infra-ansible
infra-ansible copied to clipboard
Atlassian: Support using a vault setup for passwords only
The atlassian roles/playbooks should support using the vault for passwords only. Since passwords are currently part of the overall atlassian
dictionary, and Ansible doesn't "merge" variables from two inventories/variables, it overrides the overall inventory. The roles and playbooks needs to be updated to handle sourcing the passwords from an alternative "inventory" - i.e.: something like an atlassian_credentials
dictionary (in addition to the atlassian
dictionary).
@oybed This is one approach, but it looks like ansible also supports using encrypted values with an inventory now (from v2.3): https://docs.ansible.com/ansible/latest/user_guide/playbooks_vault.html#single-encrypted-variable
Any thoughts on one approach vs the other?
I think we may find that we have a need to maintain multiple passwords and keys for multiple tools, so I think we need to take a step back to evaluate what approach would be best as I can see benefits to both using a centralized vault for all of it or having individual vault values in various areas. Let's maybe try some quick PoCs and discuss pros/cons.