community.general.systemd_creds_encrypt module – systemd‘s systemd-creds encrypt plugin

Note

This module is part of the community.general collection (version 10.7.5).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.general.

To use it in a playbook, specify: community.general.systemd_creds_encrypt.

New in community.general 10.2.0

Synopsis

  • This module encrypts input using systemd‘s systemd-creds encrypt.

Parameters

Parameter

Comments

name

string

The credential name to embed in the encrypted credential data.

not_after

string

The time when the credential shall not be used anymore.

Takes a timestamp specification in the format described in systemd.time(7).

pretty

boolean

Pretty print the output so that it may be pasted directly into a unit file.

Choices:

  • false ← (default)

  • true

secret

string / required

The secret to encrypt.

timestamp

string

The timestamp to embed into the encrypted credential.

Takes a timestamp specification in the format described in systemd.time(7).

user

string

A user name or numeric UID to encrypt the credential for.

If set to the special string self it sets the user to the user of the calling process.

Requires systemd 256 or later.

Attributes

Attribute

Support

Description

check_mode

Support: full

This action does not modify state.

Can run in check_mode and return changed status prediction without modifying target.

diff_mode

Support: N/A

This action does not modify state.

Will return details on what has changed (or possibly needs changing in check_mode), when in diff mode.

Notes

Note

  • systemd-creds requires systemd 250 or later.

Examples

- name: Encrypt secret
  become: true
  community.general.systemd_creds_encrypt:
    name: db
    not_after: +48hr
    secret: access_token
  register: encrypted_secret

- name: Print the encrypted secret
  ansible.builtin.debug:
    msg: "{{ encrypted_secret }}"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

value

string

The Base64 encoded encrypted secret.

Returned: always

Sample: "WhQZht+JQJax1aZemmGLxmAAAA..."

Authors

  • Thomas Sjögren (@konstruktoid)