# 2.4 support for multiple vault passwords, looking for feedback **URL:** \ **Category:** Ansible Project\ **Created:** [July 26, 2017, 2:09pm UTC](https://forum.ansible.com/t/2-4-support-for-multiple-vault-passwords-looking-for-feedback/25092 "2017-07-26T14:09:26Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![alikins](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@alikins](https://forum.ansible.com/u/alikins)\ **Post date:** [July 26, 2017, 2:09pm UTC](https://forum.ansible.com/t/2-4-support-for-multiple-vault-passwords-looking-for-feedback/25092/1 "2017-07-26T14:09:26Z")
![](https://us1.discourse-cdn.com/ansible/original/2X/5/56d45f8a17f5078a20af9962c992ca4678450765.gif) I’ve been working on some vault related 2.4 roadmap[1] features, namely "Support for multiple vault passwords. ". The current pr is at [https://github.com/ansible/ansible/pull/22756](https://github.com/ansible/ansible/pull/22756) The roadmap feature is based on RFE [https://github.com/ansible/ansible/issues/13243](https://github.com/ansible/ansible/issues/13243) Looking for feedback from vault users on the proposed interface and approach. For convenience, I’ll include the summary of the proposed changes from [https://github.com/ansible/ansible/pull/22756#issue-215127152](https://github.com/ansible/ansible/pull/22756#issue-215127152) inline here, but may be easier to read on the issue: The main user facing changes are: - Cli now supports a new ‘–vault-id’ option that can specify a password file or ‘prompt’ “ansible-playbook --ask-vault-pass --vault-id ~/dev\_password –vault-id prompt some\_playbook.yml” - Will prompt for a vault password (it will ask for the ‘default’ password in this example) - Will read a password from ~/dev\_password For example above, the ~/dev\_password file would be tried first, then the password from the prompt - Cli now supports providing --vault-password-file multiple times “ansible-playbook --vault-password-file ~/dev\_password –vault-password-file ~/prod\_password some\_playbook.yml” The default behavior is to try all of the specified vault secrets/passwords in the order they were specified, until one work the new ‘–vault-id’ option can be mixed in with the existing –vault-password-file and --ask-vault-pass as well - internally vault can add the vault-id label to the vault format - vault format is rev’ed to 1.2 (but anything that can read 1.1 format can read 1.2 as well) - When decrypting a 1.2 format with a ‘vault-id’, the vault secrets that match that vault id will be tried first - The --vault-id option also allows specifying a vault id label and the secret type “ansible-playbook --vault-id prod\_keychain@prod\_password\_file –vault-id stage\_keychain@prompt some\_playbook.yml” tTat will read ./prod\_password\_file and then prompt the user for the password for the ‘stage\_keychain’ vault id - A playbook can have have vaulted files that uses different passwords in the same ‘ansible-playbook’ run - A playbook can have embedded vaulted variables with different passwords in the same playbook (even in same file) So a ansible project like: secrets/dev\_password secrets/qa\_password playbooks/ playbooks/inventory # encrypted with dev password playbooks/site.yml playbooks/vars/main.yml # with multiple embedded vars, each with a different password and/or vault id dev\_password would be loaded from file, and there will be an interactive prompt for ‘prod’ vault\_id/password - Not quite done but close config option and/or cli option to enforce matching vault\_id and vault\_secret If a vault is of label ‘dev\_keychain’, then decrypting will ‘require’[1] a vault id for ‘dev\_keychain’ is provided # with “enforcing” enabled in config ansible-playbook --vault-id dev\_password playbook\_that\_has\_vaults\_for\_dev\_keychain.yml will fail indicating that ‘–vault-id dev\_keychain@dev\_password’ is needed This will help with the case where multiple vault items with different vault ids also happen to all use the same password. [1] require and enforcing in scare quotes, because that would be app level logic and not a cryptographic requirement. ie, I could edit the vault cipher text to change the vault id to ‘dev’ and above command would succeed. (The vault-id is primarily a nickname used in the UX, it is not signed or encrypted since that would require changing the vault format in a non backwards compatible way). - Not for 2.4 automatically choosing what vault passwords to interactively prompt for based on which playbook content is loaded. (that would be nice UX, but ansible doesn’t know what it needs to decrypt until way too late (in the worker processes…). We can fix that, but it may need some significant changes to other parts of ansible. - Partial for 2.4 the secret/password callbacks mentioned in the roadmaps. Same issue as above. It could work in my branch for non-interactive callbacks, but the normal interactive console prompts do not. [1] [https://github.com/ansible/ansible/blob/devel/docs/docsite/rst/roadmap/ROADMAP\_2\_4.rst#vault](https://github.com/ansible/ansible/blob/devel/docs/docsite/rst/roadmap/ROADMAP_2_4.rst#vault)