Using raw passwords with ansible_password directly in playbooks deprecated?

Archives Ansible Project
1

The reasoning behind not revealing username/passwords directly in playbooks is obvious and speaks for itself.

However, I am calling playbooks from an application that includes credential security/management, and provides credentials at runtime.

For this reason, including ansible_user/ansible_password directly in our playbook invocations works well.

My question …

I seem to recall seeing something about this method of providing credentials has been tagged as deprecated, but now I can’t find where it says so. Is this method being deprecated, or am i mis-recollecting?

Thanks,
Matt

2

You're doing it properly. There is also ansible_ssh_pass, but that's been emphasized less in favor of the ansible_password transport-agnostic version.

V/r,
James Cassell

3

Hmmm. I could of sworn I remembered seeing something to that affect. Anyway, great to hear.

Thanks James!

4

both generic and specific will work (it is defined by each connection
plugin some even have many variations), just note that the specific
has greater precedence so if you use both with ssh, ansible_ssh_pass
will override ansible_password.