CCCHH/ansible-infra
CCCHH/ansible-infra
2
2
Fork 2
Code Issues 7 Pull requests 4 Wiki Activity Actions

Vendor Galaxy Roles and Collections
Some checks failed
/ Ansible Lint (push) Failing after 5m45s
Details
/ Ansible Lint (pull_request) Failing after 4m59s
Details

Browse source
This commit is contained in:
Stefan Bethke 2026-02-06 22:07:16 +01:00
commit 2aed20393f
3553 changed files with 387444 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
ansible_collections/community/sops/.git-blame-ignore-revs Normal file
View file

@ -0,0 +1,6 @@
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# Reformat YAML: https://github.com/ansible-collections/community.sops/pull/238
67ed0dacb3b0457ee641337b33b6608a927ce885

15
ansible_collections/community/sops/.github/dependabot.yml vendored Normal file
View file

@ -0,0 +1,15 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
groups:
ci:
patterns:
- "*"

9
ansible_collections/community/sops/.github/patchback.yml vendored Normal file
View file

@ -0,0 +1,9 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
backport_branch_prefix: patchback/backports/
backport_label_prefix: backport-
target_branch_prefix: stable-
...

8
ansible_collections/community/sops/.github/pull_request_template.md vendored Normal file
View file

@ -0,0 +1,8 @@
### Motivation
<!-- describe why this changes are necessary/useful -->
### Changes description
<!-- describe what changes are in this PR. Overview is OK, details shall be found in the git commits -->
### Additional notes
<!-- any note related to these changes, please add them here -->

3
ansible_collections/community/sops/.github/pull_request_template.md.license vendored Normal file
View file

@ -0,0 +1,3 @@
GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
SPDX-License-Identifier: GPL-3.0-or-later
SPDX-FileCopyrightText: Ansible Project

95
ansible_collections/community/sops/.github/workflows/docs-pr.yml vendored Normal file
View file

@ -0,0 +1,95 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
name: Collection Docs
concurrency:
group: docs-pr-${{ github.head_ref }}
cancel-in-progress: true
'on':
pull_request_target:
types: [opened, synchronize, reopened, closed]
env:
GHP_BASE_URL: https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}
jobs:
build-docs:
permissions:
contents: read
name: Build Ansible Docs
uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-pr.yml@main
with:
collection-name: community.sops
init-lenient: false
init-fail-on-error: true
squash-hierarchy: true
init-project: Community.Sops Collection
init-copyright: Community.Sops Contributors
init-title: Community.Sops Collection Documentation
init-html-short-title: Community.Sops Collection Docs
init-extra-html-theme-options: |
documentation_home_url=https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}/branch/main/
render-file-line: '> * `$<status>` [$<path_tail>](https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}/pr/${{ github.event.number }}/$<path_tail>)'
publish-docs-gh-pages:
# for now we won't run this on forks
if: github.repository == 'ansible-collections/community.sops'
permissions:
contents: write
pages: write
id-token: write
needs: [build-docs]
name: Publish Ansible Docs
uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-publish-gh-pages.yml@main
with:
artifact-name: ${{ needs.build-docs.outputs.artifact-name }}
action: ${{ (github.event.action == 'closed' || needs.build-docs.outputs.changed != 'true') && 'teardown' || 'publish' }}
publish-gh-pages-branch: true
secrets:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
comment:
permissions:
pull-requests: write
runs-on: ubuntu-latest
needs: [build-docs, publish-docs-gh-pages]
name: PR comments
steps:
- name: PR comment
uses: ansible-community/github-docs-build/actions/ansible-docs-build-comment@main
with:
body-includes: '## Docs Build'
reactions: heart
action: ${{ needs.build-docs.outputs.changed != 'true' && 'remove' || '' }}
on-closed-body: |
## Docs Build 📝
This PR is closed and any previously published docsite has been unpublished.
on-merged-body: |
## Docs Build 📝
Thank you for contribution!✨
This PR has been merged and the docs are now incorporated into `main`:
${{ env.GHP_BASE_URL }}/branch/main
body: |
## Docs Build 📝
Thank you for contribution!✨
The docs for **this PR** have been published here:
${{ env.GHP_BASE_URL }}/pr/${{ github.event.number }}
You can compare to the docs for the `main` branch here:
${{ env.GHP_BASE_URL }}/branch/main
The docsite for **this PR** is also available for download as an artifact from this run:
${{ needs.build-docs.outputs.artifact-url }}
File changes:
${{ needs.build-docs.outputs.diff-files-rendered }}
${{ needs.build-docs.outputs.diff-rendered }}

55
ansible_collections/community/sops/.github/workflows/docs-push.yml vendored Normal file
View file

@ -0,0 +1,55 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
name: Collection Docs
concurrency:
group: docs-push-${{ github.sha }}
cancel-in-progress: true
'on':
push:
branches:
- main
- stable-*
tags:
- '*'
# Run CI once per day (at 05:30 UTC)
schedule:
- cron: '30 5 * * *'
# Allow manual trigger (for newer antsibull-docs, sphinx-ansible-theme, ... versions)
workflow_dispatch:
jobs:
build-docs:
permissions:
contents: read
name: Build Ansible Docs
uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-push.yml@main
with:
collection-name: community.sops
init-lenient: false
init-fail-on-error: true
squash-hierarchy: true
init-project: Community.Sops Collection
init-copyright: Community.Sops Contributors
init-title: Community.Sops Collection Documentation
init-html-short-title: Community.Sops Collection Docs
init-extra-html-theme-options: |
documentation_home_url=https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}/branch/main/
publish-docs-gh-pages:
# for now we won't run this on forks
if: github.repository == 'ansible-collections/community.sops'
permissions:
contents: write
pages: write
id-token: write
needs: [build-docs]
name: Publish Ansible Docs
uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-publish-gh-pages.yml@main
with:
artifact-name: ${{ needs.build-docs.outputs.artifact-name }}
publish-gh-pages-branch: true
secrets:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

35
ansible_collections/community/sops/.github/workflows/nox.yml vendored Normal file
View file

@ -0,0 +1,35 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
name: nox
'on':
push:
branches:
- main
- stable-*
pull_request:
# Run CI once per day (at 05:30 UTC)
schedule:
- cron: '30 5 * * *'
workflow_dispatch:
jobs:
nox:
runs-on: ubuntu-latest
name: "Run extra sanity tests"
steps:
- name: Check out collection
uses: actions/checkout@v5
with:
persist-credentials: false
- name: Run nox
uses: ansible-community/antsibull-nox@main
ansible-test:
uses: ansible-community/antsibull-nox/.github/workflows/reusable-nox-matrix.yml@main
with:
upload-codecov: true
secrets:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

137
ansible_collections/community/sops/.gitignore vendored Normal file
View file

@ -0,0 +1,137 @@
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
/tests/output/
/changelogs/.plugin-cache.yaml
/tests/integration/inventory
# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class
# C extensions
*.so
# Distribution / packaging
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib/
lib64/
parts/
sdist/
var/
wheels/
pip-wheel-metadata/
share/python-wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST
# PyInstaller
# Usually these files are written by a python script from a template
# before PyInstaller builds the exe, so as to inject date/other infos into it.
*.manifest
*.spec
# Installer logs
pip-log.txt
pip-delete-this-directory.txt
# Unit test / coverage reports
htmlcov/
.tox/
.nox/
.coverage
.coverage.*
.cache
nosetests.xml
coverage.xml
*.cover
*.py,cover
.hypothesis/
.pytest_cache/
# Translations
*.mo
*.pot
# Django stuff:
*.log
local_settings.py
db.sqlite3
db.sqlite3-journal
# Flask stuff:
instance/
.webassets-cache
# Scrapy stuff:
.scrapy
# Sphinx documentation
docs/_build/
# PyBuilder
target/
# Jupyter Notebook
.ipynb_checkpoints
# IPython
profile_default/
ipython_config.py
# pyenv
.python-version
# pipenv
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
# However, in case of collaboration, if having platform-specific dependencies or dependencies
# having no cross-platform support, pipenv may install dependencies that don't work, or not
# install all needed dependencies.
#Pipfile.lock
# PEP 582; used by e.g. github.com/David-OConnor/pyflow
__pypackages__/
# Celery stuff
celerybeat-schedule
celerybeat.pid
# SageMath parsed files
*.sage.py
# Environments
.env
.venv
env/
venv/
ENV/
env.bak/
venv.bak/
# Spyder project settings
.spyderproject
.spyproject
# Rope project settings
.ropeproject
# mkdocs documentation
/site
# mypy
.mypy_cache/
.dmypy.json
dmypy.json
# Pyre type checker
.pyre/

59
ansible_collections/community/sops/.yamllint Normal file
View file

@ -0,0 +1,59 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2025 Felix Fontein <felix@fontein.de>
extends: default
ignore: |
/changelogs/
*.sops.yaml
*.sops.yml
**/files/*.yaml
**/files/*.yml
/tests/integration/targets/vars_sops/test-extensions/group_vars/all.yml
/tests/integration/targets/vars_sops/test-extensions/group_vars/all/test.yml
rules:
line-length:
max: 300
level: error
document-start:
present: true
document-end: false
truthy:
level: error
allowed-values:
- 'true'
- 'false'
indentation:
spaces: 2
indent-sequences: true
key-duplicates: enable
trailing-spaces: enable
new-line-at-end-of-file: disable
hyphens:
max-spaces-after: 1
empty-lines:
max: 2
max-start: 0
max-end: 0
commas:
max-spaces-before: 0
min-spaces-after: 1
max-spaces-after: 1
colons:
max-spaces-before: 0
max-spaces-after: 1
brackets:
min-spaces-inside: 0
max-spaces-inside: 0
braces:
min-spaces-inside: 0
max-spaces-inside: 1
octal-values:
forbid-implicit-octal: true
forbid-explicit-octal: true
comments:
min-spaces-from-content: 1
comments-indentation: false

54
ansible_collections/community/sops/.yamllint-docs Normal file
View file

@ -0,0 +1,54 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2025 Felix Fontein <felix@fontein.de>
extends: default
ignore: |
/changelogs/
rules:
line-length:
max: 160
level: error
document-start:
present: false
document-end:
present: false
truthy:
level: error
allowed-values:
- 'true'
- 'false'
indentation:
spaces: 2
indent-sequences: true
key-duplicates: enable
trailing-spaces: enable
new-line-at-end-of-file: disable
hyphens:
max-spaces-after: 1
empty-lines:
max: 2
max-start: 0
max-end: 0
commas:
max-spaces-before: 0
min-spaces-after: 1
max-spaces-after: 1
colons:
max-spaces-before: 0
max-spaces-after: 1
brackets:
min-spaces-inside: 0
max-spaces-inside: 0
braces:
min-spaces-inside: 0
max-spaces-inside: 1
octal-values:
forbid-implicit-octal: true
forbid-explicit-octal: true
comments:
min-spaces-from-content: 1
comments-indentation: false

54
ansible_collections/community/sops/.yamllint-examples Normal file
View file

@ -0,0 +1,54 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2025 Felix Fontein <felix@fontein.de>
extends: default
ignore: |
/changelogs/
rules:
line-length:
max: 160
level: error
document-start:
present: true
document-end:
present: false
truthy:
level: error
allowed-values:
- 'true'
- 'false'
indentation:
spaces: 2
indent-sequences: true
key-duplicates: enable
trailing-spaces: enable
new-line-at-end-of-file: disable
hyphens:
max-spaces-after: 1
empty-lines:
max: 2
max-start: 0
max-end: 0
commas:
max-spaces-before: 0
min-spaces-after: 1
max-spaces-after: 1
colons:
max-spaces-before: 0
max-spaces-after: 1
brackets:
min-spaces-inside: 0
max-spaces-inside: 0
braces:
min-spaces-inside: 0
max-spaces-inside: 1
octal-values:
forbid-implicit-octal: true
forbid-explicit-octal: true
comments:
min-spaces-from-content: 1
comments-indentation: false

50
ansible_collections/community/sops/.yamllint-extra-docs Normal file
View file

@ -0,0 +1,50 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2025 Felix Fontein <felix@fontein.de>
extends: default
ignore: |
/changelogs/
rules:
line-length: disable # needed for SOPS files
document-start: disable
document-end:
present: false
truthy:
level: error
allowed-values:
- 'true'
- 'false'
indentation:
spaces: consistent # needed for SOPS files
indent-sequences: true
key-duplicates: enable
trailing-spaces: enable
new-line-at-end-of-file: disable
hyphens:
max-spaces-after: 1
empty-lines:
max: 2
max-start: 0
max-end: 0
commas:
max-spaces-before: 0
min-spaces-after: 1
max-spaces-after: 1
colons:
max-spaces-before: 0
max-spaces-after: 1
brackets:
min-spaces-inside: 0
max-spaces-inside: 0
braces:
min-spaces-inside: 0
max-spaces-inside: 1
octal-values:
forbid-implicit-octal: true
forbid-explicit-octal: true
comments: disable # needed for SOPS files
comments-indentation: false

