community.general.passwordstore lookup – manage passwords with passwordstore.org’s pass utility
Note
This lookup plugin is part of the community.general collection (version 10.1.0).
You might already have this collection installed if you are using the ansible package.
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install community.general.
To use it in a playbook, specify: community.general.passwordstore.
Synopsis
Enables Ansible to retrieve, create or update passwords from the passwordstore.org pass utility. It can also retrieve, create or update YAML style keys stored as multilines in the passwordfile.
To avoid problems when accessing multiple secrets at once, add
auto-expand-secmemto~/.gnupg/gpg-agent.conf. Where this is not possible, consider usinglock=readwriteinstead.
Terms
Parameter |
Comments |
|---|---|
query key. |
Keyword parameters
This describes keyword parameters of the lookup. These are the values key1=value1, key2=value2 and so on in the following
examples: lookup('community.general.passwordstore', key1=value1, key2=value2, ...) and query('community.general.passwordstore', key1=value1, key2=value2, ...)
Parameter |
Comments |
|---|---|
Specify which backend to use. Defaults to
Choices:
Configuration:
|
|
Used with Choices:
|
|
Create the password or the subkey if it does not already exist. Takes precedence over Choices:
|
|
The directory of the password store. If If Configuration:
|
|
The length of the generated password. Default: |
|
How to synchronize operations. The default of
Choices:
Configuration:
|
|
Lock timeout applied when Time with a unit suffix, Correlates with Default: Configuration:
|
|
List of preference about what to do if the password file is missing. If If set to If set to If set to Choices:
|
|
Preference about what to do if the password subkey is missing. If set to If set to Choices:
Configuration:
|
|
Use alphanumeric characters. Choices:
|
|
Overwrite the password or the subkey if it does already exist. Choices:
|
|
Include the old (edited) password inside the pass file. Choices:
|
|
Return all the content of the password, not only the first line. Choices:
|
|
By default return a specific subkey of the password. When set to With Default: |
|
Add the password generation information to the end of the file. Choices:
|
|
Sets the umask for the created Note pass’ default value is Configuration:
|
|
Specify a password to save, instead of a generated one. |
Notes
Note
When keyword and positional parameters are used together, positional parameters must be listed before keyword parameters:
lookup('community.general.passwordstore', term1, term2, key1=value1, key2=value2)andquery('community.general.passwordstore', term1, term2, key1=value1, key2=value2)The lookup supports passing all options as lookup parameters since community.general 6.0.0.
Examples
ansible.cfg: |
[passwordstore_lookup]
lock=readwrite
locktimeout=45s
missing_subkey=warn
tasks.yml: |
---
# Debug is used for examples, BAD IDEA to show passwords on screen
- name: Basic lookup. Fails if example/test does not exist
ansible.builtin.debug:
msg: "{{ lookup('community.general.passwordstore', 'example/test')}}"
- name: Basic lookup. Warns if example/test does not exist and returns empty string
ansible.builtin.debug:
msg: "{{ lookup('community.general.passwordstore', 'example/test', missing='warn')}}"
- name: Create pass with random 16 character password. If password exists just give the password
ansible.builtin.debug:
var: mypassword
vars:
mypassword: "{{ lookup('community.general.passwordstore', 'example/test', create=true)}}"
- name: Create pass with random 16 character password. If password exists just give the password
ansible.builtin.debug:
var: mypassword
vars:
mypassword: "{{ lookup('community.general.passwordstore', 'example/test', missing='create')}}"
- name: >-
Create a random 16 character password in a subkey. If the password file already exists, just add the subkey in it.
If the subkey exists, returns it
ansible.builtin.debug:
msg: "{{ lookup('community.general.passwordstore', 'example/test', create=true, subkey='foo') }}"
- name: >-
Create a random 16 character password in a subkey. Overwrite if it already exists and backup the old one.
ansible.builtin.debug:
msg: "{{ lookup('community.general.passwordstore', 'example/test', create=true, subkey='user', overwrite=true, backup=true) }}"
- name: Prints 'abc' if example/test does not exist, just give the password otherwise
ansible.builtin.debug:
var: mypassword
vars:
mypassword: >-
{{ lookup('community.general.passwordstore', 'example/test', missing='empty')
| default('abc', true) }}
- name: Different size password
ansible.builtin.debug:
msg: "{{ lookup('community.general.passwordstore', 'example/test', create=true, length=42)}}"
- name: >-
Create password and overwrite the password if it exists.
As a bonus, this module includes the old password inside the pass file
ansible.builtin.debug:
msg: "{{ lookup('community.general.passwordstore', 'example/test', create=true, overwrite=true)}}"
- name: Create an alphanumeric password
ansible.builtin.debug:
msg: "{{ lookup('community.general.passwordstore', 'example/test', create=true, nosymbols=true) }}"
- name: Return the value for user in the KV pair user, username
ansible.builtin.debug:
msg: "{{ lookup('community.general.passwordstore', 'example/test', subkey='user')}}"
- name: Return the entire password file content
ansible.builtin.set_fact:
passfilecontent: "{{ lookup('community.general.passwordstore', 'example/test', returnall=true)}}"
Return Value
Key |
Description |
|---|---|
a password Returned: success |