add documentation for passwordstore usage#4219
add documentation for passwordstore usage#4219mcnesium wants to merge 2 commits intospantaleev:masterfrom
Conversation
|
|
||
| If you **do** use SSH keys for authentication, **and** use a non-root user to *become* root (sudo), you may need to add `-K` (`--ask-become-pass`) to all Ansible commands. | ||
|
|
||
| If you use a password manager like `pass` or `gopass`, you can also add `ansible_become_password: "{{ lookup('community.general.passwordstore', 'path/to/password' }}"` to the hosts file. See the [documentation](https://docs.ansible.com/ansible/latest/collections/community/general/passwordstore_lookup.html) for more configuration options. |
There was a problem hiding this comment.
It's probably better to mention Ansible Vault and how one could use that, before nudging people to use other tools (plugins from the community collection that integrate with other password managers).
Naturally, one may wish to use another password manager for storing the Ansible Vault encryption passphrase, but still.. Storing various sensitive variables in Ansible Vault sounds like a better go-to choice for most people.
There was a problem hiding this comment.
Well, as a not-at-all-experienced Ansible user it took me two years to find out that there are more options than just --ask-become-pass, so I wanted to let more people know about this.
Yes, Ansible Vault as yet another option should definitely be mentioned in this documentation, but I would not call it a "better" option and then withheld the (go)pass way to go.
There was a problem hiding this comment.
By now I really need to point out, that using the (go)pass option works™ … but it obviously requests the password from the store again on every single task – which made the playbook run slow down tremendously. It just took ~90 minutes here. So yeah, you are probably right. This should not be the second best option to be mentioned in the docs 😅
There was a problem hiding this comment.
Sorry, as a non-maintainer of this project, I don't feel like I should decide whether extending its documentation with information about a probably rather niche feature is regarded "relevant". I would go for "yes" though 😏
luixxiul
added
the
needs-info
|
This PR is stale because it has not been provided with required information or its conflicts have not been fixed over a year. Remove stale label or this will be closed in 30 days. To exempt the PR from being marked as stale again due to inactivity, add "confirmed" label. |
luixxiul
added
docs
3 participants
No description provided.