Awx: Cannot add inventory source encrypted with vault

[vietthang207]

ISSUE TYPE

• Bug Report

COMPONENT NAME

• API
• UI

SUMMARY

I am not sure this is a bug or not, but I cannot add an inventory with source encrypted by vault.

ENVIRONMENT

• AWX version: 2.5.4
• AWX install method: docker for mac
• Ansible version: 2.5.4
• Operating System: Mac OS
• Web Browser: Google Chrome

STEPS TO REPRODUCE

1. Create a playbook project in Github with inventory located at inventories/production/hosts.yml . I also have host_var located at inventories/production/host_vars/server/vars.yml and inventories/production/host_vars/server/vault.yml where vault.yml is encrypt with password from prompt.

2. Create a playbook production.yml at home directory.

3. Create a project in awx using this source.

4. Create an inventory and create an inventory source from the project.

EXPECTED RESULTS

ACTUAL RESULTS

In Inventory source page, If I click Credential, there will be a prompt show "NO CREDENTIALS HAVE BEEN CREATED". When I try synchronizing the source, the job will run with error "ERROR! Attempting to decrypt but no vault secrets found"

ADDITIONAL INFORMATION

I've try adding a Vault credential in the job template and run the production.yml playbook, but It still showing error that variables inside vault.yml is not defined.

[AlanCoding]

See https://github.com/ansible/awx/issues/223, if you get this to work, you'll need at least Ansible 2.6, and there could be other nuances to the implementation you're attempting.

[n0l0cale]

Hi @AlanCoding ,

I am running Ansible 2.6 and struggling with that encrypted vault-topic the same way the colleague @vietthang207 did. In details my exact failure is: https://serverfault.com/questions/878320/how-to-use-existing-vault-files-in-ansible-tower

I've seen many open threads regarding this topic. Is there a documented way how it works with ansible 2.6.5?

n0l0cale

[AlanCoding]

I walked through some relevant steps in a comment in #223, but it has gotten a little buried by now. Anyway, I went ahead and replied at serverfault.

[n0l0cale]

thanks :)

[n0l0cale]

@AlanCoding
I think we should reopen this bug-thread as state in the serverfault thread and continue to handle this as a separate issue.

The clear definition would be that we would like to open vault-protected host_vars/group_vars by defining a yaml - e.g. group_var, which could be itself encrypted by a vault-protected with another passphrase, which then could be defined in the job template

[Perdjesk]

After reading https://github.com/ansible/awx/issues/223, this issue and the explication on serverfault (https://serverfault.com/questions/878320/how-to-use-existing-vault-files-in-ansible-tower), I too feel that this issue should be reopen as awx still doesn't support importing inventories that are using whole vault encrypted files.

Encrypting using the whole file was and still is a best practice documented here: https://docs.ansible.com/ansible/latest/user_guide/playbooks_best_practices.html#variables-and-vaults

As pointed in https://github.com/ansible/awx/issues/223#issuecomment-369306829 the issue relies with the behavior of ansible-inventory which fails when not able to decrypt vault file.
Should an option made available in ansible-inventory to ignore variables in vault files without failing? Thus allowing the import of inventories without vaulted variables.

[AlanCoding]

Should an option made available in ansible-inventory to ignore variables in vault files without failing? Thus allowing the import of inventories without vaulted variables.

That wouldn't be great behavior IMO. In that case, you really don't know what variables you're missing, and we would at least need to warn the user, and we don't have any logging mechanism for doing this, so it has to just fail.

Regarding:

I too feel that this issue should be reopen as awx still doesn't support importing inventories that are using whole vault encrypted files.

Yes, we are aware that this is a shortcoming, and is an open potential feature. The enhancement would be, speaking specifically, _decryption of whole-file vault secrets in inventory imports_.