813
ansible_collections/community/sops/CHANGELOG.md Normal file
View file

@ -0,0 +1,813 @@
# Community SOPS Release Notes
**Topics**
- <a href="#v2-2-7">v2\.2\.7</a>
- <a href="#release-summary">Release Summary</a>
- <a href="#known-issues">Known Issues</a>
- <a href="#v2-2-6">v2\.2\.6</a>
- <a href="#release-summary-1">Release Summary</a>
- <a href="#bugfixes">Bugfixes</a>
- <a href="#v2-2-5">v2\.2\.5</a>
- <a href="#release-summary-2">Release Summary</a>
- <a href="#bugfixes-1">Bugfixes</a>
- <a href="#v2-2-4">v2\.2\.4</a>
- <a href="#release-summary-3">Release Summary</a>
- <a href="#bugfixes-2">Bugfixes</a>
- <a href="#v2-2-3">v2\.2\.3</a>
- <a href="#release-summary-4">Release Summary</a>
- <a href="#minor-changes">Minor Changes</a>
- <a href="#bugfixes-3">Bugfixes</a>
- <a href="#v2-2-2">v2\.2\.2</a>
- <a href="#release-summary-5">Release Summary</a>
- <a href="#bugfixes-4">Bugfixes</a>
- <a href="#v2-2-1">v2\.2\.1</a>
- <a href="#release-summary-6">Release Summary</a>
- <a href="#bugfixes-5">Bugfixes</a>
- <a href="#v2-2-0">v2\.2\.0</a>
- <a href="#release-summary-7">Release Summary</a>
- <a href="#minor-changes-1">Minor Changes</a>
- <a href="#v2-1-0">v2\.1\.0</a>
- <a href="#release-summary-8">Release Summary</a>
- <a href="#minor-changes-2">Minor Changes</a>
- <a href="#v2-0-5">v2\.0\.5</a>
- <a href="#release-summary-9">Release Summary</a>
- <a href="#v2-0-4">v2\.0\.4</a>
- <a href="#release-summary-10">Release Summary</a>
- <a href="#bugfixes-6">Bugfixes</a>
- <a href="#v2-0-3">v2\.0\.3</a>
- <a href="#release-summary-11">Release Summary</a>
- <a href="#bugfixes-7">Bugfixes</a>
- <a href="#v2-0-2">v2\.0\.2</a>
- <a href="#release-summary-12">Release Summary</a>
- <a href="#bugfixes-8">Bugfixes</a>
- <a href="#v2-0-1">v2\.0\.1</a>
- <a href="#release-summary-13">Release Summary</a>
- <a href="#v2-0-0">v2\.0\.0</a>
- <a href="#release-summary-14">Release Summary</a>
- <a href="#removed-features-previously-deprecated">Removed Features \(previously deprecated\)</a>
- <a href="#v1-9-1">v1\.9\.1</a>
- <a href="#release-summary-15">Release Summary</a>
- <a href="#bugfixes-9">Bugfixes</a>
- <a href="#v1-9-0">v1\.9\.0</a>
- <a href="#release-summary-16">Release Summary</a>
- <a href="#minor-changes-3">Minor Changes</a>
- <a href="#v1-8-2">v1\.8\.2</a>
- <a href="#release-summary-17">Release Summary</a>
- <a href="#deprecated-features">Deprecated Features</a>
- <a href="#v1-8-1">v1\.8\.1</a>
- <a href="#release-summary-18">Release Summary</a>
- <a href="#bugfixes-10">Bugfixes</a>
- <a href="#v1-8-0">v1\.8\.0</a>
- <a href="#release-summary-19">Release Summary</a>
- <a href="#minor-changes-4">Minor Changes</a>
- <a href="#bugfixes-11">Bugfixes</a>
- <a href="#v1-7-0">v1\.7\.0</a>
- <a href="#release-summary-20">Release Summary</a>
- <a href="#minor-changes-5">Minor Changes</a>
- <a href="#bugfixes-12">Bugfixes</a>
- <a href="#v1-6-7">v1\.6\.7</a>
- <a href="#release-summary-21">Release Summary</a>
- <a href="#bugfixes-13">Bugfixes</a>
- <a href="#v1-6-6">v1\.6\.6</a>
- <a href="#release-summary-22">Release Summary</a>
- <a href="#bugfixes-14">Bugfixes</a>
- <a href="#v1-6-5">v1\.6\.5</a>
- <a href="#release-summary-23">Release Summary</a>
- <a href="#bugfixes-15">Bugfixes</a>
- <a href="#v1-6-4">v1\.6\.4</a>
- <a href="#release-summary-24">Release Summary</a>
- <a href="#bugfixes-16">Bugfixes</a>
- <a href="#v1-6-3">v1\.6\.3</a>
- <a href="#release-summary-25">Release Summary</a>
- <a href="#known-issues-1">Known Issues</a>
- <a href="#v1-6-2">v1\.6\.2</a>
- <a href="#release-summary-26">Release Summary</a>
- <a href="#bugfixes-17">Bugfixes</a>
- <a href="#v1-6-1">v1\.6\.1</a>
- <a href="#release-summary-27">Release Summary</a>
- <a href="#bugfixes-18">Bugfixes</a>
- <a href="#v1-6-0">v1\.6\.0</a>
- <a href="#release-summary-28">Release Summary</a>
- <a href="#minor-changes-6">Minor Changes</a>
- <a href="#v1-5-0">v1\.5\.0</a>
- <a href="#release-summary-29">Release Summary</a>
- <a href="#minor-changes-7">Minor Changes</a>
- <a href="#new-playbooks">New Playbooks</a>
- <a href="#new-roles">New Roles</a>
- <a href="#v1-4-1">v1\.4\.1</a>
- <a href="#release-summary-30">Release Summary</a>
- <a href="#bugfixes-19">Bugfixes</a>
- <a href="#v1-4-0">v1\.4\.0</a>
- <a href="#release-summary-31">Release Summary</a>
- <a href="#minor-changes-8">Minor Changes</a>
- <a href="#v1-3-0">v1\.3\.0</a>
- <a href="#release-summary-32">Release Summary</a>
- <a href="#minor-changes-9">Minor Changes</a>
- <a href="#v1-2-3">v1\.2\.3</a>
- <a href="#release-summary-33">Release Summary</a>
- <a href="#v1-2-2">v1\.2\.2</a>
- <a href="#release-summary-34">Release Summary</a>
- <a href="#bugfixes-20">Bugfixes</a>
- <a href="#v1-2-1">v1\.2\.1</a>
- <a href="#release-summary-35">Release Summary</a>
- <a href="#v1-2-0">v1\.2\.0</a>
- <a href="#release-summary-36">Release Summary</a>
- <a href="#minor-changes-10">Minor Changes</a>
- <a href="#bugfixes-21">Bugfixes</a>
- <a href="#v1-1-0">v1\.1\.0</a>
- <a href="#release-summary-37">Release Summary</a>
- <a href="#minor-changes-11">Minor Changes</a>
- <a href="#new-plugins">New Plugins</a>
- <a href="#filter">Filter</a>
- <a href="#v1-0-6">v1\.0\.6</a>
- <a href="#release-summary-38">Release Summary</a>
- <a href="#bugfixes-22">Bugfixes</a>
- <a href="#v1-0-5">v1\.0\.5</a>
- <a href="#release-summary-39">Release Summary</a>
- <a href="#bugfixes-23">Bugfixes</a>
- <a href="#v1-0-4">v1\.0\.4</a>
- <a href="#release-summary-40">Release Summary</a>
- <a href="#security-fixes">Security Fixes</a>
- <a href="#v1-0-3">v1\.0\.3</a>
- <a href="#release-summary-41">Release Summary</a>
- <a href="#bugfixes-24">Bugfixes</a>
- <a href="#v1-0-2">v1\.0\.2</a>
- <a href="#release-summary-42">Release Summary</a>
- <a href="#v1-0-1">v1\.0\.1</a>
- <a href="#release-summary-43">Release Summary</a>
- <a href="#v1-0-0">v1\.0\.0</a>
- <a href="#release-summary-44">Release Summary</a>
- <a href="#minor-changes-12">Minor Changes</a>
- <a href="#v0-2-0">v0\.2\.0</a>
- <a href="#release-summary-45">Release Summary</a>
- <a href="#minor-changes-13">Minor Changes</a>
- <a href="#v0-1-0">v0\.1\.0</a>
- <a href="#release-summary-46">Release Summary</a>
- <a href="#new-plugins-1">New Plugins</a>
- <a href="#lookup">Lookup</a>
- <a href="#vars">Vars</a>
- <a href="#new-modules">New Modules</a>
<a id="v2-2-7"></a>
## v2\.2\.7
<a id="release-summary"></a>
### Release Summary
Maintenance release\.
<a id="known-issues"></a>
### Known Issues
* When using the <code>community\.sops\.load\_vars</code> with ansible\-core 2\.20\, note that the deprecation of <code>INJECT\_FACTS\_AS\_VARS</code> causes deprecation warnings to be shown every time a variable loaded with <code>community\.sops\.load\_vars</code> is used\. This is due to ansible\-core deprecating <code>INJECT\_FACTS\_AS\_VARS</code> without providing an alternative for modules like <code>community\.sops\.load\_vars</code> to use\. If you do not like these deprecation warnings\, you have to explicitly set <code>INJECT\_FACTS\_AS\_VARS</code> to <code>true</code>\. <strong>DO NOT</strong> change the use of SOPS encrypted variables to <code>ansible\_facts</code>\. The situation will hopefully improve in ansible\-core 2\.21 through the promised API that allows action plugins to set variables\; community\.sops will adapt to use it\, which will make the warning go away\. \(The API was originally promised for ansible\-core 2\.20\, but then delayed\.\)
<a id="v2-2-6"></a>
## v2\.2\.6
<a id="release-summary-1"></a>
### Release Summary
Bugfix and maintenance release\.
<a id="bugfixes"></a>
### Bugfixes
* Clean up plugin code that does not run on the target \([https\://github\.com/ansible\-collections/community\.sops/pull/275](https\://github\.com/ansible\-collections/community\.sops/pull/275)\)\.
* Note that the MIT licenced code in <code>plugins/module\_utils/\_six\.py</code> has been removed \([https\://github\.com/ansible\-collections/community\.sops/pull/275](https\://github\.com/ansible\-collections/community\.sops/pull/275)\)\.
* sops vars plugin \- ensure that loaded vars are evaluated also with ansible\-core 2\.19\+ \([https\://github\.com/ansible\-collections/community\.sops/pull/273](https\://github\.com/ansible\-collections/community\.sops/pull/273)\)\.
<a id="v2-2-5"></a>
## v2\.2\.5
<a id="release-summary-2"></a>
### Release Summary
Maintenance release\.
<a id="bugfixes-1"></a>
### Bugfixes
* load\_vars action \- avoid another deprecated module utils from ansible\-core \([https\://github\.com/ansible\-collections/community\.sops/pull/270](https\://github\.com/ansible\-collections/community\.sops/pull/270)\)\.
* load\_vars action \- avoid deprecated import from ansible\-core that will be removed in ansible\-core 2\.21 \([https\://github\.com/ansible\-collections/community\.sops/pull/272](https\://github\.com/ansible\-collections/community\.sops/pull/272)\)\.
<a id="v2-2-4"></a>
## v2\.2\.4
<a id="release-summary-3"></a>
### Release Summary
Maintenance release\.
<a id="bugfixes-2"></a>
### Bugfixes
* Fix accidental type extensions \([https\://github\.com/ansible\-collections/community\.sops/pull/269](https\://github\.com/ansible\-collections/community\.sops/pull/269)\)\.
<a id="v2-2-3"></a>
## v2\.2\.3
<a id="release-summary-4"></a>
### Release Summary
Maintenance release\.
<a id="minor-changes"></a>
### Minor Changes
* Note that some new code in <code>plugins/module\_utils/\_six\.py</code> is MIT licensed \([https\://github\.com/ansible\-collections/community\.sops/pull/268](https\://github\.com/ansible\-collections/community\.sops/pull/268)\)\.
<a id="bugfixes-3"></a>
### Bugfixes
* Avoid using <code>ansible\.module\_utils\.six</code> to avoid deprecation warnings with ansible\-core 2\.20 \([https\://github\.com/ansible\-collections/community\.sops/pull/268](https\://github\.com/ansible\-collections/community\.sops/pull/268)\)\.
<a id="v2-2-2"></a>
## v2\.2\.2
<a id="release-summary-5"></a>
### Release Summary
Bugfix release\.
<a id="bugfixes-4"></a>
### Bugfixes
* Avoid deprecated functionality in ansible\-core 2\.20 \([https\://github\.com/ansible\-collections/community\.sops/pull/260](https\://github\.com/ansible\-collections/community\.sops/pull/260)\)\.
* all modules and plugins \- the default of <code>enable\_local\_keyservice</code> changed from <code>false</code> to <code>true</code>\, and explicitly setting it to <code>false</code> now passes <code>\-\-enable\-local\-keyservice\=false</code>\. SOPS\' default has always been <code>true</code>\, and when setting this option to <code>true</code> so far it resulted in passing <code>\-\-enable\-local\-keyservice</code>\, which is equivalent to <code>\-\-enable\-local\-keyservice\=true</code> and had no effect\. This means that from now on\, setting <code>enable\_local\_keyservice</code> explicitly to <code>false</code> has an effect\. If <code>enable\_local\_keyservice</code> was not set before\, or was set to <code>true</code>\, nothing will change \([https\://github\.com/ansible\-collections/community\.sops/issues/261](https\://github\.com/ansible\-collections/community\.sops/issues/261)\, [https\://github\.com/ansible\-collections/community\.sops/pull/262](https\://github\.com/ansible\-collections/community\.sops/pull/262)\)\.
<a id="v2-2-1"></a>
## v2\.2\.1
<a id="release-summary-6"></a>
### Release Summary
Bugfix release\.
<a id="bugfixes-5"></a>
### Bugfixes
* install role \- avoid deprecated parameter value for the <code>ansible\.builtin\.uri</code> module \([https\://github\.com/ansible\-collections/community\.sops/pull/255](https\://github\.com/ansible\-collections/community\.sops/pull/255)\)\.
<a id="v2-2-0"></a>
## v2\.2\.0
<a id="release-summary-7"></a>
### Release Summary
Feature release\.
<a id="minor-changes-1"></a>
### Minor Changes
* load\_vars \- expressions can now be lazily evaluated when using ansible\-core 2\.19 or newer \([https\://github\.com/ansible\-collections/community\.sops/pull/229](https\://github\.com/ansible\-collections/community\.sops/pull/229)\)\.
<a id="v2-1-0"></a>
