ansible/test/integration/roles/test_vault_embedded/vars/main.yml

# If you use normal 'ansible-vault create' or edit, files always have at least one new line
# so c&p from a vault encrypted that wasn't specifically created sans new line ends up with one.
# (specifically created, as in 'echo -n "just one line" > my_secret.yml'
vault_encrypted_var: !vault-encrypted |
              $ANSIBLE_VAULT;1.1;AES256
              66386439653236336462626566653063336164663966303231363934653561363964363833313662
              6431626536303530376336343832656537303632313433360a626438346336353331386135323734
              62656361653630373231613662633962316233633936396165386439616533353965373339616234
              3430613539666330390a313736323265656432366236633330313963326365653937323833366536
              34623731376664623134383463316265643436343438623266623965636363326136
vault_encrypted_one_line_var: !vault-encrypted |
                              $ANSIBLE_VAULT;1.1;AES256
                              33363965326261303234626463623963633531343539616138316433353830356566396130353436
                              3562643163366231316662386565383735653432386435610a306664636137376132643732393835
                              63383038383730306639353234326630666539346233376330303938323639306661313032396437
                              6233623062366136310a633866373936313238333730653739323461656662303864663666653563
                              3138
Implement vault encrypted yaml variables. (#16274) Make !vault-encrypted create a AnsibleVaultUnicode yaml object that can be used as a regular string object. This allows a playbook to include a encrypted vault blob for the value of a yaml variable. A 'secret_password' variable can have it's value encrypted instead of having to vault encrypt an entire vars file. Add __ENCRYPTED__ to the vault yaml types so template.Template can treat it similar to __UNSAFE__ flags. vault.VaultLib api changes: - Split VaultLib.encrypt to encrypt and encrypt_bytestring - VaultLib.encrypt() previously accepted the plaintext data as either a byte string or a unicode string. Doing the right thing based on the input type would fail on py3 if given a arg of type 'bytes'. To simplify the API, vaultlib.encrypt() now assumes input plaintext is a py2 unicode or py3 str. It will encode to utf-8 then call the new encrypt_bytestring(). The new methods are less ambiguous. - moved VaultLib.is_encrypted logic to vault module scope and split to is_encrypted() and is_encrypted_file(). Add a test/unit/mock/yaml_helper.py It has some helpers for testing parsing/yaml Integration tests added as roles test_vault and test_vault_embedded 2016-08-24 02:03:11 +02:00			`# If you use normal 'ansible-vault create' or edit, files always have at least one new line`
			`# so c&p from a vault encrypted that wasn't specifically created sans new line ends up with one.`
			`# (specifically created, as in 'echo -n "just one line" > my_secret.yml'`
			`vault_encrypted_var: !vault-encrypted \|`
			`$ANSIBLE_VAULT;1.1;AES256`
			`66386439653236336462626566653063336164663966303231363934653561363964363833313662`
			`6431626536303530376336343832656537303632313433360a626438346336353331386135323734`
			`62656361653630373231613662633962316233633936396165386439616533353965373339616234`
			`3430613539666330390a313736323265656432366236633330313963326365653937323833366536`
			`34623731376664623134383463316265643436343438623266623965636363326136`
			`vault_encrypted_one_line_var: !vault-encrypted \|`
			`$ANSIBLE_VAULT;1.1;AES256`
			`33363965326261303234626463623963633531343539616138316433353830356566396130353436`
			`3562643163366231316662386565383735653432386435610a306664636137376132643732393835`
			`63383038383730306639353234326630666539346233376330303938323639306661313032396437`
			`6233623062366136310a633866373936313238333730653739323461656662303864663666653563`
			`3138`