Ooops ! I just pushed my unencrypted vault/secets file to the Git repo...

Archives Ansible Developer
1

Hello everyone, I had opened this “feature suggestion” issue :

https://github.com/ansible/ansible/issues/9990

And Toshio suggested I discuss it in the mailing list, so here I to :

The problem :

It is easy to add an unencrypted vault file to the Git index before commiting. The nature of Git will cause the secrets to be in the repo “forever”, unless a git rest + git force push is done.

A solution :

Have a switch to cause the naming of encrypted files to have different name (ex. append a suffix) than that of the clear YAML file,
so that the clear file can be added to .gitignore

This sounds like the simplest solution, but maybe there is a simpler way that could work without requiring changes/feature to the current ansible version.

Thanks for reading !

2

I solved this problem with a naming convention, and a git hook that
rejected files with that naming convention that were unencrypted (it's
pretty easy to tell- even when encrypted, they're still plain text,
and there's a header.)

3

Cool, would you mind sharing your git hook config/code ?