Unexpected password-lookup behaviour after re-organizing playbooks using roles

Archives Ansible Project
1

Dear all,

After re-organising my playbooks using roles and changing $PASSWORD(credentials/mysql/root) to {{ lookup(‘password’, ‘credentials/mysql/root’) }}, I run into troubles configuring mysql.

file: ansible-playbooks/roles/mysql/tasks/main.yml

  • name: MySQL | Set the root password
    mysql_user: user=root password=“{{ lookup(‘password’, ‘credentials/mysql/root’) }}” host=localhost

  • name: MySQL | Config for easy access as root user
    template: src=root-my-cnf.j2 dest=/root/.my.cnf

file: ansible-playbooks/roles/mysql/templates/root-my-cnf.j2

[client]
user=root
pass={{ lookup(‘password’, ‘credentials/mysql/root’) }}

I didn’t expect any change after the reorganization, but although both mysql_user and template action use the same lookup, they access different files:

  • template: as expected, ansible-playbooks/credentials/mysql/root and uses old password
  • mysql_user: ansible-playbooks/roles/mysql/files/credentials/mysql/root and generates new (and different) password

Note that ansible-playbooks/roles/mysql/files exists and contains other files, but credentials didn’t exist before running the playbook.

Quick and dirty workarounds would be to rely on either (obsolete) $PASSWORD-syntax, or create symlinks roles/mysql/files/credentials to …/…/…/credentials, or use absolute paths. None of these solutions seem elegant, so I’m looking for a proper solution.

Any ideas how to make sure the top-level credentials files is accessed by both mysql_user and template actions?

Kind regards,
Koen

2

The plugin will not generate password files when they are present.

I suspect you were running the playbook when the file was not present and it regenerated the password.

This is not a syntax issue.

3

Let me clarify the issue:

The file /etc/ansible/credentials/mysql/root exists before running the playbook and the password therein is used by the template action (which is run after the mysql_user action). However, for the mysql_user a new file and password generated in /etc/ansible/roles/mysql/files/credentials/mysql/root.

I expected both mysql_user and template action to access the same file (/etc/ansible/credentials/mysql/root).

Any ideas?

grtz, Koen