Can't re-encrypt de-encrypted vault

[mgvazquez]

Hi!
Before anything, great Job! Its an excellent plugin for my day-to-day job!

I'm using the plugins on IntelliJ IDEA UI-182.4505.22

I don't how re-encrypt a de-encrypted vault. The Option 'Encrypt' do nothing :(

[captainju]

Hello,
the actions are directly using the command ansible-vault
https://github.com/captainju/ansible-vault/blob/master/src/com/company/dontcare/AnsibleVaultAction.java#L66

For encrypting, it's using
ansible-vault encrypt --vault-password configured_password_file file_to_encrypt
Does that command work in a terminal?

Does the decryting action work?

[mgvazquez]

Hi!
Yes, as a workarround, I re-encrypt the vault via 'ansible-vault', and work fine.

The decryting action (from IntelliJ ContextMenu) work fine too.

[captainju]

I don't know why it doesn't work through intellij, I'll add an error event in case the command fails.

[captainju]

I've added a error log if the ansible command fails.
The new plugin version will be available after jetbrain approval in a few days.

[mgvazquez]

This is the log when I try to Re-encrypt de vault

10:07 AM	AnsibleVault Event Log: ansible-vault execution error, exit value: 5
10:07 AM	AnsibleVault Event Log: [ansible-vault, encrypt, --vault-password, /home/user/.ansible_vault, /home/user/ansible/recipes/project/group_vars/all/vault]
10:07 AM	AnsibleVault Event Log
					ERROR! The vault-ids default,default are available to encrypt. Specify the vault-id to encrypt with --encrypt-vault-id
					Usage: ansible-vault encrypt [options] file_name
					encryption/decryption utility for Ansible data files
					Options:
					--ask-vault-pass      ask for vault password
					--encrypt-vault-id=ENCRYPT_VAULT_ID
					the vault id used to encrypt (required if more than
					vault-id is provided)
					-h, --help            show this help message and exit
					--new-vault-id=NEW_VAULT_ID
					the new vault identity to use for rekey
					--new-vault-password-file=NEW_VAULT_PASSWORD_FILE
					new vault password file for rekey
					--output=OUTPUT_FILE  output file name for encrypt or decrypt; use - for
					stdout
					--vault-id=VAULT_IDS  the vault identity to use
					--vault-password-file=VAULT_PASSWORD_FILES
					vault password file
					-v, --verbose         verbose mode (-vvv for more, -vv... (show balloon)

Extra Info: My .ansible_vault is a symlink.

[mgvazquez]

Ohhh!, the parameter --vault-password don't exist in my Ansible version (2.7.2)
The parameter for the password file is --vault-password-file

But now, I don't know why the decrypt function works

[captainju]

Thx! Im using ansible 2.7.4
it looks like the preferred way to use a password file is using the --vault-id option.
https://docs.ansible.com/ansible/latest/user_guide/vault.html#providing-vault-passwords

Can you try it from cli to see if it works?
ansible-vault encrypt --vault-id /home/user/.ansible_vault /home/user/ansible/recipes/project/group_vars/all/vault

[mgvazquez]

No, ansible-vault encrypt --vault-id /home/user/.ansible_vault /home/user/ansible/recipes/project/group_vars/all/vault doesn't worked.

But It's works when I use with this parameters (in that order)(?):

ansible-vault --vault-id /home/user/.ansible_vault --encrypt-vault-id default encrypt /home/user/ansible/recipes/project/group_vars/all/vault

[captainju]

I think it's because of:
The vault-ids default,default are available to encrypt.

I don't know where those 2 vault-ids come from. Do you have any idea?

In the vault-crypter settings, instead of specifying a file I should probably let the user put whatever he wants in it.
One setting for encryption, and another one for decryption.
They will be added directly to the command line, like:
ansible-vault encrypt <encrypt_settings> file
ansible-vault decrypt <decrypt_settings> file

What do you think about it?

[mgvazquez]

Sorry for the delay.
I was looking up information about the Vault-ids, and I found this post about it.

You can put some form to get the Ansible vaults configuration (ansible.cfg) by default; and if these config aren't present; can put the vault-key instead.

[RonaldFindling]

The plugin also didn't encrypt files for me, I analysed it a bit.

Conclusion

• When vault_identity_list is specified in your ansible.cfg the --vault-id parameter of encrypt & decrypt seems to have no effect (vault_identity_list has precedence)
• When vault_identity_list is specified in your ansible.cfg the encryption step needs to know which id to use for encryption therefore the parameter --encrypt-vault-id=files is mandatory (providing an identifier defined in ansible.cfg)
• When vault_identity_list is specified in your ansible.cfg this doesn't influence decrypts behaviour (except the already mentioned precedence of vault_identity_list), it seems to just try all options so no additional decrypt parameter is required

Plugin Suggestions

• Add an optional vault-id for encryption to the settings (the value "default" seems to work regardless of vault_identity_list being defined or not)
• As the password file configured in the settings won't be used when vault_identity_list is defined in ansible either a note (if vault_identity_list is defined in your ansible.cfg it will overwrite this value here) or a validation would be helpful

Analysis

• General: --vault-id= expects a file location
• Encryption: a provided file location with --vault-id~/.ansible_inline_pass doesn't seem to be taken into account --> it's still complaining that multiple vault-ids are available ERROR! The vault-ids inline,files,default are available to encrypt. Specify the vault-id to encrypt with --encrypt-vault-id (obviously taken from the .ansible.cfg)
• Encryption: --encrypt-vault-id=inline without --vault-id works when having vault_identity_list specified in your ansible.cfg
• Decryption: doesn't need any identity parameters when vault_identity_list is specified in your ansible.cfg, otherwise --vault-id is mandatory

Used Versions

• Idea:

IntelliJ IDEA 2019.1.3 (Ultimate Edition)
Build #IU-191.7479.19, built on May 28, 2019
Licensed to Smarter Ecommerce GmbH / Ronald Findling
Subscription is active until November 19, 2019
JRE: 1.8.0_202-release-1483-b58 x86_64
JVM: OpenJDK 64-Bit Server VM by JetBrains s.r.o
macOS 10.14.5

• Ansible:

ansible 2.8.1
python version = 3.7.3

Observed Errors With the Plugin

Idea Error

[ansible-vault, encrypt, --vault-password, /my/path/ansible-vault-pwd.vault_pass, /my/path/to_encrypt.yaml]

The error when executing the command on the cmd

ERROR! The vault-ids inline,files,default are available to encrypt. Specify the vault-id to encrypt with --encrypt-vault-id

The encryption works with the command proposed by @mgvazquez

ansible-vault --vault-id=~/.ansible_inline_pass  --encrypt-vault-id default encrypt file_to_encrypt.yaml

My minimal ~/.ansible.cfg

[defaults]
vault_identity_list = inline@~/.ansible_inline_pass , files@~/.ansible_files_pass

[captainju]

Hello @RonaldFindling, thanks for your very detailed analyse!
I don't really have time right now to handle this.

As I said earlier, I think the easiest solution would be to take all the parameters as an option, instead of only the password file.

Then we'll use these simple commands:
ansible-vault encrypt <encrypt_settings> file
ansible-vault decrypt <decrypt_settings> file

Feel free to clone and make the changes you want!