## v2\.1\.0
<a id="release-summary-8"></a>
### Release Summary
Feature release\.
<a id="minor-changes-2"></a>
### Minor Changes
* Now supports specifying SSH private keys for age with the new <code>age\_ssh\_private\_keyfile</code> option \([https\://github\.com/ansible\-collections/community\.sops/pull/241](https\://github\.com/ansible\-collections/community\.sops/pull/241)\)\.
<a id="v2-0-5"></a>
## v2\.0\.5
<a id="release-summary-9"></a>
### Release Summary
Maintenance release with updated SOPS version test coverage\.
<a id="v2-0-4"></a>
## v2\.0\.4
<a id="release-summary-10"></a>
### Release Summary
Maintenance release with Data Tagging support\.
<a id="bugfixes-6"></a>
### Bugfixes
* load\_vars \- make evaluation compatible with Data Tagging in upcoming ansible\-core release \([https\://github\.com/ansible\-collections/community\.sops/pull/225](https\://github\.com/ansible\-collections/community\.sops/pull/225)\)\.
<a id="v2-0-3"></a>
## v2\.0\.3
<a id="release-summary-11"></a>
### Release Summary
Bugfix release\.
<a id="bugfixes-7"></a>
### Bugfixes
* install role \- <code>sops\_install\_on\_localhost\=false</code> was not working properly if the role was running on more than one host due to a bug in ansible\-core \([https\://github\.com/ansible\-collections/community\.sops/issues/223](https\://github\.com/ansible\-collections/community\.sops/issues/223)\, [https\://github\.com/ansible\-collections/community\.sops/pull/224](https\://github\.com/ansible\-collections/community\.sops/pull/224)\)\.
<a id="v2-0-2"></a>
## v2\.0\.2
<a id="release-summary-12"></a>
### Release Summary
Bugfix release\.
<a id="bugfixes-8"></a>
### Bugfixes
* install role \- when used with Debian on ARM architecture\, the architecture name is now correctly translated from <code>aarch64</code> to <code>arm64</code> \([https\://github\.com/ansible\-collections/community\.sops/issues/220](https\://github\.com/ansible\-collections/community\.sops/issues/220)\, [https\://github\.com/ansible\-collections/community\.sops/pull/221](https\://github\.com/ansible\-collections/community\.sops/pull/221)\)\.
<a id="v2-0-1"></a>
## v2\.0\.1
<a id="release-summary-13"></a>
### Release Summary
Maintenance release with updated documentation\.
<a id="v2-0-0"></a>
## v2\.0\.0
<a id="release-summary-14"></a>
### Release Summary
Major verison that drops support for End of Life Ansible/ansible\-base/ansible\-core versions\.
<a id="removed-features-previously-deprecated"></a>
### Removed Features \(previously deprecated\)
* The collection no longer supports Ansible 2\.9\, ansible\-base 2\.10\, ansible\-core 2\.11\, ansible\-core 2\.12\, ansible\-core 2\.13\, and ansible\-core 2\.14\. If you need to continue using End of Life versions of Ansible/ansible\-base/ansible\-core\, please use community\.sops 1\.x\.y \([https\://github\.com/ansible\-collections/community\.sops/pull/206](https\://github\.com/ansible\-collections/community\.sops/pull/206)\)\.
<a id="v1-9-1"></a>
## v1\.9\.1
<a id="release-summary-15"></a>
### Release Summary
Bugfix release\.
<a id="bugfixes-9"></a>
### Bugfixes
* sops\_encrypt \- pass absolute paths to <code>module\.atomic\_move\(\)</code> \([https\://github\.com/ansible/ansible/issues/83950](https\://github\.com/ansible/ansible/issues/83950)\, [https\://github\.com/ansible\-collections/community\.sops/pull/208](https\://github\.com/ansible\-collections/community\.sops/pull/208)\)\.
<a id="v1-9-0"></a>
## v1\.9\.0
<a id="release-summary-16"></a>
### Release Summary
Feature release\.
<a id="minor-changes-3"></a>
### Minor Changes
* decrypt filter plugin \- now supports the input and output type <code>ini</code> \([https\://github\.com/ansible\-collections/community\.sops/pull/204](https\://github\.com/ansible\-collections/community\.sops/pull/204)\)\.
* sops lookup plugin \- new option <code>extract</code> allows extracting a single key out of a JSON or YAML file\, equivalent to sops\' <code>decrypt \-\-extract</code> \([https\://github\.com/ansible\-collections/community\.sops/pull/200](https\://github\.com/ansible\-collections/community\.sops/pull/200)\)\.
* sops lookup plugin \- now supports the input and output type <code>ini</code> \([https\://github\.com/ansible\-collections/community\.sops/pull/204](https\://github\.com/ansible\-collections/community\.sops/pull/204)\)\.
<a id="v1-8-2"></a>
## v1\.8\.2
<a id="release-summary-17"></a>
### Release Summary
Maintenance release with updated documentation and changelog\.
<a id="deprecated-features"></a>
### Deprecated Features
* The collection deprecates support for all Ansible/ansible\-base/ansible\-core versions that are currently End of Life\, [according to the ansible\-core support matrix](https\://docs\.ansible\.com/ansible\-core/devel/reference\_appendices/release\_and\_maintenance\.html\#ansible\-core\-support\-matrix)\. This means that the next major release of the collection will no longer support Ansible 2\.9\, ansible\-base 2\.10\, ansible\-core 2\.11\, ansible\-core 2\.12\, ansible\-core 2\.13\, and ansible\-core 2\.14\.
<a id="v1-8-1"></a>
## v1\.8\.1
<a id="release-summary-18"></a>
### Release Summary
Bugfix release\.
<a id="bugfixes-10"></a>
### Bugfixes
* Pass <code>config\_path</code> on SOPS 3\.9\.0 before the subcommand instead of after it \([https\://github\.com/ansible\-collections/community\.sops/issues/195](https\://github\.com/ansible\-collections/community\.sops/issues/195)\, [https\://github\.com/ansible\-collections/community\.sops/pull/197](https\://github\.com/ansible\-collections/community\.sops/pull/197)\)\.
<a id="v1-8-0"></a>
## v1\.8\.0
<a id="release-summary-19"></a>
### Release Summary
Feature release for supporting improvements coming with SOPS 3\.9\.0\.
<a id="minor-changes-4"></a>
### Minor Changes
* Detect SOPS 3\.9\.0 and use new <code>decrypt</code> and <code>encrypt</code> subcommands \([https\://github\.com/ansible\-collections/community\.sops/pull/190](https\://github\.com/ansible\-collections/community\.sops/pull/190)\)\.
* sops vars plugin \- new option <code>handle\_unencrypted\_files</code> allows to control behavior when encountering unencrypted files with SOPS 3\.9\.0\+ \([https\://github\.com/ansible\-collections/community\.sops/pull/190](https\://github\.com/ansible\-collections/community\.sops/pull/190)\)\.
<a id="bugfixes-11"></a>
### Bugfixes
* sops\_encrypt \- properly support <code>path\_regex</code> in <code>\.sops\.yaml</code> when SOPS 3\.9\.0 or later is used \([https\://github\.com/ansible\-collections/community\.sops/issues/153](https\://github\.com/ansible\-collections/community\.sops/issues/153)\, [https\://github\.com/ansible\-collections/community\.sops/pull/190](https\://github\.com/ansible\-collections/community\.sops/pull/190)\)\.
<a id="v1-7-0"></a>
## v1\.7\.0
<a id="release-summary-20"></a>
### Release Summary
Bugfix and feature release to fix installation issues with SOPS 3\.9\.0\.
<a id="minor-changes-5"></a>
### Minor Changes
* sops vars plugin \- allow to configure the valid extensions with an <code>ansible\.cfg</code> entry or with an environment variable \([https\://github\.com/ansible\-collections/community\.sops/pull/185](https\://github\.com/ansible\-collections/community\.sops/pull/185)\)\.
<a id="bugfixes-12"></a>
### Bugfixes
* Fix RPM URL for the 3\.9\.0 release \([https\://github\.com/ansible\-collections/community\.sops/pull/188](https\://github\.com/ansible\-collections/community\.sops/pull/188)\)\.
<a id="v1-6-7"></a>
## v1\.6\.7
<a id="release-summary-21"></a>
### Release Summary
Bugfix release\.
<a id="bugfixes-13"></a>
### Bugfixes
* sops\_encrypt \- ensure that output\-type is set to <code>yaml</code> when the file extension <code>\.yml</code> is used\. Now both <code>\.yaml</code> and <code>\.yml</code> files use the SOPS <code>\-\-output\-type\=yaml</code> formatting \([https\://github\.com/ansible\-collections/community\.sops/issues/164](https\://github\.com/ansible\-collections/community\.sops/issues/164)\)\.
<a id="v1-6-6"></a>
## v1\.6\.6
<a id="release-summary-22"></a>
### Release Summary
Make fully compatible with and test against sops 3\.8\.0\.
<a id="bugfixes-14"></a>
### Bugfixes
* Fix RPM URL for the 3\.8\.0 release \([https\://github\.com/ansible\-collections/community\.sops/pull/161](https\://github\.com/ansible\-collections/community\.sops/pull/161)\)\.
<a id="v1-6-5"></a>
## v1\.6\.5
<a id="release-summary-23"></a>
### Release Summary
Make compatible with and test against sops 3\.8\.0\-rc\.1\.
<a id="bugfixes-15"></a>
### Bugfixes
* Avoid pre\-releases when picking the latest version when using the GitHub API method \([https\://github\.com/ansible\-collections/community\.sops/pull/159](https\://github\.com/ansible\-collections/community\.sops/pull/159)\)\.
* Fix changed DEB and RPM URLs for 3\.8\.0 and its prerelease\(s\) \([https\://github\.com/ansible\-collections/community\.sops/pull/159](https\://github\.com/ansible\-collections/community\.sops/pull/159)\)\.
<a id="v1-6-4"></a>
## v1\.6\.4
<a id="release-summary-24"></a>
### Release Summary
Maintenance/bugfix release for the move of sops to the new [getsops GitHub organization](https\://github\.com/getsops)\.
<a id="bugfixes-16"></a>
### Bugfixes
* install role \- fix <code>sops\_github\_latest\_detection\=latest\-release</code>\, which broke due to sops moving to another GitHub organization \([https\://github\.com/ansible\-collections/community\.sops/pull/151](https\://github\.com/ansible\-collections/community\.sops/pull/151)\)\.
<a id="v1-6-3"></a>
## v1\.6\.3
<a id="release-summary-25"></a>
### Release Summary
Maintenance release with updated documentation\.
From this version on\, community\.sops is using the new [Ansible semantic markup](https\://docs\.ansible\.com/ansible/devel/dev\_guide/developing\_modules\_documenting\.html\#semantic\-markup\-within\-module\-documentation)
in its documentation\. If you look at documentation with the ansible\-doc CLI tool
from ansible\-core before 2\.15\, please note that it does not render the markup
correctly\. You should be still able to read it in most cases\, but you need
ansible\-core 2\.15 or later to see it as it is intended\. Alternatively you can
look at [the devel docsite](https\://docs\.ansible\.com/ansible/devel/collections/community/sops/)
for the rendered HTML version of the documentation of the latest release\.
<a id="known-issues-1"></a>
### Known Issues
* Ansible markup will show up in raw form on ansible\-doc text output for ansible\-core before 2\.15\. If you have trouble deciphering the documentation markup\, please upgrade to ansible\-core 2\.15 \(or newer\)\, or read the HTML documentation on [https\://docs\.ansible\.com/ansible/devel/collections/community/sops/](https\://docs\.ansible\.com/ansible/devel/collections/community/sops/)\.
<a id="v1-6-2"></a>
## v1\.6\.2
<a id="release-summary-26"></a>
### Release Summary
Maintenance release\.
<a id="bugfixes-17"></a>
### Bugfixes
* install role \- make sure that the <code>pkg\_mgr</code> fact is definitely available when installing on <code>localhost</code>\. This can improve error messages in some cases \([https\://github\.com/ansible\-collections/community\.sops/issues/145](https\://github\.com/ansible\-collections/community\.sops/issues/145)\, [https\://github\.com/ansible\-collections/community\.sops/pull/146](https\://github\.com/ansible\-collections/community\.sops/pull/146)\)\.
<a id="v1-6-1"></a>
## v1\.6\.1
<a id="release-summary-27"></a>
### Release Summary
Maintenance release\.
<a id="bugfixes-18"></a>
### Bugfixes
* action plugin helper \- fix handling of deprecations for ansible\-core 2\.14\.2 \([https\://github\.com/ansible\-collections/community\.sops/pull/136](https\://github\.com/ansible\-collections/community\.sops/pull/136)\)\.
* various plugins \- remove unnecessary imports \([https\://github\.com/ansible\-collections/community\.sops/pull/133](https\://github\.com/ansible\-collections/community\.sops/pull/133)\)\.
<a id="v1-6-0"></a>
## v1\.6\.0
<a id="release-summary-28"></a>
