ansible/test/integration/roles/test_vault_embedded/tasks/main.yml

---
- name: Assert that a embedded vault of a string with no newline works
  assert:
    that:
      - '"{{ vault_encrypted_one_line_var }}" == "Setec Astronomy"'

- name: Assert that a multi line embedded vault works, including new line
  assert:
    that:
      - vault_encrypted_var == "Setec Astronomy\n"

# TODO: add a expected fail here
# - debug: var=vault_encrypted_one_line_var_with_embedded_template
Implement vault encrypted yaml variables. (#16274) Make !vault-encrypted create a AnsibleVaultUnicode yaml object that can be used as a regular string object. This allows a playbook to include a encrypted vault blob for the value of a yaml variable. A 'secret_password' variable can have it's value encrypted instead of having to vault encrypt an entire vars file. Add __ENCRYPTED__ to the vault yaml types so template.Template can treat it similar to __UNSAFE__ flags. vault.VaultLib api changes: - Split VaultLib.encrypt to encrypt and encrypt_bytestring - VaultLib.encrypt() previously accepted the plaintext data as either a byte string or a unicode string. Doing the right thing based on the input type would fail on py3 if given a arg of type 'bytes'. To simplify the API, vaultlib.encrypt() now assumes input plaintext is a py2 unicode or py3 str. It will encode to utf-8 then call the new encrypt_bytestring(). The new methods are less ambiguous. - moved VaultLib.is_encrypted logic to vault module scope and split to is_encrypted() and is_encrypted_file(). Add a test/unit/mock/yaml_helper.py It has some helpers for testing parsing/yaml Integration tests added as roles test_vault and test_vault_embedded 2016-08-24 02:03:11 +02:00			`---`
			`- name: Assert that a embedded vault of a string with no newline works`
			`assert:`
			`that:`
			`- '"{{ vault_encrypted_one_line_var }}" == "Setec Astronomy"'`

			`- name: Assert that a multi line embedded vault works, including new line`
			`assert:`
			`that:`
			`- vault_encrypted_var == "Setec Astronomy\n"`

			`# TODO: add a expected fail here`
			`# - debug: var=vault_encrypted_one_line_var_with_embedded_template`