### What's the difference between `ansible-vault` and [`hashi_vault`](https://github.com/ansible/ansible/blob/devel/lib/ansible/plugins/lookup/hashi_vault.py)\n\n- (Ansible Vault) No external dependencies; (hashi_vault) requires hvac\n- (Ansible Vault) Uses the same environment variables as vault itself\n- (Ansible Vault) Quicker update cycle\n- (Ansible Vault) Supports dynamic secrets\n- (Ansible Vault) Supports custom fields\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjhaals%2Fansible-vault","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjhaals%2Fansible-vault","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjhaals%2Fansible-vault/lists"}