### Release Summary
Feature release improving the installation role\.
<a id="minor-changes-6"></a>
### Minor Changes
* install role \- add <code>sops\_github\_latest\_detection</code> option that allows to configure which method to use for detecting the latest release on GitHub\. By default \(<code>auto</code>\) first tries to retrieve a list of recent releases using the API\, and if that fails due to rate limiting\, tries to obtain the latest GitHub release from a semi\-documented URL \([https\://github\.com/ansible\-collections/community\.sops/pull/133](https\://github\.com/ansible\-collections/community\.sops/pull/133)\)\.
* install role \- add <code>sops\_github\_token</code> option to allow passing a GitHub token\. This can for example be used to avoid rate limits when using the role in GitHub Actions \([https\://github\.com/ansible\-collections/community\.sops/pull/132](https\://github\.com/ansible\-collections/community\.sops/pull/132)\)\.
* install role \- implement another method to determine the latest release on GitHub than using the GitHub API\, which can make installation fail due to rate\-limiting \([https\://github\.com/ansible\-collections/community\.sops/pull/131](https\://github\.com/ansible\-collections/community\.sops/pull/131)\)\.
<a id="v1-5-0"></a>
## v1\.5\.0
<a id="release-summary-29"></a>
### Release Summary
Feature release\.
<a id="minor-changes-7"></a>
### Minor Changes
* Automatically install GNU Privacy Guard \(GPG\) in execution environments\. To install Mozilla sops a manual step needs to be added to the EE definition\, see the collection\'s documentation for details \([https\://github\.com/ansible\-collections/community\.sops/pull/98](https\://github\.com/ansible\-collections/community\.sops/pull/98)\)\.
<a id="new-playbooks"></a>
### New Playbooks
* community\.sops\.install \- Installs sops and GNU Privacy Guard on all remote hosts
* community\.sops\.install\_localhost \- Installs sops and GNU Privacy Guard on localhost
<a id="new-roles"></a>
### New Roles
* community\.sops\.install \- Install Mozilla sops
<a id="v1-4-1"></a>
## v1\.4\.1
<a id="release-summary-30"></a>
### Release Summary
Maintenance release to improve compatibility with future ansible\-core releases\.
<a id="bugfixes-19"></a>
### Bugfixes
* load\_vars \- ensure compatibility with newer versions of ansible\-core \([https\://github\.com/ansible\-collections/community\.sops/pull/121](https\://github\.com/ansible\-collections/community\.sops/pull/121)\)\.
<a id="v1-4-0"></a>
## v1\.4\.0
<a id="release-summary-31"></a>
### Release Summary
Feature release\.
<a id="minor-changes-8"></a>
### Minor Changes
* Allow to specify age keys as <code>age\_key</code>\, or age keyfiles as <code>age\_keyfile</code> \([https\://github\.com/ansible\-collections/community\.sops/issues/116](https\://github\.com/ansible\-collections/community\.sops/issues/116)\, [https\://github\.com/ansible\-collections/community\.sops/pull/117](https\://github\.com/ansible\-collections/community\.sops/pull/117)\)\.
* sops\_encrypt \- allow to specify age recipients \([https\://github\.com/ansible\-collections/community\.sops/issues/116](https\://github\.com/ansible\-collections/community\.sops/issues/116)\, [https\://github\.com/ansible\-collections/community\.sops/pull/117](https\://github\.com/ansible\-collections/community\.sops/pull/117)\)\.
<a id="v1-3-0"></a>
## v1\.3\.0
<a id="release-summary-32"></a>
### Release Summary
Feature release\.
<a id="minor-changes-9"></a>
### Minor Changes
* All software licenses are now in the <code>LICENSES/</code> directory of the collection root\, and the collection repository conforms to the [REUSE specification](https\://reuse\.software/spec/) except for the changelog fragments \([https\://github\.com/ansible\-collections/community\.crypto/sops/108](https\://github\.com/ansible\-collections/community\.crypto/sops/108)\, [https\://github\.com/ansible\-collections/community\.sops/pull/113](https\://github\.com/ansible\-collections/community\.sops/pull/113)\)\.
* sops vars plugin \- added a configuration option to temporarily disable the vars plugin \([https\://github\.com/ansible\-collections/community\.sops/pull/114](https\://github\.com/ansible\-collections/community\.sops/pull/114)\)\.
<a id="v1-2-3"></a>
## v1\.2\.3
<a id="release-summary-33"></a>
### Release Summary
Fix formatting bug in documentation\. No code changes\.
<a id="v1-2-2"></a>
## v1\.2\.2
<a id="release-summary-34"></a>
### Release Summary
Maintenance release\.
<a id="bugfixes-20"></a>
### Bugfixes
* Include <code>simplified\_bsd\.txt</code> license file for the <code>sops</code> module utils\.
<a id="v1-2-1"></a>
## v1\.2\.1
<a id="release-summary-35"></a>
### Release Summary
Maintenance release with updated documentation\.
<a id="v1-2-0"></a>
## v1\.2\.0
<a id="release-summary-36"></a>
### Release Summary
Collection release for inclusion in Ansible 4\.9\.0 and 5\.1\.0\.
This release contains a change allowing to configure generic plugin options with ansible\.cfg keys and env variables\.
<a id="minor-changes-10"></a>
### Minor Changes
* sops lookup and vars plugin \- allow to configure almost all generic options by ansible\.cfg entries and environment variables \([https\://github\.com/ansible\-collections/community\.sops/pull/81](https\://github\.com/ansible\-collections/community\.sops/pull/81)\)\.
<a id="bugfixes-21"></a>
### Bugfixes
* Fix error handling in calls of the <code>sops</code> binary when negative errors are returned \([https\://github\.com/ansible\-collections/community\.sops/issues/82](https\://github\.com/ansible\-collections/community\.sops/issues/82)\, [https\://github\.com/ansible\-collections/community\.sops/pull/83](https\://github\.com/ansible\-collections/community\.sops/pull/83)\)\.
<a id="v1-1-0"></a>
## v1\.1\.0
<a id="release-summary-37"></a>
### Release Summary
A minor release for inclusion in Ansible 4\.2\.0\.
<a id="minor-changes-11"></a>
### Minor Changes
* Avoid internal ansible\-core module\_utils in favor of equivalent public API available since at least Ansible 2\.9 \([https\://github\.com/ansible\-collections/community\.sops/pull/73](https\://github\.com/ansible\-collections/community\.sops/pull/73)\)\.
<a id="new-plugins"></a>
### New Plugins
<a id="filter"></a>
#### Filter
* community\.sops\.decrypt \- Decrypt sops\-encrypted data
<a id="v1-0-6"></a>
## v1\.0\.6
<a id="release-summary-38"></a>
### Release Summary
This release makes the collection compatible to the latest beta release of ansible\-core 2\.11\.
<a id="bugfixes-22"></a>
### Bugfixes
* action\_module plugin helper \- make compatible with latest changes in ansible\-core 2\.11\.0b3 \([https\://github\.com/ansible\-collections/community\.sops/pull/58](https\://github\.com/ansible\-collections/community\.sops/pull/58)\)\.
* community\.sops\.load\_vars \- make compatible with latest changes in ansible\-core 2\.11\.0b3 \([https\://github\.com/ansible\-collections/community\.sops/pull/58](https\://github\.com/ansible\-collections/community\.sops/pull/58)\)\.
<a id="v1-0-5"></a>
## v1\.0\.5
<a id="release-summary-39"></a>
### Release Summary
This release fixes a bug that prevented correct YAML file to be created when the output was ending in <code>\.yaml</code>\.
<a id="bugfixes-23"></a>
### Bugfixes
* community\.sops\.sops\_encrypt \- use output type <code>yaml</code> when path ends with <code>\.yaml</code> \([https\://github\.com/ansible\-collections/community\.sops/pull/56](https\://github\.com/ansible\-collections/community\.sops/pull/56)\)\.
<a id="v1-0-4"></a>
## v1\.0\.4
<a id="release-summary-40"></a>
### Release Summary
This is a security release\, fixing a potential information leak in the <code>community\.sops\.sops\_encrypt</code> module\.
<a id="security-fixes"></a>
### Security Fixes
* community\.sops\.sops\_encrypt \- mark the <code>aws\_secret\_access\_key</code> and <code>aws\_session\_token</code> parameters as <code>no\_log</code> to avoid leakage of secrets \([https\://github\.com/ansible\-collections/community\.sops/pull/54](https\://github\.com/ansible\-collections/community\.sops/pull/54)\)\.
<a id="v1-0-3"></a>
## v1\.0\.3
<a id="release-summary-41"></a>
### Release Summary
This release include some fixes to Ansible docs and required changes for inclusion in Ansible\.
<a id="bugfixes-24"></a>
### Bugfixes
* community\.sops\.sops lookup plugins \- fix wrong format of Ansible variables so that these are actually used \([https\://github\.com/ansible\-collections/community\.sops/pull/51](https\://github\.com/ansible\-collections/community\.sops/pull/51)\)\.
* community\.sops\.sops vars plugins \- remove non\-working Ansible variables \([https\://github\.com/ansible\-collections/community\.sops/pull/51](https\://github\.com/ansible\-collections/community\.sops/pull/51)\)\.
<a id="v1-0-2"></a>
## v1\.0\.2
<a id="release-summary-42"></a>
### Release Summary
Fix of 1\.0\.1 release which had no changelog entry\.
<a id="v1-0-1"></a>
## v1\.0\.1
<a id="release-summary-43"></a>
### Release Summary
Re\-release of 1\.0\.0 to counteract error during release\.
<a id="v1-0-0"></a>
## v1\.0\.0
<a id="release-summary-44"></a>
### Release Summary
First stable release\. This release is expected to be included in Ansible 3\.0\.0\.
<a id="minor-changes-12"></a>
### Minor Changes
* All plugins and modules\: allow to pass generic sops options with new options <code>config\_path</code>\, <code>enable\_local\_keyservice</code>\, <code>keyservice</code>\. Also allow to pass AWS parameters with options <code>aws\_profile</code>\, <code>aws\_access\_key\_id</code>\, <code>aws\_secret\_access\_key</code>\, and <code>aws\_session\_token</code> \([https\://github\.com/ansible\-collections/community\.sops/pull/47](https\://github\.com/ansible\-collections/community\.sops/pull/47)\)\.
* community\.sops\.sops\_encrypt \- allow to pass encryption\-specific options <code>kms</code>\, <code>gcp\_kms</code>\, <code>azure\_kv</code>\, <code>hc\_vault\_transit</code>\, <code>pgp</code>\, <code>unencrypted\_suffix</code>\, <code>encrypted\_suffix</code>\, <code>unencrypted\_regex</code>\, <code>encrypted\_regex</code>\, <code>encryption\_context</code>\, and <code>shamir\_secret\_sharing\_threshold</code> to sops \([https\://github\.com/ansible\-collections/community\.sops/pull/47](https\://github\.com/ansible\-collections/community\.sops/pull/47)\)\.
<a id="v0-2-0"></a>
## v0\.2\.0
<a id="release-summary-45"></a>
### Release Summary
This release adds features for the lookup and vars plugins\.
<a id="minor-changes-13"></a>
### Minor Changes
* community\.sops\.sops lookup plugin \- add <code>empty\_on\_not\_exist</code> option which allows to return an empty string instead of an error when the file does not exist \([https\://github\.com/ansible\-collections/community\.sops/pull/33](https\://github\.com/ansible\-collections/community\.sops/pull/33)\)\.
* community\.sops\.sops vars plugin \- add option to control caching \([https\://github\.com/ansible\-collections/community\.sops/pull/32](https\://github\.com/ansible\-collections/community\.sops/pull/32)\)\.
* community\.sops\.sops vars plugin \- add option to determine when vars are loaded \([https\://github\.com/ansible\-collections/community\.sops/pull/32](https\://github\.com/ansible\-collections/community\.sops/pull/32)\)\.
<a id="v0-1-0"></a>
## v0\.1\.0
<a id="release-summary-46"></a>
### Release Summary
First release of the <code>community\.sops</code> collection\!
This release includes multiple plugins\: an <code>action</code> plugin\, a <code>lookup</code> plugin and a <code>vars</code> plugin\.
<a id="new-plugins-1"></a>
### New Plugins
<a id="lookup"></a>
#### Lookup
* community\.sops\.sops \- Read sops encrypted file contents
<a id="vars"></a>
#### Vars
* community\.sops\.sops \- Loading sops\-encrypted vars files
<a id="new-modules"></a>
### New Modules
* community\.sops\.load\_vars \- Load sops\-encrypted variables from files\, dynamically within a task
* community\.sops\.sops\_encrypt \- Encrypt data with sops

