Lookup vault in memory

Archives Ansible Project
1

Hi,
I have a question about lookup and memory:
When I use a lookup with vault, is the pass is store in memory when I use it directly in a task or pass it through a variable in an inventory ? Is there a significant difference ?

Have a nice day.

2

For more information :
I’m concerned about security issue in my company where the continous delivery is share between many teams. I would like to not store secret in memory or at least the shortest possible time. I supposed that if I use my lookup directly in task and not in a variable I was safer. Am I right ?

3

There is no difference because of "Lazy Evaluation" ("Ansible evaluates any
variables in playbook content at the last possible second."), I think. See
https://docs.ansible.com/ansible/latest/reference_appendices/glossary.html

(Is this hashi_vault plugin?)

Cheers,

  -vlado

4

Yes It is.
I mean if I don’t use it as a variable but directly in a task as a parameter.
As example:
Is there a difference between

  • shell: check.sh {{ lookup(‘hashi_vault’, ‘secret=secret1’) }}
    And
  • shell: check.sh {{ password 1}}
    Where password1 is defined in an inventory

It seems logical to me than the first one is safer and evaluate later

5

I can only assume that "password1 is defined in an inventory" means a
similar line can be found in an inventory

  password1: "{{ lookup('hashi_vault', 'secret=secret1') }}"

(Otherwise the comparison does not make much sense).

I can only repeat that both arguments below will be decrypted at the same
time because of the "Lazy Evaluation" ("Ansible evaluates any variables in
playbook content at the last possible second.")

  - shell: "check.sh {{ lookup('hashi_vault', 'secret=secret1') }}"
  - shell: "check.sh {{ password1 }}"

Cheers,

  -vlado

6

Thanks vlado for your responses.

Yes, sorry for not being clear, password1 was defined in an inventory.

It's almost clear now.
Does it mean that if i use a variable from inventory twice It will be evaluate twice or the variable will be store in memory ? Same question for lookup directly in task.

By the way, have you any advice in order to not store vault secret in memory.

And sorry for bad english (plus I write from a phone)

Have a nice day and thanks once again)

7

Does it mean that if i use a variable from inventory twice It will be
evaluate twice or the variable will be store in memory ? Same question for
lookup directly in task.

It will be evaluated twice. In general the expansions "{{ }}" will be "lazy"
evaluated when referenced.

By the way, have you any advice in order to not store vault secret in memory.

As described, the value is not stored in memory for longer time than needed, I
think.

You're welcome. Cheers,

  -vlado

8

Ok, thank you very much for your explanation.
Have a nice day !