community.general.systemd_creds_decrypt module – systemd‘s systemd-creds decrypt plugin

Note

This module is part of the community.general collection (version 10.7.5).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.general.

To use it in a playbook, specify: community.general.systemd_creds_decrypt.

New in community.general 10.2.0

Synopsis

  • This module decrypts input using systemd‘s systemd-creds decrypt.

Parameters

Parameter

Comments

name

string

The credential name to validate the embedded credential name.

newline

boolean

Whether to add a trailing newline character to the end of the output, if not present.

Choices:

  • false ← (default)

  • true

secret

string / required

The secret to decrypt.

timestamp

string

The timestamp to use to validate the not-after timestamp that was used during encryption.

Takes a timestamp specification in the format described in systemd.time(7).

transcode

string

Whether to transcode the output before returning it.

Choices:

  • "base64"

  • "unbase64"

  • "hex"

  • "unhex"

user

string

A user name or numeric UID when decrypting from a specific user context.

If set to the special string self it sets the user to the user of the calling process.

Requires systemd 256 or later.

Attributes

Attribute

Support

Description

check_mode

Support: full

This action does not modify state.

Can run in check_mode and return changed status prediction without modifying target.

diff_mode

Support: N/A

This action does not modify state.

Will return details on what has changed (or possibly needs changing in check_mode), when in diff mode.

Notes

Note

  • systemd-creds requires systemd 250 or later.

Examples

- name: Decrypt secret
  community.general.systemd_creds_decrypt:
    name: db
    secret: "WhQZht+JQJax1aZemmGLxmAAAA..."
  register: decrypted_secret

- name: Print the decrypted secret
  ansible.builtin.debug:
    msg: "{{ decrypted_secret }}"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

value

string

The decrypted secret.

Note that Ansible only supports returning UTF-8 encoded strings. If the decrypted secret is binary data, or a string encoded in another way, use transcode=base64 or transcode=hex to circument this restriction. You then need to decode the data when using it, for example using the ansible.builtin.b64decode filter.

Returned: always

Sample: "access_token"

Authors

  • Thomas Sjögren (@konstruktoid)