community.sops.sops – Loading sops-encrypted vars files
community.sops.sops – Loading sops-encrypted vars files
Note
This plugin is part of the community.sops collection (version 1.0.4).
To install it use: ansible-galaxy collection install community.sops
.
To use it in a playbook, specify: community.sops.sops
.
New in version 0.1.0: of community.sops
Synopsis
- Load encrypted YAML files into corresponding groups/hosts in group_vars/ and host_vars/ directories.
- Files are encrypted prior to reading, making this plugin an effective companion to host_group_vars plugin.
- Files are restricted to .sops.yaml, .sops.yml, .sops.json extensions.
- Hidden files are ignored.
Parameters
Parameter | Choices/Defaults | Configuration | Comments |
---|---|---|---|
_valid_extensions list / elements=string |
Default: [".sops.yml", ".sops.yaml", ".sops.json"] |
Check all of these extensions when looking for 'variable' files which should be YAML or JSON or vaulted versions of these. This affects vars_files, include_vars, inventory and vars plugins among others. | |
aws_access_key_id string added in 1.0.0 of community.sops |
The AWS access key ID to use for requests to AWS. Sets the environment variable | ||
aws_profile string added in 1.0.0 of community.sops |
The AWS profile to use for requests to AWS. This corresponds to the sops | ||
aws_secret_access_key string added in 1.0.0 of community.sops |
The AWS secret access key to use for requests to AWS. Sets the environment variable | ||
aws_session_token string added in 1.0.0 of community.sops |
The AWS session token to use for requests to AWS. Sets the environment variable | ||
cache boolean added in 0.2.0 of community.sops |
|
ini entries: [community.sops]vars_cache = yes
env:ANSIBLE_VARS_SOPS_PLUGIN_CACHE |
Whether to cache decrypted files or not. If the cache is disabled, the files will be decrypted for almost every task. This is very slow! Only disable caching if you modify the variable files during a playbook run and want the updated result to be available from the next task on. Note that setting stage to |
config_path path added in 1.0.0 of community.sops |
Path to the sops configuration file. If not set, sops will recursively search for the config file starting at the file that is encrypted or decrypted. This corresponds to the sops | ||
enable_local_keyservice boolean added in 1.0.0 of community.sops |
|
Tell sops to use local key service. This corresponds to the sops | |
keyservice list / elements=string added in 1.0.0 of community.sops |
Specify key services to use next to the local one. A key service must be specified in the form This corresponds to the sops | ||
sops_binary path added in 1.0.0 of community.sops |
Path to the sops binary. By default uses | ||
stage string added in 0.2.0 of community.sops |
|
ini entries: [community.sops]vars_stage = None
env:ANSIBLE_VARS_SOPS_PLUGIN_STAGE |
Control when this vars plugin may be executed. Setting this option to Setting this option to Setting this option to If this option is omitted, the global RUN_VARS_PLUGINS configuration is used to determine when to execute the vars plugin. |
Authors
- Edoardo Tenani (@endorama) <[email protected]>
© 2012–2018 Michael DeHaan
© 2018–2021 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.11/collections/community/sops/sops_vars.html