Just a minor process note – It’s often troublesome to have a discussion about a feature on github because less people are there to read a ticket. I’d much prefer we discuss feature ideas here, for most major things, since that allows greater discussion, and search is also better.
That all being said, the basics here is that vault is designed to encrypt and decrypt YAML data files – of which since Ansible is data driven is mostly everything.
By contrast, the password lookup plugin is a clever tool, but it’s a hack and architecturally wrong for this solution, and it was not intended to keep files in version control.
The “random password per server” approach works on writing little stub files text here and there and I can see it being possible for, if --ask-vault-pass was set, and I can see this approach being fiddly. We’re unlikely to want to implement this though, because the random password generator bits are not designed to keep all the data in one file – it was an interesting plugin, but probably not implemented the way you want.
What you’d propose here I think is better served by keeping a file in a configurable location, like
{{ lookup(“password2”, “password.yml”, “mysql/” + inventory_hostname) }}
Which would store a key “mysql__{{inventory_hostname}}” in a YAML file.
Basically a rearchitected alternative to the password plugin.
where it would write a random password into password.yml under some_key and then encrypt and decrypt as needed using --ask-vault-pass.
This is going to be out of scope for 1.5, and we’re going to want to move on rather than build this for you, but if someone wants to implement this to the above suggested spec, I think it would be pretty interesting and useful.