# operating on multiple MySQL databases... **URL:** \ **Category:** Ansible Project\ **Created:** [July 12, 2013, 4:06pm UTC](https://forum.ansible.com/t/operating-on-multiple-mysql-databases/13111 "2013-07-12T16:06:08Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Dimon](https://avatars.discourse-cdn.com/v4/letter/d/eb8c5e/32.png) [@Dimon](https://forum.ansible.com/u/Dimon)\ **Post date:** [July 12, 2013, 4:06pm UTC](https://forum.ansible.com/t/operating-on-multiple-mysql-databases/13111/1 "2013-07-12T16:06:08Z")
Hi, my current usecase is to walk around multiple MySQL DB hosts and remove user from them. Sounds like a nice usecase for mysql\_user module. Bit of complication: all hosts have different root credentials. I do not want to either hardcode credentials into the playbook/CLI invocation nor do I feel comfortable sticking it on every box under ${HOME}/.my.cnf . What are current recommendations for this kind of scenario. I’ve seen vars\_prompt, however since I’ll need it per-host: how do I do that? Another thing - since we’re talking “action” vs “configuration” I felt it’s a task for “ansible CLI” vs “ansible-playbook”, am I understanding things correctly? What shall I do with multiple hosts and their login credentials? ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [July 12, 2013, 6:39pm UTC](https://forum.ansible.com/t/operating-on-multiple-mysql-databases/13111/2 "2013-07-12T18:39:31Z")
The typical way to keep secret data is to load them via “vars\_files” from a directory outside of your main playbooks repository. It is perfectly fine to set up playbooks for doing common tasks if you want to, I actually don’t use /usr/bin/ansible hardly ever, except maybe to reboot some nodes, or to check something simple like uptime. Though if you want to use the ansible program instead, that is fine too. But playbooks are for all kinds of processes, not just configuration. Rolling updates of applications are a particulary common non-OS-config task. ---
**Author:** ![Dimon](https://avatars.discourse-cdn.com/v4/letter/d/eb8c5e/32.png) [@Dimon](https://forum.ansible.com/u/Dimon)\ **Post date:** [July 12, 2013, 6:59pm UTC](https://forum.ansible.com/t/operating-on-multiple-mysql-databases/13111/3 "2013-07-12T18:59:38Z")
> The typical way to keep secret data is to load them via “vars\_files” from a directory outside of your main playbooks repository. I thought of that - but can’t find a way to do it “dictionary style” with mapping hostname → login:password for multiple machines. Am I looking at creating \_login and \_pass variables? Any better solutions that I can recycle inside a single “mysql\_user” command? > It is perfectly fine to set up playbooks for doing common tasks if you want to, I actually don’t use /usr/bin/ansible hardly ever, except maybe to reboot some nodes, or to check something simple like uptime. > Though if you want to use the ansible program instead, that is fine too. > > But playbooks are for all kinds of processes, not just configuration. > > Rolling updates of applications are a particulary common non-OS-config task. ok, good to know. I just got a feeling that ansible is “more natural” in setting things up, as running tasks becomes a bit more cumbersome with all the output suppressed etc. “ansible” in those cases is pleasantly verbose 🙂 ---
**Author:** ![Dimon](https://avatars.discourse-cdn.com/v4/letter/d/eb8c5e/32.png) [@Dimon](https://forum.ansible.com/u/Dimon)\ **Post date:** [July 12, 2013, 7:01pm UTC](https://forum.ansible.com/t/operating-on-multiple-mysql-databases/13111/4 "2013-07-12T19:01:23Z")
> ok, good to know. I just got a feeling that ansible is “more natural” in setting things up, as running tasks becomes a bit more cumbersome with all the output suppressed etc. “ansible” in those cases is pleasantly verbose 🙂 that should’ve read as: ok, good to know. I just got a feeling that **ansible-playbook** is “more natural” in setting things up, as running tasks becomes a bit more cumbersome with all the output suppressed etc. “ansible” in those cases is pleasantly verbose 🙂 ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [July 12, 2013, 7:51pm UTC](https://forum.ansible.com/t/operating-on-multiple-mysql-databases/13111/5 "2013-07-12T19:51:33Z")
That’s why there is the “-v” option to ansible-playbook 🙂 ---
**Author:** ![Dimon](https://avatars.discourse-cdn.com/v4/letter/d/eb8c5e/32.png) [@Dimon](https://forum.ansible.com/u/Dimon)\ **Post date:** [July 15, 2013, 4:37pm UTC](https://forum.ansible.com/t/operating-on-multiple-mysql-databases/13111/6 "2013-07-15T16:37:54Z")
you’ll have to agree that it is not nearly as useful as output of “absible” when it comes to post-processing. 😉 and yes - I do use “ansible-playbook -vv” a lot. ---
**Author:** ![Dimon](https://avatars.discourse-cdn.com/v4/letter/d/eb8c5e/32.png) [@Dimon](https://forum.ansible.com/u/Dimon)\ **Post date:** [July 15, 2013, 4:40pm UTC](https://forum.ansible.com/t/operating-on-multiple-mysql-databases/13111/7 "2013-07-15T16:40:33Z")
now that we’ve dealt with ansible vs ansible-playbook, what about the above. I did see vars\_files Michael mentioned but how do I do it per-host? Am I missing something obvious? ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [July 15, 2013, 4:50pm UTC](https://forum.ansible.com/t/operating-on-multiple-mysql-databases/13111/8 "2013-07-15T16:50:53Z")
“host\_vars” and “group\_vars” perhaps? ---
**Author:** ![Dimon](https://avatars.discourse-cdn.com/v4/letter/d/eb8c5e/32.png) [@Dimon](https://forum.ansible.com/u/Dimon)\ **Post date:** [July 15, 2013, 7:03pm UTC](https://forum.ansible.com/t/operating-on-multiple-mysql-databases/13111/9 "2013-07-15T19:03:02Z")
yes, I was looking at those. Still unconvinced I’d like to store those passwords clear-text (esp. when I push it into central repo). Probably I should just integrate gpg invocation to pull cred info into the vars. Sounds hacky but at least stores things securely. Now what’s the best way to marry ansible and gpg prompt? gpg-agent? Is it a completely whacked idea? ---
**Author:** ![Jim\_Kleckner](https://avatars.discourse-cdn.com/v4/letter/j/848f3c/32.png) [@Jim\_Kleckner](https://forum.ansible.com/u/Jim_Kleckner)\ **Post date:** [July 19, 2013, 2:43am UTC](https://forum.ansible.com/t/operating-on-multiple-mysql-databases/13111/10 "2013-07-19T02:43:42Z")
You might find this closed pull request interesting. It explored using a keyring implementation: [https://github.com/ansible/ansible/pull/2184](https://github.com/ansible/ansible/pull/2184) ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [July 19, 2013, 3:54am UTC](https://forum.ansible.com/t/operating-on-multiple-mysql-databases/13111/11 "2013-07-19T03:54:31Z")
See also very long (better) thread about storing encrypted data in a “vault” type approach. We need to squash the 1.3 bug queue first though before we start entertaining testing that. ---
**Author:** ![prateek\_gupta](https://avatars.discourse-cdn.com/v4/letter/p/f17d59/32.png) [@prateek\_gupta](https://forum.ansible.com/u/prateek_gupta)\ **Post date:** [April 15, 2014, 10:29am UTC](https://forum.ansible.com/t/operating-on-multiple-mysql-databases/13111/12 "2014-04-15T10:29:33Z")
Can you please cross check this Im trying to create a user but it gets executed but the user is not getting created in my RDS mysql DB .