Awx: New Survey Type "volatile Password" (Option to not save jt survey passwords)

[FloThinksPi]

ISSUE TYPE

• Feature Idea

COMPONENT NAME

• API
• UI

SUMMARY

Option to not save jt survey passwords via seperate Survey field Type "volatile Password".
This is simmilar to #742 but with Credentials provided by Surveys.

I worked around #688 where the Password promt on launch is faulty.
I did this by creating a password field in a survey and overwrote ansible_ssh_password.

Now the problem is that the Password Survey answer gets saved somwhere and relaunches can be triggered without supplying a password.

The requirement that the password does not get saved can be covered with the promt on launch of the credential when #688 is fixed. But if there must be other variables/passwords provided in a playbook to login somewhere (eg. rest apis), there should also be an option to not save survey passwords like it is done with credential prompt on launch.

I propose this as there can be environments wich force that there is no saved passwords anywhere.
These are likely more organisatorical Requirement than Technical requirements but they exist nonetheless.

STEPS TO REPRODUCE

Create a JT with Suvery and a Password field.
Run the JT and supply the Password
Trigger Relaunch of the above completed Job

EXPECTED RESULTS

There could be a seperate Survey field Type "volatile Password" which is not saved anywhere and forces a Survey popup on relauch. When using this survey field, schedules are disabled of course, because there is no way one can supply the Survey values.

ACTUAL RESULTS

The Relunch has valid credentials and triggers the relaunch without prompt.

[AlanCoding]

This is a well-thought out request. Thanks for putting in the effort.

When using this survey field, schedules are disabled of course

Also can't be used in workflows, yes. Defaults don't make any sense either. Either case would defeat the original intention. We are on the same page there.

Forgetting the values (which are inside job extra_vars) would be a minor development challenge, but it could be done in the same way that the solution to 742 was.

[wenottingham]

As a user interface, I think a "Save for relaunch" checkbox on password type makes more functional sense than a separate type.

When using this survey field, schedules are disabled of course
Also can't be used in workflows, yes

This is only if required: True is set.

[AlanCoding]

^ Yes, this implementation would be better than a new question type.

It also raises the question about whether workflows and schedules would save survey password answers when they create jobs. It could be configurable, or the answer could just be "no". Both relaunch and re-scheduling must be done as a distinct user action, so the user can re-enter the passwords then. This way, you can be assured your encrypted passwords are fully deleted when you delete that schedule or workflow.

This would be a good deal of development work, but the implementation details could be nailed down pretty easily.

[wenottingham]

Closing this as an item that will hang off of https://github.com/ansible/awx/issues/553 - context can still exist here.