<p>I have a kubernetes secrets manifest in the form of secret.j2 file which has a password key. This password key is supposed assigned a value from an ansible-vault encrypted string present in a dev.yml file. This dev.yml looks like below:-</p>
<pre><code>dev_db_password: !vault |
    $ANSIBLE_VAULT;1.1;AES256
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
</code></pre>
<p>I am passing &quot;dev&quot; as a runtime parameter &quot;namespace=dev&quot; to my playbook. The stringData of secret.j2 looks like this:-</p>
<pre><code>stringData:
 consoleadminpassword: &quot;{{'{{'}} {{ namespace + '_console_password' }} {{'}}'}}&quot;
 consolenonadminpassword: &quot;{{'{{'}} {{ namespace + '_console_password' }} {{'}}'}}&quot;
 dbpassword: &quot;{{'{{'}} {{ namespace + '_console_password' }} {{'}}'}}&quot;
</code></pre>
<p>When I am templating secret.j2 to secret.yml, the resulting output of stringData looks like this:-</p>
<pre><code>stringData:
  consoleadminpassword: &quot;{{ dev_console_password }}&quot;
  consolenonadminpassword: &quot;{{ dev_console_password }}&quot;
  dbpassword: &quot;{{ dev_db_password }}&quot;
</code></pre>
<p>Now I want it to further evaluate the &quot;dev_db_password&quot; to set &quot;dbpassword&quot; key to the decrypted value from dev.yml while ansible templates secret.j2 to secret.yml. Is there a way to achieve this in the same line by modifying <code>dbpassword: &quot;{{'{{'}} {{ namespace + '_db_password' }} {{'}}'}}&quot;</code> ?</p>

Suyash Gupta
<p>Q: <strong>&quot;<em>evaluate the dev_db_password ... while ansible templates secret.j2. Is there a way to achieve this in the same line by modifying <em>dbpassword:</em> ... ?</em>&quot;</strong></p>
<p>A: Yes. There is. Try <em>lookup</em> plugin <em>vars</em>. See <code>ansible-doc -t lookup vars</code></p>
<pre class="lang-yaml prettyprint-override"><code>dbpassword: &quot;{{'{{'}} {{ lookup('vars', namespace + '_db_password') }} {{'}}'}}&quot;
</code></pre>
<p>For example, the template</p>
<pre class="lang-yaml prettyprint-override"><code>shell&gt; cat secret.j2
stringData:
  consoleadminpassword: &quot;{{'{{'}} {{ lookup('vars', namespace + '_console_password') }} {{'}}'}}&quot;
  consolenonadminpassword: &quot;{{'{{'}} {{ lookup('vars', namespace + '_console_password') }} {{'}}'}}&quot;
  dbpassword: &quot;{{'{{'}} {{ lookup('vars', namespace + '_db_password') }} {{'}}'}}&quot;
</code></pre>
<p>and the playbook</p>
<pre class="lang-yaml prettyprint-override"><code>- hosts: localhost
  tasks:
    - template:
        src: secret.j2
        dest: secret.yml
      vars:
        namespace: dev
        dev_console_password: passwd_console
        dev_db_password: passwd_db
</code></pre>
<p>give</p>
<pre class="lang-yaml prettyprint-override"><code>shell&gt; cat secret.yml 
stringData:
  consoleadminpassword: &quot;{{ passwd_console }}&quot;
  consolenonadminpassword: &quot;{{ passwd_console }}&quot;
  dbpassword: &quot;{{ passwd_db }}&quot;
</code></pre>
<hr>
<p>If you don't need the next evaluation of the variables (passwords) in the  dictionary the template below</p>
<pre class="lang-yaml prettyprint-override"><code>shell&gt; cat secret.j2
stringData:
  consoleadminpassword: {{ lookup('vars', namespace + '_console_password') }}
  consolenonadminpassword: {{ lookup('vars', namespace + '_console_password') }}
  dbpassword: {{ lookup('vars', namespace + '_db_password') }}
</code></pre>
<p>will give</p>
<pre class="lang-yaml prettyprint-override"><code>shell&gt; cat secret.yml 
stringData:
  consoleadminpassword: passwd_console
  consolenonadminpassword: passwd_console
  dbpassword: passwd_db
</code></pre>
<hr>
<p>If you put the passwords into an encrypted file</p>
<pre class="lang-yaml prettyprint-override"><code>shell&gt; cat dev.yml 
dev_console_password: passwd_console
dev_db_password: passwd_db
</code></pre>
<pre class="lang-sh prettyprint-override"><code>shell&gt; ansible-vault encrypt dev.yml
Encryption successful
</code></pre>
<pre class="lang-sh prettyprint-override"><code>shell&gt; cat dev.yml
$ANSIBLE_VAULT;1.1;AES256
30663636653963333864346339303034356463356234383035363561356365376130396465323736
...
</code></pre>
<p>the playbook will give the same results</p>
<pre class="lang-yaml prettyprint-override"><code>- hosts: localhost
  vars:
    namespace: dev
  tasks:
    - include_vars: &quot;{{ namespace }}.yml&quot;
    - template:
        src: secret.j2
        dest: secret.yml
</code></pre>
