Trzymanie haseł do ssh/winrm w ansible-vault i odwołanie się do nich w inventory

Cześć, mam plik z hasłami np. secret.yaml w group_vars/all/ zaszyfrowany ansible-vaultem

pass1: pass1
pass2 pass2

w jaki sposób teraz mogę się odnieść do np. pass2 w pliku inventory? żeby było coś takiego

ansible_connection: winrm
ansible_user: test
ansible_password: "{{ pass2 }}"

I wtedy wywołując playbooka zrobić --ask-vault-pass zamiast po prostu --ask-pass albo --ask-become-pass i czy da się w ogóle tak zrobić?

Da się tak zrobić. Przykład z vars_files poniżej:

# vagrant@ubuntu-focal:~/ansible$ ansible-vault  view secrets.vault
Vault password:
user1_pass: pass1
user2_pass: pass2

# vagrant@ubuntu-focal:~/ansible$ cat helloWorld.yaml
---
- name: Echo User Password
  hosts: localhost
  vars_files:
    - secrets.vault

  tasks:
    - name: Echo the password
      debug:
        msg: "Hello World! My password is {{ user1_pass }} "

# vagrant@ubuntu-focal:~/ansible$ ansible-playbook helloWorld.yaml --ask-vault-pass
Vault password:
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'

PLAY [Echo User Password] ****************************************************************************************************************************************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************************************************************************************************************************************************
ok: [localhost]

TASK [Echo the password] *****************************************************************************************************************************************************************************************************************************************************************
ok: [localhost] => {
    "msg": "Hello World! My password is pass1 "
}

PLAY RECAP *******************************************************************************************************************************************************************************************************************************************************************************
localhost                  : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

Ok, to w takim razie mam inventory.yaml

all:
  win:
    hosts:
      1.1.1.1:
        ansible_connection: winrm
        ansible_user: test
        ansible_password: "{{ pass2 }}"
     vars_files:
      - "path/to/secret.yaml"

no i ten secret.yaml

pass1: pass1
pass2: pass2

i wykonując playbooka
ansible-playbook -i inventory.yaml test-playbook.yaml --ask-vault-pass
dostaje błąd
Field password has and invalid value which includes an undefines variable The error was: 'pass2' is undefined
pytanie czy ten vars_files źle jakoś podaje czy o co chodzi?

Skupiłem się na wyciągnięciu haseł z vaulta, a nie miejscu, w którym chcesz je wyciągać. Można to ogarnąć tak, że w inventory ustawiasz zmienną, w której jest hasło per host, a w playbooku wyciągasz hasło na podstawie tej zmiennej.

# vagrant@ubuntu-focal:~/ansible$ cat inventory.yaml
all:
  hosts:
    127.0.0.1:
      ansible_connection: local
      user_pass_var: 'user1_pass'
    127.0.0.2:
      ansible_connection: local
      user_pass_var: 'user2_pass'

# vagrant@ubuntu-focal:~/ansible$ cat helloWorld.yaml
---
- name: Echo User Password
  hosts: all
  vars_files:
    - secrets.vault

  tasks:
    - name: Echo the password
      debug:
        msg: "Hello World! My password is {{ lookup('vars', hostvars[inventory_hostname]['user_pass_var']) }}"

I wynik:

# vagrant@ubuntu-focal:~/ansible$ ansible-playbook -i inventory.yaml helloWorld.yaml --ask-vault-pass
Vault password:

PLAY [Echo User Password] ****************************************************************************************************************************************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************************************************************************************************************************************************
ok: [127.0.0.1]
ok: [127.0.0.2]

TASK [Echo the password] *****************************************************************************************************************************************************************************************************************************************************************
ok: [127.0.0.1] => {
    "msg": "Hello World! My password is password1"
}
ok: [127.0.0.2] => {
    "msg": "Hello World! My password is password2"
}

PLAY RECAP *******************************************************************************************************************************************************************************************************************************************************************************
127.0.0.1                  : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
127.0.0.2                  : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

Per wybrany host:
ansible-playbook -i inventory.yaml helloWorld.yaml --ask-vault-pass -l 127.0.0.2

Okej już rozumiem wystarczy że ten plik secret podam w playbooku w vars_files i wtedy nawet w inventory z którego ten playbook będzie korzystał mogę tam zmienne wrzucić.