From c6cb7216ac2dc837184f42769abdf807e88fda5f Mon Sep 17 00:00:00 2001
From: Rafael Guterres Jeffman <rjeffman@redhat.com>
Date: Thu, 3 Sep 2020 16:40:53 -0300
Subject: [PATCH] Add note about `no_log` use on vault data retrieve.
When using the ipavault module to retrieve stored data, this data is
often sensitive, and if `no_log` is not enabled on the playbook, the
sensitive data will be logged by Ansible.
This change in de documentation, and playbook examples, suggests the
use of `no_log: true` when using `state: retrieved` with ipavault.
---
README-vault.md | 11 +++++++++--
playbooks/vault/retrive-data-asymmetric-vault.yml | 1 +
playbooks/vault/retrive-data-symmetric-vault.yml | 1 +
3 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/README-vault.md b/README-vault.md
index 9098b049..8e57958e 100644
--- a/README-vault.md
+++ b/README-vault.md
@@ -130,7 +130,7 @@ Example playbook to make sure vault data is present in a symmetric vault:
action: member
```
-Example playbook to retrieve vault data from a symmetric vault:
+When retrieving data from a vault, it is recommended that `no_log: yes` is used, so that sensitive data stored in a vault is not logged by Ansible. The data is returned in a dict `vault`, in the field `data` (e.g. `result.vault.data`). An example playbook to retrieve data from a symmetric vault:
```yaml
---
@@ -139,12 +139,19 @@ Example playbook to retrieve vault data from a symmetric vault:
become: true
tasks:
- - ipavault:
+ - name: Retrieve data from vault and register it in 'ipavault'
+ ipavault:
ipaadmin_password: SomeADMINpassword
name: symvault
username: admin
password: SomeVAULTpassword
state: retrieved
+ no_log: yes
+ register: ipavault
+
+ - name: Print retrieved data from vault
+ debug:
+ var: ipavault.vault.data
```
Example playbook to make sure vault data is absent in a symmetric vault:
diff --git a/playbooks/vault/retrive-data-asymmetric-vault.yml b/playbooks/vault/retrive-data-asymmetric-vault.yml
index f71f826b..0bda412d 100644
--- a/playbooks/vault/retrive-data-asymmetric-vault.yml
+++ b/playbooks/vault/retrive-data-asymmetric-vault.yml
@@ -13,5 +13,6 @@
private_key_file: private.pem
state: retrieved
register: result
+ no_log: true
- debug:
msg: "Data: {{ result.vault.data }}"
diff --git a/playbooks/vault/retrive-data-symmetric-vault.yml b/playbooks/vault/retrive-data-symmetric-vault.yml
index 24692a8a..609c5f5d 100644
--- a/playbooks/vault/retrive-data-symmetric-vault.yml
+++ b/playbooks/vault/retrive-data-symmetric-vault.yml
@@ -13,5 +13,6 @@
password: SomeVAULTpassword
state: retrieved
register: result
+ no_log: true
- debug:
msg: "{{ result.vault.data }}"
--
GitLab