{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible/issues/15617","repository_url":"https://api.github.com/repos/ansible/ansible","labels_url":"https://api.github.com/repos/ansible/ansible/issues/15617/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible/issues/15617/comments","events_url":"https://api.github.com/repos/ansible/ansible/issues/15617/events","html_url":"https://github.com/ansible/ansible/issues/15617","id":151325624,"number":15617,"title":"Enable encrypted password support in ansible via individually encrypted values","user":{"login":"ssbarnea","id":102495,"avatar_url":"https://avatars.githubusercontent.com/u/102495?v=3","gravatar_id":"","url":"https://api.github.com/users/ssbarnea","html_url":"https://github.com/ssbarnea","followers_url":"https://api.github.com/users/ssbarnea/followers","following_url":"https://api.github.com/users/ssbarnea/following{/other_user}","gists_url":"https://api.github.com/users/ssbarnea/gists{/gist_id}","starred_url":"https://api.github.com/users/ssbarnea/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ssbarnea/subscriptions","organizations_url":"https://api.github.com/users/ssbarnea/orgs","repos_url":"https://api.github.com/users/ssbarnea/repos","events_url":"https://api.github.com/users/ssbarnea/events{/privacy}","received_events_url":"https://api.github.com/users/ssbarnea/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ansible/ansible/labels/feature_idea","name":"feature_idea","color":"006b75"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-04-27T08:16:45Z","updated_at":"2016-04-27T17:22:17Z","closed_at":null,"body":"Currently Ansible solution to the security of the sensitive data is ansible-vault which has some serious design issues that would never be solvable by that module. Security must be part of the code ansible approach.\r\n\r\nFirst problem is that you cannot search inside ansible-vaults, so if you are trying to find out where a variable is used you will search the entire repository and not find the vault file because, well is encrypted.\r\n\r\n2nd problem is that you cannot really use SCM (like git) to merge vault files.\r\n\r\n3rd problem is that you cannot use different vaults.\r\n\r\nHave a look at Travis and the way they solved the management of sensitive information, they encrypt only the value, you can encrypt any value, anywhere. \r\n\r\nBecause Ansible supports jinja2 this makes me think that we could probably implement this with the help of it. As a note, it would be wonderful if, while implementing this, we could also specify an optional secret key to use for decryption. This would allow us to encrypt different secrets with different keys, allowing us to give access to ansible on a finer grade: some people could get only the decryption keys for staging but not the ones for production.\r\n\r\nReference: https://docs.travis-ci.com/user/encryption-keys/"},"comment":{"url":"https://api.github.com/repos/ansible/ansible/issues/comments/215157944","html_url":"https://github.com/ansible/ansible/issues/15617#issuecomment-215157944","issue_url":"https://api.github.com/repos/ansible/ansible/issues/15617","id":215157944,"user":{"login":"abadger","id":209242,"avatar_url":"https://avatars.githubusercontent.com/u/209242?v=3","gravatar_id":"","url":"https://api.github.com/users/abadger","html_url":"https://github.com/abadger","followers_url":"https://api.github.com/users/abadger/followers","following_url":"https://api.github.com/users/abadger/following{/other_user}","gists_url":"https://api.github.com/users/abadger/gists{/gist_id}","starred_url":"https://api.github.com/users/abadger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abadger/subscriptions","organizations_url":"https://api.github.com/users/abadger/orgs","repos_url":"https://api.github.com/users/abadger/repos","events_url":"https://api.github.com/users/abadger/events{/privacy}","received_events_url":"https://api.github.com/users/abadger/received_events","type":"User","site_admin":false},"created_at":"2016-04-27T17:22:17Z","updated_at":"2016-04-27T17:22:17Z","body":"/cc @bcoca \r\n\r\nbcoca is Looking at several vault improvements for 2.2.  The notes I have say that there's a PR already open for something that sounds a lot like this but I wasn't able to find it.  Might be something to talk to bccoa about on IRC (we're in #ansible-devel on irc.freenode.net) once the 2.2 roadmap is sent ot the mailing list."}}