Hi -- I've got a playbook with multiple plays. One play depends on ability
to unlock an ansible-vault and declares this fact in the var_files section
of the play:
a_playbook.yml
```
- hosts: local
vars_files:
- var_files/encrypted_secret_variables.yml
tasks:
```
Prior to ansible2 it was possible to run this playbook without providing
the ansible-vault-password as long as --skip-tags matched all tasks within
the play shown.
Is there a way to achieve this with ansible2? My use case is that I have
some playbooks which define some automation tasks, portions of these
playbooks only need to be run some of the time and are only able to be run
by people who can decrypt the required vault. Other plays wishing this
same playbook described related automation/manage related systems and
should be runnable with an appropriate -s option.
I'll give some more specifics on why I want to do this, maybe someone can
offer suggestions for alternative approach? a_playbook.yml describes
release automation for a software artifact -- everything up to the actual
deployment of the release to its final production resting place is runnable
by anyone -- steps which involve mutating production systems to actually
deploy the release artifacts are only runnable when you unlock the vault.
Describing the whole end to end process in a single playbook is nice for
readability/reproducibility/portability ...
--
You received this message because you are subscribed to the Google Groups
"Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to ansible-project+unsubscr...@googlegroups.com.
To post to this group, send email to ansible-project@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/ansible-project/CABUBibtLKUp3fx3Gh01ddx4Fv%2BvLb0P14r%2Bq213ewGK23_s7EA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.