3
ansible_collections/community/sops/CHANGELOG.md.license Normal file
View file

@ -0,0 +1,3 @@
GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
SPDX-License-Identifier: GPL-3.0-or-later
SPDX-FileCopyrightText: Ansible Project

669
ansible_collections/community/sops/CHANGELOG.rst Normal file
View file

@ -0,0 +1,669 @@
============================
Community SOPS Release Notes
============================
.. contents:: Topics
v2.2.7
======
Release Summary
---------------
Maintenance release.
Known Issues
------------
- When using the ``community.sops.load_vars`` with ansible-core 2.20, note that the deprecation of ``INJECT_FACTS_AS_VARS`` causes deprecation warnings to be shown every time a variable loaded with ``community.sops.load_vars`` is used. This is due to ansible-core deprecating ``INJECT_FACTS_AS_VARS`` without providing an alternative for modules like ``community.sops.load_vars`` to use. If you do not like these deprecation warnings, you have to explicitly set ``INJECT_FACTS_AS_VARS`` to ``true``. **DO NOT** change the use of SOPS encrypted variables to ``ansible_facts``. The situation will hopefully improve in ansible-core 2.21 through the promised API that allows action plugins to set variables; community.sops will adapt to use it, which will make the warning go away. (The API was originally promised for ansible-core 2.20, but then delayed.)
v2.2.6
======
Release Summary
---------------
Bugfix and maintenance release.
Bugfixes
--------
- Clean up plugin code that does not run on the target (https://github.com/ansible-collections/community.sops/pull/275).
- Note that the MIT licenced code in ``plugins/module_utils/_six.py`` has been removed (https://github.com/ansible-collections/community.sops/pull/275).
- sops vars plugin - ensure that loaded vars are evaluated also with ansible-core 2.19+ (https://github.com/ansible-collections/community.sops/pull/273).
v2.2.5
======
Release Summary
---------------
Maintenance release.
Bugfixes
--------
- load_vars action - avoid another deprecated module utils from ansible-core (https://github.com/ansible-collections/community.sops/pull/270).
- load_vars action - avoid deprecated import from ansible-core that will be removed in ansible-core 2.21 (https://github.com/ansible-collections/community.sops/pull/272).
v2.2.4
======
Release Summary
---------------
Maintenance release.
Bugfixes
--------
- Fix accidental type extensions (https://github.com/ansible-collections/community.sops/pull/269).
v2.2.3
======
Release Summary
---------------
Maintenance release.
Minor Changes
-------------
- Note that some new code in ``plugins/module_utils/_six.py`` is MIT licensed (https://github.com/ansible-collections/community.sops/pull/268).
Bugfixes
--------
- Avoid using ``ansible.module_utils.six`` to avoid deprecation warnings with ansible-core 2.20 (https://github.com/ansible-collections/community.sops/pull/268).
v2.2.2
======
Release Summary
---------------
Bugfix release.
Bugfixes
--------
- Avoid deprecated functionality in ansible-core 2.20 (https://github.com/ansible-collections/community.sops/pull/260).
- all modules and plugins - the default of ``enable_local_keyservice`` changed from ``false`` to ``true``, and explicitly setting it to ``false`` now passes ``--enable-local-keyservice=false``. SOPS' default has always been ``true``, and when setting this option to ``true`` so far it resulted in passing ``--enable-local-keyservice``, which is equivalent to ``--enable-local-keyservice=true`` and had no effect. This means that from now on, setting ``enable_local_keyservice`` explicitly to ``false`` has an effect. If ``enable_local_keyservice`` was not set before, or was set to ``true``, nothing will change (https://github.com/ansible-collections/community.sops/issues/261, https://github.com/ansible-collections/community.sops/pull/262).
v2.2.1
======
Release Summary
---------------
Bugfix release.
Bugfixes
--------
- install role - avoid deprecated parameter value for the ``ansible.builtin.uri`` module (https://github.com/ansible-collections/community.sops/pull/255).
v2.2.0
======
Release Summary
---------------
Feature release.
Minor Changes
-------------
- load_vars - expressions can now be lazily evaluated when using ansible-core 2.19 or newer (https://github.com/ansible-collections/community.sops/pull/229).
v2.1.0
======
Release Summary
---------------
Feature release.
Minor Changes
-------------
- Now supports specifying SSH private keys for age with the new ``age_ssh_private_keyfile`` option (https://github.com/ansible-collections/community.sops/pull/241).
v2.0.5
======
Release Summary
---------------
Maintenance release with updated SOPS version test coverage.
v2.0.4
======
Release Summary
---------------
Maintenance release with Data Tagging support.
Bugfixes
--------
- load_vars - make evaluation compatible with Data Tagging in upcoming ansible-core release (https://github.com/ansible-collections/community.sops/pull/225).
v2.0.3
======
Release Summary
---------------
Bugfix release.
Bugfixes
--------
- install role - ``sops_install_on_localhost=false`` was not working properly if the role was running on more than one host due to a bug in ansible-core (https://github.com/ansible-collections/community.sops/issues/223, https://github.com/ansible-collections/community.sops/pull/224).
v2.0.2
======
Release Summary
---------------
Bugfix release.
Bugfixes
--------
- install role - when used with Debian on ARM architecture, the architecture name is now correctly translated from ``aarch64`` to ``arm64`` (https://github.com/ansible-collections/community.sops/issues/220, https://github.com/ansible-collections/community.sops/pull/221).
v2.0.1
======
Release Summary
---------------
Maintenance release with updated documentation.
v2.0.0
======
Release Summary
---------------
Major verison that drops support for End of Life Ansible/ansible-base/ansible-core versions.
Removed Features (previously deprecated)
----------------------------------------
- The collection no longer supports Ansible 2.9, ansible-base 2.10, ansible-core 2.11, ansible-core 2.12, ansible-core 2.13, and ansible-core 2.14. If you need to continue using End of Life versions of Ansible/ansible-base/ansible-core, please use community.sops 1.x.y (https://github.com/ansible-collections/community.sops/pull/206).
v1.9.1
======
Release Summary
---------------
Bugfix release.
Bugfixes
--------
- sops_encrypt - pass absolute paths to ``module.atomic_move()`` (https://github.com/ansible/ansible/issues/83950, https://github.com/ansible-collections/community.sops/pull/208).
v1.9.0
======
Release Summary
---------------
Feature release.
Minor Changes
-------------
- decrypt filter plugin - now supports the input and output type ``ini`` (https://github.com/ansible-collections/community.sops/pull/204).
- sops lookup plugin - new option ``extract`` allows extracting a single key out of a JSON or YAML file, equivalent to sops' ``decrypt --extract`` (https://github.com/ansible-collections/community.sops/pull/200).
- sops lookup plugin - now supports the input and output type ``ini`` (https://github.com/ansible-collections/community.sops/pull/204).
v1.8.2
======
Release Summary
---------------
Maintenance release with updated documentation and changelog.
Deprecated Features
-------------------
- The collection deprecates support for all Ansible/ansible-base/ansible-core versions that are currently End of Life, `according to the ansible-core support matrix <https://docs.ansible.com/ansible-core/devel/reference_appendices/release_and_maintenance.html#ansible-core-support-matrix>`__. This means that the next major release of the collection will no longer support Ansible 2.9, ansible-base 2.10, ansible-core 2.11, ansible-core 2.12, ansible-core 2.13, and ansible-core 2.14.
v1.8.1
======
Release Summary
---------------
Bugfix release.
Bugfixes
--------
- Pass ``config_path`` on SOPS 3.9.0 before the subcommand instead of after it (https://github.com/ansible-collections/community.sops/issues/195, https://github.com/ansible-collections/community.sops/pull/197).
v1.8.0
======
Release Summary
---------------
Feature release for supporting improvements coming with SOPS 3.9.0.
Minor Changes
-------------
- Detect SOPS 3.9.0 and use new ``decrypt`` and ``encrypt`` subcommands (https://github.com/ansible-collections/community.sops/pull/190).
- sops vars plugin - new option ``handle_unencrypted_files`` allows to control behavior when encountering unencrypted files with SOPS 3.9.0+ (https://github.com/ansible-collections/community.sops/pull/190).
Bugfixes
--------
- sops_encrypt - properly support ``path_regex`` in ``.sops.yaml`` when SOPS 3.9.0 or later is used (https://github.com/ansible-collections/community.sops/issues/153, https://github.com/ansible-collections/community.sops/pull/190).
v1.7.0
======
Release Summary
---------------
Bugfix and feature release to fix installation issues with SOPS 3.9.0.
Minor Changes
-------------
- sops vars plugin - allow to configure the valid extensions with an ``ansible.cfg`` entry or with an environment variable (https://github.com/ansible-collections/community.sops/pull/185).
Bugfixes
--------
- Fix RPM URL for the 3.9.0 release (https://github.com/ansible-collections/community.sops/pull/188).
v1.6.7
======
Release Summary
---------------
Bugfix release.
Bugfixes
--------
- sops_encrypt - ensure that output-type is set to ``yaml`` when the file extension ``.yml`` is used. Now both ``.yaml`` and ``.yml`` files use the SOPS ``--output-type=yaml`` formatting (https://github.com/ansible-collections/community.sops/issues/164).
v1.6.6
======
Release Summary
---------------
Make fully compatible with and test against sops 3.8.0.
Bugfixes
--------
- Fix RPM URL for the 3.8.0 release (https://github.com/ansible-collections/community.sops/pull/161).
v1.6.5
======
Release Summary
---------------
Make compatible with and test against sops 3.8.0-rc.1.
Bugfixes
--------
- Avoid pre-releases when picking the latest version when using the GitHub API method (https://github.com/ansible-collections/community.sops/pull/159).
- Fix changed DEB and RPM URLs for 3.8.0 and its prerelease(s) (https://github.com/ansible-collections/community.sops/pull/159).
v1.6.4
======
Release Summary
---------------
Maintenance/bugfix release for the move of sops to the new `getsops GitHub organization <https://github.com/getsops>`__.
Bugfixes
--------
- install role - fix ``sops_github_latest_detection=latest-release``, which broke due to sops moving to another GitHub organization (https://github.com/ansible-collections/community.sops/pull/151).
v1.6.3
======
Release Summary
---------------
Maintenance release with updated documentation.
From this version on, community.sops is using the new `Ansible semantic markup
<https://docs.ansible.com/ansible/devel/dev_guide/developing_modules_documenting.html#semantic-markup-within-module-documentation>`__
in its documentation. If you look at documentation with the ansible-doc CLI tool
from ansible-core before 2.15, please note that it does not render the markup
correctly. You should be still able to read it in most cases, but you need
ansible-core 2.15 or later to see it as it is intended. Alternatively you can
look at `the devel docsite <https://docs.ansible.com/ansible/devel/collections/community/sops/>`__
for the rendered HTML version of the documentation of the latest release.
Known Issues
------------
- Ansible markup will show up in raw form on ansible-doc text output for ansible-core before 2.15. If you have trouble deciphering the documentation markup, please upgrade to ansible-core 2.15 (or newer), or read the HTML documentation on https://docs.ansible.com/ansible/devel/collections/community/sops/.
v1.6.2
======
Release Summary
---------------
Maintenance release.
Bugfixes
--------
- install role - make sure that the ``pkg_mgr`` fact is definitely available when installing on ``localhost``. This can improve error messages in some cases (https://github.com/ansible-collections/community.sops/issues/145, https://github.com/ansible-collections/community.sops/pull/146).
v1.6.1
======
Release Summary
---------------
Maintenance release.
Bugfixes
--------
- action plugin helper - fix handling of deprecations for ansible-core 2.14.2 (https://github.com/ansible-collections/community.sops/pull/136).
- various plugins - remove unnecessary imports (https://github.com/ansible-collections/community.sops/pull/133).
v1.6.0
======
Release Summary
---------------
Feature release improving the installation role.
Minor Changes
-------------
- install role - add ``sops_github_latest_detection`` option that allows to configure which method to use for detecting the latest release on GitHub. By default (``auto``) first tries to retrieve a list of recent releases using the API, and if that fails due to rate limiting, tries to obtain the latest GitHub release from a semi-documented URL (https://github.com/ansible-collections/community.sops/pull/133).
- install role - add ``sops_github_token`` option to allow passing a GitHub token. This can for example be used to avoid rate limits when using the role in GitHub Actions (https://github.com/ansible-collections/community.sops/pull/132).
- install role - implement another method to determine the latest release on GitHub than using the GitHub API, which can make installation fail due to rate-limiting (https://github.com/ansible-collections/community.sops/pull/131).
v1.5.0
======
Release Summary
---------------
Feature release.
Minor Changes
-------------
- Automatically install GNU Privacy Guard (GPG) in execution environments. To install Mozilla sops a manual step needs to be added to the EE definition, see the collection's documentation for details (https://github.com/ansible-collections/community.sops/pull/98).
New Playbooks
-------------
- community.sops.install - Installs sops and GNU Privacy Guard on all remote hosts
- community.sops.install_localhost - Installs sops and GNU Privacy Guard on localhost
New Roles
---------
- community.sops.install - Install Mozilla sops
v1.4.1
======
Release Summary
---------------
Maintenance release to improve compatibility with future ansible-core releases.
Bugfixes
--------
- load_vars - ensure compatibility with newer versions of ansible-core (https://github.com/ansible-collections/community.sops/pull/121).
v1.4.0
======
Release Summary
---------------
Feature release.
Minor Changes
-------------
- Allow to specify age keys as ``age_key``, or age keyfiles as ``age_keyfile`` (https://github.com/ansible-collections/community.sops/issues/116, https://github.com/ansible-collections/community.sops/pull/117).
- sops_encrypt - allow to specify age recipients (https://github.com/ansible-collections/community.sops/issues/116, https://github.com/ansible-collections/community.sops/pull/117).
v1.3.0
======
Release Summary
---------------
Feature release.
Minor Changes
-------------
- All software licenses are now in the ``LICENSES/`` directory of the collection root, and the collection repository conforms to the `REUSE specification <https://reuse.software/spec/>`__ except for the changelog fragments (https://github.com/ansible-collections/community.crypto/sops/108, https://github.com/ansible-collections/community.sops/pull/113).
- sops vars plugin - added a configuration option to temporarily disable the vars plugin (https://github.com/ansible-collections/community.sops/pull/114).
