# Questions regarding the ansible sops collection

**URL:** <https://forum.ansible.com/t/questions-regarding-the-ansible-sops-collection/36569>\
**Category:** Ansible Project\
**Created:** [April 27, 2022, 7:56am UTC](https://forum.ansible.com/t/questions-regarding-the-ansible-sops-collection/36569 "2022-04-27T07:56:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![schoeppi](https://avatars.discourse-cdn.com/v4/letter/s/76d3ee/32.png) [@schoeppi](https://forum.ansible.com/u/schoeppi)\
**Post date:** [April 27, 2022, 7:56am UTC](https://forum.ansible.com/t/questions-regarding-the-ansible-sops-collection/36569/1 "2022-04-27T07:56:55Z")

</div>

Hello,

I am relatively new to ansible and I want to use the sops collection to  
decrypt some sensible data for our ansible playbooks / roles that we want to  
store in a git repo. Unfortunatly things are not working as expected, which  
might be because I do not understand all things corect. I'd would be great  
if you can help me things sort out...

For test reasons and to understand how to work with sops and ansible I did  
the following:

1. I've created a file  
inventories/test/group\_vars/ansible\_become\_password.sops.yml with the  
following decrypted content:

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [April 27, 2022, 4:15pm UTC](https://forum.ansible.com/t/questions-regarding-the-ansible-sops-collection/36569/2 "2022-04-27T16:15:36Z")

</div>

Hi,

> I am relatively new to ansible and I want to use the sops collection  
> to decrypt some sensible data for our ansible playbooks / roles that  
> we want to store in a git repo. Unfortunatly things are not working  
> as expected, which might be because I do not understand all things  
> corect. I'd would be great if you can help me things sort out...
> 
> For test reasons and to understand how to work with sops and ansible  
> I did the following:
> 
> 1. I've created a file  
> inventories/test/group\_vars/ansible\_become\_password.sops.yml with the  
> following decrypted content:  
> [...]  
> This looks good to me...
> 
> 3. Now I've created this little playbook to test decryption:
> 
> -----  
> ---  
> - name: Create sops-encrypted private key  
> &nbsp;&nbsp;hosts: localhost  
> &nbsp;&nbsp;gather\_facts: false  
> &nbsp;&nbsp;tasks:  
> &nbsp;&nbsp;&nbsp;&nbsp;- name: Load encrypted credentials  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;community.sops.load\_vars:  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;file:  
> /home/cs/git/linova/linova-gitops/ansible/inventories/test/group\_vars/ansible\_become\_password.sops.yml  
> expressions: evaluate-on-load
> 
> &nbsp;&nbsp;&nbsp;&nbsp;- name: Show password  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;debug:  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;msg: "The password is {{ ansible\_become\_password }}"  
> -----

> 4. Wehn I run the playbook I get the following output:
> 
> [WARNING]: Removed restricted key from module data:  
> ansible\_become\_password = ansible

This is the relevant warning. Ansible-core apparently does not allow  
modules or action plugins to return certain values, in particular  
ansible\_become\_password. Since you are asking the  
community.sops.load\_vars action to decrypt a file containing that  
value, and ansible-core throws that value away, you cannot use it later  
on.

(This is in part because community.sops.load\_vars is kind of a hack.  
Proper variable loading is not possible for actions that are not part  
of ansible-core itself.)

> 1. Am I going into the right direction and are my steps OK in  
> general, or do I follow a wrong way to handle our encrypted data with  
> the plugin?

Instead of using community.sops.load\_vars, you should use the  
community.sops.sops vars plugin. That allows to load group and host  
vars that are sops encrypted. To use this, you need to activate the  
vars plugin as shown here:  
[https://github.com/ansible-collections/community.sops#vars-plugin](https://github.com/ansible-collections/community.sops#vars-plugin)

I think your inventory file is named correctly so that simply enabling  
the community.sops.sops vars plugin should suffice in your case. With  
it, simply this should already work: