Hi – I’ve got a playbook with multiple plays. One play depends on ability to unlock an ansible-vault and declares this fact in the var_files section of the play:
a_playbook.yml
- hosts: local
vars_files:
- var_files/encrypted_secret_variables.yml
tasks:
Prior to ansible2 it was possible to run this playbook without providing the ansible-vault-password as long as --skip-tags matched all tasks within the play shown.
Is there a way to achieve this with ansible2? My use case is that I have some playbooks which define some automation tasks, portions of these playbooks only need to be run some of the time and are only able to be run by people who can decrypt the required vault. Other plays wishing this same playbook described related automation/manage related systems and should be runnable with an appropriate -s option.
I’ll give some more specifics on why I want to do this, maybe someone can offer suggestions for alternative approach? a_playbook.yml describes release automation for a software artifact – everything up to the actual deployment of the release to its final production resting place is runnable by anyone – steps which involve mutating production systems to actually deploy the release artifacts are only runnable when you unlock the vault. Describing the whole end to end process in a single playbook is nice for readability/reproducibility/portability …