v1.2.3
======
Release Summary
---------------
Fix formatting bug in documentation. No code changes.
v1.2.2
======
Release Summary
---------------
Maintenance release.
Bugfixes
--------
- Include ``simplified_bsd.txt`` license file for the ``sops`` module utils.
v1.2.1
======
Release Summary
---------------
Maintenance release with updated documentation.
v1.2.0
======
Release Summary
---------------
Collection release for inclusion in Ansible 4.9.0 and 5.1.0.
This release contains a change allowing to configure generic plugin options with ansible.cfg keys and env variables.
Minor Changes
-------------
- sops lookup and vars plugin - allow to configure almost all generic options by ansible.cfg entries and environment variables (https://github.com/ansible-collections/community.sops/pull/81).
Bugfixes
--------
- Fix error handling in calls of the ``sops`` binary when negative errors are returned (https://github.com/ansible-collections/community.sops/issues/82, https://github.com/ansible-collections/community.sops/pull/83).
v1.1.0
======
Release Summary
---------------
A minor release for inclusion in Ansible 4.2.0.
Minor Changes
-------------
- Avoid internal ansible-core module_utils in favor of equivalent public API available since at least Ansible 2.9 (https://github.com/ansible-collections/community.sops/pull/73).
New Plugins
-----------
Filter
~~~~~~
- community.sops.decrypt - Decrypt sops-encrypted data
v1.0.6
======
Release Summary
---------------
This release makes the collection compatible to the latest beta release of ansible-core 2.11.
Bugfixes
--------
- action_module plugin helper - make compatible with latest changes in ansible-core 2.11.0b3 (https://github.com/ansible-collections/community.sops/pull/58).
- community.sops.load_vars - make compatible with latest changes in ansible-core 2.11.0b3 (https://github.com/ansible-collections/community.sops/pull/58).
v1.0.5
======
Release Summary
---------------
This release fixes a bug that prevented correct YAML file to be created when the output was ending in ``.yaml``.
Bugfixes
--------
- community.sops.sops_encrypt - use output type ``yaml`` when path ends with ``.yaml`` (https://github.com/ansible-collections/community.sops/pull/56).
v1.0.4
======
Release Summary
---------------
This is a security release, fixing a potential information leak in the ``community.sops.sops_encrypt`` module.
Security Fixes
--------------
- community.sops.sops_encrypt - mark the ``aws_secret_access_key`` and ``aws_session_token`` parameters as ``no_log`` to avoid leakage of secrets (https://github.com/ansible-collections/community.sops/pull/54).
v1.0.3
======
Release Summary
---------------
This release include some fixes to Ansible docs and required changes for inclusion in Ansible.
Bugfixes
--------
- community.sops.sops lookup plugins - fix wrong format of Ansible variables so that these are actually used (https://github.com/ansible-collections/community.sops/pull/51).
- community.sops.sops vars plugins - remove non-working Ansible variables (https://github.com/ansible-collections/community.sops/pull/51).
v1.0.2
======
Release Summary
---------------
Fix of 1.0.1 release which had no changelog entry.
v1.0.1
======
Release Summary
---------------
Re-release of 1.0.0 to counteract error during release.
v1.0.0
======
Release Summary
---------------
First stable release. This release is expected to be included in Ansible 3.0.0.
Minor Changes
-------------
- All plugins and modules: allow to pass generic sops options with new options ``config_path``, ``enable_local_keyservice``, ``keyservice``. Also allow to pass AWS parameters with options ``aws_profile``, ``aws_access_key_id``, ``aws_secret_access_key``, and ``aws_session_token`` (https://github.com/ansible-collections/community.sops/pull/47).
- community.sops.sops_encrypt - allow to pass encryption-specific options ``kms``, ``gcp_kms``, ``azure_kv``, ``hc_vault_transit``, ``pgp``, ``unencrypted_suffix``, ``encrypted_suffix``, ``unencrypted_regex``, ``encrypted_regex``, ``encryption_context``, and ``shamir_secret_sharing_threshold`` to sops (https://github.com/ansible-collections/community.sops/pull/47).
v0.2.0
======
Release Summary
---------------
This release adds features for the lookup and vars plugins.
Minor Changes
-------------
- community.sops.sops lookup plugin - add ``empty_on_not_exist`` option which allows to return an empty string instead of an error when the file does not exist (https://github.com/ansible-collections/community.sops/pull/33).
- community.sops.sops vars plugin - add option to control caching (https://github.com/ansible-collections/community.sops/pull/32).
- community.sops.sops vars plugin - add option to determine when vars are loaded (https://github.com/ansible-collections/community.sops/pull/32).
v0.1.0
======
Release Summary
---------------
First release of the ``community.sops`` collection!
This release includes multiple plugins: an ``action`` plugin, a ``lookup`` plugin and a ``vars`` plugin.
New Plugins
-----------
Lookup
~~~~~~
- community.sops.sops - Read sops encrypted file contents
Vars
~~~~
- community.sops.sops - Loading sops-encrypted vars files
New Modules
-----------
- community.sops.load_vars - Load sops-encrypted variables from files, dynamically within a task
- community.sops.sops_encrypt - Encrypt data with sops

3
ansible_collections/community/sops/CHANGELOG.rst.license Normal file
View file

@ -0,0 +1,3 @@
GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
SPDX-License-Identifier: GPL-3.0-or-later
SPDX-FileCopyrightText: Ansible Project

37
ansible_collections/community/sops/CONTRIBUTING.md Normal file
View file

@ -0,0 +1,37 @@
<!--
Copyright (c) Ansible Project
GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
SPDX-License-Identifier: GPL-3.0-or-later
-->
# Contributing
Hello and welcome! Thank you for being interested in contributing to this project.
First of all get confident with the [Ansible Collections Overview](https://github.com/ansible-collections/overview).
We accept pull requests for bugfixes, new features, and other improvements, assuming they pass our review. If you are planning a larger feature or refactoring, please create an issue first to discuss it with us.
## :bug: Reporting an issue
Please [search in the issue list](https://github.com/ansible-collections/community.sops/issues) and if has not been already reported, [open a new issue](https://github.com/ansible-collections/community.sops/issues/new/choose)
## 🏗 To contribute
A more extensive walk-through can be found in [Ansible's Contributing to collections](https://docs.ansible.com/ansible/devel/dev_guide/developing_collections.html#hacking-collections).
1. Fork this repo (when checking it out, see [here](https://docs.ansible.com/ansible/devel/dev_guide/developing_collections.html#contributing-to-collections) for how to place the checkout correctly)
1. Create a feature branch
1. Commit and push your code. To make the process faster, please ensure:
- the tests are green. Tests runs using [GitHub Actions](https://help.github.com/en/actions)
- you added a [changelog fragment](https://docs.ansible.com/ansible/devel/community/collection_development_process.html#creating-a-changelog-fragment)
Please note that all PRs that are not strictly documentation, testing, or add a new plugin or module, require a changelog fragment. See [Creating a changelog fragment](https://docs.ansible.com/ansible/devel/community/collection_development_process.html#creating-a-changelog-fragment) for information on that.
Further resources:
- [Ansible Developer guide: developing collections](https://docs.ansible.com/ansible/devel/dev_guide/developing_collections.html)
- [Ansible Developer guide](https://docs.ansible.com/ansible/devel/dev_guide/index.html)
This repository adheres to the [Ansible Community code of conduct](https://docs.ansible.com/ansible/devel/community/code_of_conduct.html)

674
ansible_collections/community/sops/COPYING Normal file
View file

@ -0,0 +1,674 @@
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU General Public License is a free, copyleft license for
software and other kinds of works.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users. We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors. You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights. Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received. You must make sure that they, too, receive
or can get the source code. And you must show them these terms so they
know their rights.
Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.
For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software. For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.
Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting users' freedom to change the software. The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable. Therefore, we
have designed this version of the GPL to prohibit the practice for those
products. If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.
Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary. To prevent this, the GPL assures that
patents cannot be used to render the program non-free.
The precise terms and conditions for copying, distribution and
modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this
License. Each licensee is addressed as "you". "Licensees" and
"recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy. The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based
on the Program.
To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy. Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other
parties to make or receive copies. Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License. If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work
for making modifications to it. "Object code" means any non-source
form of a work.
A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form. A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities. However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work. For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.
The Corresponding Source for a work in source code form is that
same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the unmodified Program. The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work. This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force. You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright. Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under
the conditions stated below. Sublicensing is not allowed; section 10
makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.
When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.
b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7. This requirement modifies the requirement in section 4 to
"keep intact all notices".
c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy. This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged. This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.
A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit. Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:
a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source. This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.
d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge. You need not require recipients to copy the
Corresponding Source along with the object code. If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source. Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.
A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling. In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage. For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product. A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source. The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.
If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information. But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).
The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed. Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law. If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it. (Additional permissions may be written to require their own
removal in certain cases when you modify the work.) You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or
e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.
All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10. If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term. If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.
Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License. If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance. However,
nothing other than this License grants you permission to propagate or
modify any covered work. These actions infringe copyright if you do
not accept this License. Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License. You are not responsible
for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations. If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License. For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based. The
work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version. For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement). To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.
If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.
A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License. You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.
13. Use with the GNU Affero General Public License.
Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.
If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.
Later license versions may give you additional or different
permissions. However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
Also add information on how to contact you by electronic and paper mail.
If the program does terminal interaction, make it output a short
notice like this when it starts in an interactive mode:
<program> Copyright (C) <year> <name of author>
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, your program's commands
might be different; for a GUI interface, you would use an "about box".
You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU GPL, see
<https://www.gnu.org/licenses/>.
The GNU General Public License does not permit incorporating your program
into proprietary programs. If your program is a subroutine library, you
may consider it more useful to permit linking proprietary applications with
the library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License. But first, please read
<https://www.gnu.org/licenses/why-not-lgpl.html>.

2861
ansible_collections/community/sops/FILES.json Normal file
View file

File diff suppressed because it is too large Load diff

8
ansible_collections/community/sops/LICENSES/BSD-2-Clause.txt Normal file
View file

@ -0,0 +1,8 @@
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

1
ansible_collections/community/sops/LICENSES/GPL-3.0-or-later.txt Symbolic link
View file

@ -0,0 +1 @@
../COPYING

37
ansible_collections/community/sops/MANIFEST.json Normal file
View file

@ -0,0 +1,37 @@
{
"collection_info": {
"namespace": "community",
"name": "sops",
"version": "2.2.7",
"authors": [
"Edoardo Tenani"
],
"readme": "README.md",
"tags": [
"sops",
"encryption",
"decryption",
"secret",
"vault"
],
"description": "Support usage of SOPS (getsops/sops) from your Ansible playbooks",
"license": [
