Sops: Ansible integration

[conorsch]

Has anyone tried integrating SOPS with Ansible? At a high level, looks like a custom vars_plugin would support automatic decryption of SOPS vars files. As the SOPS docs state, all SOPS-encrypted vars files will have a top-level key sops. That should be good enough to trigger safely shelling out to the sops CLI and adding the decrypted vars to the play run.

The case would be a single Ansible site config repository that's shared across a team, so that YAML vars files can be encrypted to various team members' GPG keys, and safely stored in version control.

I'm happy to tackle prototyping the integration, but wanted to take the time to open an issue here in case others are interested in same. Feel free to comment here, otherwise I'll report back with progress when and if some is made.

[conorsch]

Here's a working prototype that handles host/group vars encrypted with SOPS: https://gist.github.com/conorsch/1556c634b1b65598bc766737d9e76fc6 It will not decrypt vars in other locations, e.g. vars/. For that, a custom parser must be written for Ansible, which involves a patch (and therefore a fork) of Ansible itself to work.

[musicformellons]

@conorsch I am looking around for a key/secret solution and stumbled onto sops which -as far as I understand things right now- like for being versatile supporting aws kms, google kms, gpg, and supported by mozilla etc. Integration with Ansible is a requirement for me as well. Before I was going in the direction of Credstash (aws kms) and noticed that it is supported by Ansible as a lookup.

Probably I am wrong -new as I am in this field- but my impression is that sops as a vars_plugin can only be used for setting up host keys, whereas the as a lookup it would be more versatile. Could you maybe shed some light on this? E.g.:

• why as a vars_plugin and not lookup?
• differences between credstash and sops in combination with ansible?

[endorama]

Hello, I provided two more ansible plugins for supporting all sops feature in Ansible.

You can check out the PRs here:

• https://github.com/ansible/ansible/pull/59641 Ansible lookup plugin
• https://github.com/ansible/ansible/pull/59639 Ansible vars plugin

Both are being used by our operations team at my company since late 2018.

[MarkusTeufelberger]

Work seems to be progressing in https://github.com/ansible-collections/community.sops

[endorama]

Indeed it is! Testers are welcome, consider we are working towards the first release so you should install it via git (ansible-galaxy collection install https://github.com/ansible-collections/community.sops.git)