"GPL-3.0-or-later",
"BSD-2-Clause"
],
"license_file": null,
"dependencies": {},
"repository": "https://github.com/ansible-collections/community.sops",
"documentation": null,
"homepage": "https://github.com/ansible-collections/community.sops",
"issues": "https://github.com/ansible-collections/community.sops/issues"
},
"file_manifest_file": {
"name": "FILES.json",
"ftype": "file",
"chksum_type": "sha256",
"chksum_sha256": "d6a32bb2e00581e2d48d02e472b018d2e958cff2cacac32329d0375611666f34",
"format": 1
},
"format": 1
}

362
ansible_collections/community/sops/README.md Normal file
View file

@ -0,0 +1,362 @@
<!--
Copyright (c) Ansible Project
GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
SPDX-License-Identifier: GPL-3.0-or-later
-->
# Community SOPS Collection
[![Documentation](https://img.shields.io/badge/docs-brightgreen.svg)](https://docs.ansible.com/ansible/devel/collections/community/sops/)
[![CI](https://github.com/ansible-collections/community.sops/actions/workflows/nox.yml/badge.svg?branch=main)](https://github.com/ansible-collections/community.sops/actions)
[![Codecov](https://img.shields.io/codecov/c/github/ansible-collections/community.sops)](https://codecov.io/gh/ansible-collections/community.sops)
[![REUSE status](https://api.reuse.software/badge/github.com/ansible-collections/community.sops)](https://api.reuse.software/info/github.com/ansible-collections/community.sops)
The `community.sops` collection allows integrating [CNCF SOPS (`getsops/sops`)](https://github.com/getsops/sops) in Ansible.
`getsops/sops` is a tool for encryption and decryption of files using secure keys (GPG, KMS, age). It can be leveraged in Ansible to provide an easy to use and flexible to manage way to manage ecrypted secrets' files.
Please note that this collection does **not** support Windows targets.
## SOPS version compatibility
The following table shows which versions of SOPS were tested with which versions of the collection. Older (or newer) versions of SOPS can still work fine, it just means that we did not test them. In some cases, it could be that a minimal required version of SOPS is explicitly documented for a specific feature. This is the case from community.sops 1.8.0 on; from that version on the collection automatically detects the SOPS version to determine whether a feature is supported or not.
|`community.sops` version|SOPS versions|
|---|---|
|`main` branch|`3.5.0`, `3.6.0`, `3.6.1`, `3.7.0`, `3.7.3`, `3.8.0`, `3.8.1`, `3.9.0`, `3.9.1`, `3.9.2`, `3.9.3`, `3.10.0`, `3.10.1`, `3.10.2`, `3.11.0`|
## Code of Conduct
We follow [Ansible Code of Conduct](https://docs.ansible.com/ansible/latest/community/code_of_conduct.html) in all our interactions within this project.
If you encounter abusive behavior violating the [Ansible Code of Conduct](https://docs.ansible.com/ansible/latest/community/code_of_conduct.html), please refer to the [policy violations](https://docs.ansible.com/ansible/latest/community/code_of_conduct.html#policy-violations) section of the Code of Conduct for information on how to raise a complaint.
## Communication
* Join the Ansible forum:
* [Get Help](https://forum.ansible.com/c/help/6): get help or help others.Please add appropriate tags if you start new discussions, for example the `sops` tag.
* [Posts tagged with 'sops'](https://forum.ansible.com/tag/sops): subscribe to participate in SOPS related conversations.
* [Social Spaces](https://forum.ansible.com/c/chat/4): gather and interact with fellow enthusiasts.
* [News & Announcements](https://forum.ansible.com/c/news/5): track project-wide announcements including social events.
* The Ansible [Bullhorn newsletter](https://docs.ansible.com/ansible/devel/community/communication.html#the-bullhorn): used to announce releases and important changes.
For more information about communication, see the [Ansible communication guide](https://docs.ansible.com/ansible/devel/community/communication.html).
## Tested with Ansible
Tested with the current ansible-core 2.15, ansible-core 2.16, ansible-core 2.17, ansible-core 2.18, and ansible-core 2.19 releases and the current development version of ansible-core. Ansible versions before 2.15.0 are not supported.
## External requirements
<!-- List any external resources the collection depends on, for example minimum versions of an OS, libraries, or utilities. Do not list other Ansible collections here. -->
You will need to install [the `sops` CLI tool](https://github.com/getsops/sops) manually before using plugins provided by this
collection.
## Collection Documentation
Browsing the [**latest** collection documentation](https://docs.ansible.com/ansible/latest/collections/community/sops) will show docs for the _latest version released in the Ansible package_, not the latest version of the collection released on Galaxy.
Browsing the [**devel** collection documentation](https://docs.ansible.com/ansible/devel/collections/community/sops) shows docs for the _latest version released on Galaxy_.
We also separately publish [**latest commit** collection documentation](https://ansible-collections.github.io/community.sops/branch/main/) which shows docs for the _latest commit in the `main` branch_.
If you use the Ansible package and do not update collections independently, use **latest**. If you install or update this collection directly from Galaxy, use **devel**. If you are looking to contribute, use **latest commit**.
## Included content
<!-- Galaxy will eventually list the module docs within the UI, but until that is ready, you may need to either describe your plugins etc here, or point to an external docsite to cover that information. -->
This collection provides:
- a [lookup plugin](https://docs.ansible.com/ansible/latest/user_guide/playbooks_lookups.html#playbooks-lookups) `community.sops.sops` that allows looking up a SOPS-encrypted file content;
- a [filter plugin](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_filters.html) `community.sops.decrypt` that allows decrypting SOPS-encrypted data;
- a [vars plugin](https://docs.ansible.com/ansible/latest/plugins/vars.html) `community.sops.sops` that allows loading Ansible vars from SOPS-encrypted files for hosts and groups;
- an [action plugin](https://docs.ansible.com/ansible/latest/plugins/action.html) `community.sops.load_vars` that allows loading Ansible vars from a SOPS-encrypted file dynamically during a playbook or role;
- a [module](https://docs.ansible.com/ansible/latest/user_guide/basic_concepts.html#modules) `community.sops.sops_encrypt` which allows to encrypt data with SOPS.
- a [role](https://docs.ansible.com/ansible/latest/user_guide/playbooks_reuse_roles.html) `community.sops.install` which allows to install SOPS and GNU Privacy Guard.
- two [playbooks](https://docs.ansible.com/ansible/latest/user_guide/playbooks_intro.html) `community.sops.install` and `community.sops.install_localhost` which allow to install SOPS and GNU Privacy Guard.
## Using this collection
### Installing SOPS
To install SOPS, you can use the `community.sops.install` role. The role also installs [GNU Privacy Guard (GPG)](https://en.wikipedia.org/wiki/GNU_Privacy_Guard).
Examples:
```yaml
tasks:
# To use the sops_encrypt module on a remote host, you need to install SOPS on it:
- name: Install SOPS on remote hosts
ansible.builtin.include_role:
name: community.sops.install
vars:
sops_version: 2.7.0 # per default installs the latest version
# To use the lookup plugin, filter plugin, vars plugin, or the load_vars action,
# you need SOPS installed on localhost:
- name: Install SOPS on localhost
ansible.builtin.include_role:
name: community.sops.install
vars:
sops_install_on_localhost: true
```
### lookup plugin
The lookup plugin can be accessed with the `community.sops.sops` key.
Examples:
```yaml
tasks:
- name: Output secrets to screen (BAD IDEA!)
ansible.builtin.debug:
msg: "Content: {{ lookup('community.sops.sops', '/path/to/sops-encrypted-file.enc.yaml') }}"
- name: Add SSH private key
ansible.builtin.copy:
content: "{{ lookup('community.sops.sops', user + '-id_rsa') }}"
dest: /home/{{ user }}/.ssh/id_rsa
owner: "{{ user }}"
group: "{{ user }}"
mode: 0600
no_log: true # avoid content to be written to log
```
See [Lookup Plugins](https://docs.ansible.com/ansible/latest/plugins/lookup.html) for more details on lookup plugins.
### filter plugin
The filter plugin can be used in Jinja2 expressions by the name `community.sops.decrypt`. It can decrypt SOPS-encrypted data coming from other sources than files.
Example:
```yaml
tasks:
- name: Load SOPS encrypted data
ansible.builtin.set_fact:
encrypted_data: "{{ lookup('file', '/path/to/sops-encrypted-file.enc.yaml') }}"
- name: Output secrets to screen (BAD IDEA!)
ansible.builtin.debug:
msg: "Content: {{ encrypted_data | community.sops.decrypt(output_type='yaml') }}"
```
See [Filter Plugins](https://docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html) for more details on filters.
Please note that if you put a Jinja2 expression in a variable, it will be evaluated **every time it is used**. Decrypting data takes a certain amount of time. If you need to use an expression multiple times, it is better to store its evaluated form as a fact with `ansible.bulitin.set_fact` first:
```yaml
tasks:
- name: Decrypt data once
ansible.builtin.set_fact:
decrypted_data: "{{ encrypted_data | community.sops.decrypt }}"
run_once: true # if encrypted_data is identical on all hosts
- name: Use decrypted secrets multiple times
ansible.builtin.openssl_privatekey:
path: "/path/to/private_{{ item }}.pem"
passphrase: "{{ decrypted_data }}"
cipher: auto
loop:
- foo
- bar
- baz
```
By using `{{ encrypted_data | community.sops.decrypt }}` instead of `{{ decrypted_data }}` in the `openssl_privatekey` task, the data would be decrypted three times for every host this is executed for. With the `ansible.builtin.set_fact` and `run_once: true`, it is evaluated only once.
### vars plugin
Vars plugins only work in ansible >= 2.10 and require explicit enabling. One
way to enable the plugin is by adding the following to the `defaults` section of
your `ansible.cfg`:
```ini
vars_plugins_enabled = host_group_vars,community.sops.sops
```
See [VARIABLE_PLUGINS_ENABLED](https://docs.ansible.com/ansible/devel/reference_appendices/config.html#variable-plugins-enabled) for more details.
After the plugin is enabled, correctly named group and host vars files will be
transparently decrypted with SOPS.
The files must end with one of these extensions:
* `.sops.yaml`
* `.sops.yml`
* `.sops.json`
(These extensions can be adjusted, check out the vars plugin's options for details.) Here is an example file structure:
```
├── inventory/
│ ├── group_vars/
│ │ └── all.sops.yml
│ ├── host_vars/
│ │ ├── server1.sops.yml
│ │ └── server2/
│ │ └── data.sops.yml
│ └── hosts
├── playbooks/
│ └── setup-server.yml
└── ansible.cfg
```
You could execute the playbook in this example with the following command. The
SOPS-encrypted vars files would be decrypted and used.
```console
$ ansible-playbook playbooks/setup-server.yml -i inventory/hosts
```
#### Determine when to load variables
Ansible 2.10 allows to determine [when vars plugins load the data](https://docs.ansible.com/ansible/latest/plugins/vars.html#using-vars-plugins).
To run the SOPS vars plugin right after importing inventory, you can add the following to `ansible.cfg`:
```ini
[community.sops]
vars_stage = inventory
```
#### Caching variable files
By default, the vars plugin caches decrypted files to avoid having to decrypt them every task. If this is not wanted, it can be explicitly disabled in `ansible.cfg`:
```ini
[community.sops]
vars_cache = false
```
Please note that when using vars plugin staging, this setting only has effect if the variables are not only loaded during the `inventory` stage. See the documentation of the `community.sops.sops` vars plugin for more details.
### load_vars action plugin
The `load_vars` action plugin can be used similarly to Ansible's `include_vars`, except that it right now only supports single files. Also, it does not allow to load proper variables (i.e. "unsafe" Jinja2 expressions which evaluate on usage), but only facts. This is a restriction imposed by ansible-core. The plugin does allow to evaluate expressions on load-time, though.
Examples:
```yaml
tasks:
- name: Load variables from file and store them in a variable
community.sops.load_vars:
file: path/to/sops-encrypted-file.sops.yaml
name: variable_to_store_contents_in
- name: Load variables from file into global namespace, and evaluate Jinja2 expressions
community.sops.load_vars:
file: path/to/sops-encrypted-file-with-jinja2-expressions.sops.yaml
# The following allows to use Jinja2 expressions in the encrypted file!
# They are evaluated right now, i.e. not later like when loaded with include_vars.
expressions: evaluate-on-load
```
### sops_encrypt module
The `sops_encrypt` module can be used to create and update SOPS-encrypted files. It assumes that SOPS is configured via environment variables or a `.sops.yaml` file.
Examples:
```yaml
tasks:
- name: Store secret text SOPS-encrypted
community.sops.sops_encrypt:
path: path/to/sops-encrypted-file.sops
content_text: This is some secret text.
- name: Store secret binary data SOPS-encrypted
community.sops.sops_encrypt:
path: path/to/sops-encrypted-file.sops
content_binary: "{{ some_secret_binary_data | b64encode }}"
- name: Store secret JSON data
community.sops.sops_encrypt:
path: path/to/sops-encrypted-file.sops.json
content_json:
key1: value1
key2:
- value2
- key3: value3
key4: value5
- name: Store secret YAML data
community.sops.sops_encrypt:
path: path/to/sops-encrypted-file.sops.yaml
content_yaml:
key1: value1
key2:
- value2
- key3: value3
key4: value5
```
## Troubleshooting
### Spurious failures during encryption and decryption with gpg
Older versions of SOPS calls `gpg` with `--use-agent`. When running multiple of these in parallel, for example when loading variables or looking up files for various hosts at once, some of these can randomly fail with messages such as
```
Failed to get the data key required to decrypt the SOPS file.
Group 0: FAILED
D13xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: FAILED
- | could not decrypt data key with PGP key:
| golang.org/x/crypto/openpgp error: Reading PGP message
| failed: openpgp: incorrect key; GPG binary error: exit
| status 2
828xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: FAILED
- | could not decrypt data key with PGP key:
| golang.org/x/crypto/openpgp error: Reading PGP message
| failed: openpgp: incorrect key; GPG binary error: exit
| status 2
Recovery failed because no master key was able to decrypt the file. In
order for SOPS to recover the file, at least one key has to be successful,
but none were.
```
This is a limitation of gpg-agent which can be fixed by adding `auto-expand-secmem` to `~/.gnupg/gpg-agent.conf` ([reference on option](https://www.gnupg.org/documentation/manuals/gnupg/Agent-Options.html#index-ssh_002dfingerprint_002ddigest), [reference on config file](https://www.gnupg.org/documentation/manuals/gnupg/Agent-Configuration.html)).
(See https://github.com/ansible-collections/community.sops/issues/34 and https://dev.gnupg.org/T4146 for more details.)
## Contributing to this collection
<!--Describe how the community can contribute to your collection. At a minimum, include how and where users can create issues to report problems or request features for this collection. List contribution requirements, including preferred workflows and necessary testing, so you can benefit from community PRs. If you are following general Ansible contributor guidelines, you can link to - [Ansible Community Guide](https://docs.ansible.com/ansible/latest/community/index.html). -->
See [CONTRIBUTING.md](https://github.com/ansible-collections/community.sops/blob/main/CONTRIBUTING.md)
## Release notes
See [CHANGELOG.md](https://github.com/ansible-collections/community.sops/blob/main/CHANGELOG.md).
## Releasing, Versioning and Deprecation
This collection follows [Semantic Versioning](https://semver.org/). More details on versioning can be found [in the Ansible docs](https://docs.ansible.com/ansible/latest/dev_guide/developing_collections.html#collection-versions).
We plan to regularly release new minor or bugfix versions once new features or bugfixes have been implemented.
Releasing the current major version happens from the `main` branch. We will create a `stable-1` branch for 1.x.y versions once we start working on a 2.0.0 release, to allow backporting bugfixes and features from the 2.0.0 branch (`main`) to `stable-1`. A `stable-2` branch will be created once we work on a 3.0.0 release, and so on.
We currently are not planning any deprecations or new major releases like 2.0.0 containing backwards incompatible changes. If backwards incompatible changes are needed, we plan to deprecate the old behavior as early as possible. We also plan to backport at least bugfixes for the old major version for some time after releasing a new major version. We will not block community members from backporting other bugfixes and features from the latest stable version to older release branches, under the condition that these backports are of reasonable quality.
## More information
<!-- List out where the user can find additional information, such as working group meeting times, slack/IRC channels, or documentation for the product this collection automates. At a minimum, link to: -->
- [Ansible Collection overview](https://github.com/ansible-collections/overview)
- [Ansible User guide](https://docs.ansible.com/ansible/latest/user_guide/index.html)
- [Ansible Developer guide](https://docs.ansible.com/ansible/latest/dev_guide/index.html)
## Licensing
This collection is primarily licensed and distributed as a whole under the GNU General Public License v3.0 or later.
See [LICENSES/GPL-3.0-or-later.txt](https://github.com/ansible-collections/community.sops/blob/main/COPYING) for the full text.
Parts of the collection are licensed under the [BSD 2-Clause license](https://github.com/ansible-collections/community.sops/blob/main/LICENSES/BSD-2-Clause.txt).
All files have a machine readable `SDPX-License-Identifier:` comment denoting its respective license(s) or an equivalent entry in an accompanying `.license` file. Only changelog fragments (which will not be part of a release) are covered by a blanket statement in `REUSE.toml`. This conforms to the [REUSE specification](https://reuse.software/spec/).

11
ansible_collections/community/sops/REUSE.toml Normal file
View file

@ -0,0 +1,11 @@
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
version = 1
[[annotations]]
path = "changelogs/fragments/**"
precedence = "aggregate"
SPDX-FileCopyrightText = "Ansible Project"
SPDX-License-Identifier = "GPL-3.0-or-later"

355
ansible_collections/community/sops/antsibull-nox.toml Normal file
View file

@ -0,0 +1,355 @@
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
[collection_sources]
"community.internal_test_tools" = "git+https://github.com/ansible-collections/community.internal_test_tools.git,main"
"community.general" = "git+https://github.com/ansible-collections/community.general.git,main"
[collection_sources_per_ansible.'2.15']
# community.general's main branch needs ansible-core >= 2.16
"community.general" = "git+https://github.com/ansible-collections/community.general.git,stable-10"
[collection_sources_per_ansible.'2.16']
# community.general's main branch needs ansible-core >= 2.17
"community.general" = "git+https://github.com/ansible-collections/community.general.git,stable-11"
[vcs]
vcs = "git"
development_branch = "main"
stable_branches = [ "stable-*" ]
[sessions]
[sessions.lint]
run_isort = false
run_black = false
run_flake8 = false
run_pylint = false
run_yamllint = true
yamllint_config = ".yamllint"
yamllint_config_plugins = ".yamllint-docs"
yamllint_config_plugins_examples = ".yamllint-examples"
yamllint_config_extra_docs = ".yamllint-extra-docs"
run_mypy = false
[sessions.docs_check]
validate_collection_refs="all"
codeblocks_restrict_types = [
"ansible-output",
"console",
"ini",
"yaml",
"yaml+jinja",
]
codeblocks_restrict_type_exact_case = true
codeblocks_allow_without_type = false
codeblocks_allow_literal_blocks = false
[sessions.license_check]
[sessions.extra_checks]
run_no_unwanted_files = true
no_unwanted_files_module_extensions = [".py"]
no_unwanted_files_yaml_extensions = [".yml"]
run_action_groups = true
run_no_trailing_whitespace = true
run_avoid_characters = true
[[sessions.extra_checks.avoid_character_group]]
name = "tab"
regex = "\\x09"
skip_extensions = [
".json",
]
skip_directories = [
"tests/integration/targets/filter_decrypt/files/",
"tests/integration/targets/lookup_sops/files/",
"tests/integration/targets/sops_encrypt/files/",
]
[sessions.build_import_check]
run_galaxy_importer = true
[sessions.ansible_test_sanity]
include_devel = true
[sessions.ansible_test_integration]
[sessions.ansible_test_integration.ansible_vars]
github_token = { type = "env", name = "GITHUB_TOKEN", unset_if_not_set = true }
[[sessions.ansible_test_integration.groups]]
session_name = "ansible-test-integration-main"
description = "Meta-session for all ansible-test-integration-main-* sessions."
session_name_template = "ansible-test-integration-main-{ansible_core}{dash_docker_short}{dash_override_sops_version}{dash_gha_arm_lower}"
display_name_template = "main+Ⓐ{ansible_core}+SOPS-{override_sops_version}{plus_docker_short}{plus_py_python_version}{plus_gha_arm}"
description_template = "Run main integration tests with ansible-core {ansible_core}, {docker_short}, SOPS {override_sops_version}{comma_gha_arm}"
target = "gha/main/"
gha_container = "ubuntu-latest"
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = ["ubuntu2204", "ubuntu2404", "fedora42"]
ansible_vars = { override_sops_version = "3.5.0" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = ["ubuntu2204", "ubuntu2404", "fedora42"]
ansible_vars = { override_sops_version = "3.6.1" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = ["ubuntu2204", "ubuntu2404", "fedora42"]
ansible_vars = { override_sops_version = "3.7.3" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = ["ubuntu2204", "ubuntu2404", "fedora42"]
ansible_vars = { override_sops_version = "3.8.1" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = ["ubuntu2204", "ubuntu2404", "fedora42"]
ansible_vars = { override_sops_version = "3.9.3" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = ["ubuntu2204", "ubuntu2404", "fedora42"]
ansible_vars = { override_sops_version = "3.11.0" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.15"
docker = "ubuntu2004"
ansible_vars = { override_sops_version = "3.10.0" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.15"
docker = "ubuntu2204"
ansible_vars = { override_sops_version = "3.6.0" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.15"
docker = "quay.io/ansible-community/test-image:debian-bullseye"
python_version = "3.9"
ansible_vars = { override_sops_version = "latest" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.16"
docker = "ubuntu2004"
ansible_vars = { override_sops_version = "3.7.0" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.16"
docker = "ubuntu2204"
ansible_vars = { override_sops_version = "3.7.3" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.17"
docker = "ubuntu2204"
ansible_vars = { override_sops_version = "3.8.0" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.17"
docker = "fedora39"
ansible_vars = { override_sops_version = "3.10.1" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.18"
docker = "ubuntu2404"
ansible_vars = { override_sops_version = "3.9.0" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.18"
docker = "fedora40"
ansible_vars = { override_sops_version = "3.9.2" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.19"
docker = "ubuntu2404"
ansible_vars = { override_sops_version = "3.10.0" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.19"
docker = "fedora41"
ansible_vars = { override_sops_version = "3.10.2" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "ubuntu2204"
ansible_vars = { override_sops_version = "3.6.0" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "ubuntu2204"
ansible_vars = { override_sops_version = "3.7.0" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "ubuntu2404"
ansible_vars = { override_sops_version = "3.9.1" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "quay.io/ansible-community/test-image:archlinux"
python_version = "3.13"
ansible_vars = { override_sops_version = "latest" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "quay.io/ansible-community/test-image:debian-bookworm"
python_version = "3.11"
ansible_vars = { override_sops_version = "latest" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "quay.io/ansible-community/test-image:debian-13-trixie"
python_version = "3.13"
ansible_vars = { override_sops_version = "latest" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "ubuntu2404"
gha_container = "ubuntu-24.04-arm"
ansible_vars = { override_sops_version = "latest" }
[[sessions.ansible_test_integration.groups]]
session_name = "ansible-test-integration-install-1"
description = "Meta-session for all ansible-test-integration-install-1-* sessions."
session_name_template = "ansible-test-integration-install-1-{ansible_core}{dash_docker_short}{dash_gha_arm_lower}"
display_name_template = "install-1+Ⓐ{ansible_core}{plus_docker_short}{plus_py_python_version}{plus_gha_arm}"
description_template = "Run install role integration tests (specific SOPS version) with ansible-core {ansible_core}, {docker_short}{comma_gha_arm}"
target = "gha/install/1/"
gha_container = "ubuntu-latest"
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.17"
docker = ["ubuntu2204", "fedora39"]
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.18"
docker = ["ubuntu2404", "fedora40"]
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.19"
docker = ["ubuntu2404", "fedora41"]
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "ubuntu2404"
gha_container = "ubuntu-24.04-arm"
ansible_vars = { github_latest_detection = "auto" }
[[sessions.ansible_test_integration.groups]]
session_name = "ansible-test-integration-install-2"
description = "Meta-session for all ansible-test-integration-install-2-* sessions."
session_name_template = "ansible-test-integration-install-2-{ansible_core}{dash_docker_short}{dash_gha_arm_lower}"
display_name_template = "install-2+Ⓐ{ansible_core}{plus_docker_short}{plus_py_python_version}{plus_gha_arm}"
description_template = "Run install role integration tests (localhost vs. remote host) with ansible-core {ansible_core}, {docker_short}{comma_gha_arm}"
target = "gha/install/2/"
gha_container = "ubuntu-latest"
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "ubuntu2204"
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "ubuntu2204"
gha_container = "ubuntu-24.04-arm"
ansible_vars = { github_latest_detection = "auto" }
[[sessions.ansible_test_integration.groups]]
session_name = "ansible-test-integration-install-3"
description = "Meta-session for all ansible-test-integration-install-3-* sessions."
session_name_template = "ansible-test-integration-install-3-{ansible_core}{dash_docker_short}{dash_gha_arm_lower}"
display_name_template = "install-3+Ⓐ{ansible_core}{plus_docker_short}{plus_py_python_version}{plus_gha_arm}"
description_template = "Run install role integration tests (latest SOPS version) with ansible-core {ansible_core}, {docker_short}{comma_gha_arm}"
target = "gha/install/3/"
gha_container = "ubuntu-latest"
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "quay.io/ansible-community/test-image:archlinux"
python_version = "3.13"
ansible_vars = { github_latest_detection = "auto" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "quay.io/ansible-community/test-image:debian-13-trixie"
python_version = "3.13"
ansible_vars = { github_latest_detection = "auto" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "quay.io/ansible-community/test-image:debian-bookworm"
python_version = "3.11"
ansible_vars = { github_latest_detection = "auto" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.16"
docker = "quay.io/ansible-community/test-image:debian-bullseye"
python_version = "3.9"
ansible_vars = { github_latest_detection = "auto" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.19"
docker = "fedora41"
ansible_vars = { github_latest_detection = "auto" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "fedora42"
ansible_vars = { github_latest_detection = "auto" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "ubuntu2204"
ansible_vars = { github_latest_detection = "api" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "ubuntu2404"
ansible_vars = { github_latest_detection = "latest-release" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "2.19"
docker = "alpine321"
ansible_vars = { github_latest_detection = "auto" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "alpine322"
ansible_vars = { github_latest_detection = "auto" }
[[sessions.ansible_test_integration.groups.sessions]]
ansible_core = "devel"
docker = "alpine322"
gha_container = "ubuntu-24.04-arm"
ansible_vars = { github_latest_detection = "auto" }
[[sessions.ee_check.execution_environments]]
name = "devel-ubi-9"
description = "ansible-core devel @ RHEL UBI 9"
test_playbooks = ["tests/ee/all.yml"]
config.images.base_image.name = "docker.io/redhat/ubi9:latest"
config.dependencies.ansible_core.package_pip = "https://github.com/ansible/ansible/archive/devel.tar.gz"
config.dependencies.ansible_runner.package_pip = "ansible-runner"
config.dependencies.python_interpreter.package_system = "python3.12 python3.12-pip python3.12-wheel python3.12-cryptography"
config.dependencies.python_interpreter.python_path = "/usr/bin/python3.12"
config.additional_build_steps.append_final = [
"RUN ansible-playbook -v community.sops.install_localhost",
]
runtime_environment = {"ANSIBLE_PRIVATE_ROLE_VARS" = "true"}
[[sessions.ee_check.execution_environments]]
name = "2.15-rocky-9"
description = "ansible-core 2.15 @ Rocky Linux 9"
test_playbooks = ["tests/ee/all.yml"]
config.images.base_image.name = "quay.io/rockylinux/rockylinux:9"
config.dependencies.ansible_core.package_pip = "https://github.com/ansible/ansible/archive/stable-2.15.tar.gz"
config.dependencies.ansible_runner.package_pip = "ansible-runner"
config.additional_build_steps.append_final = [
"RUN ansible-playbook -v community.sops.install_localhost",
]
runtime_environment = {"ANSIBLE_PRIVATE_ROLE_VARS" = "true"}

606
ansible_collections/community/sops/changelogs/changelog.yaml Normal file
View file

@ -0,0 +1,606 @@
---
ancestor: null
releases:
0.1.0:
changes:
release_summary: 'First release of the ``community.sops`` collection!
This release includes multiple plugins: an ``action`` plugin, a ``lookup``
plugin and a ``vars`` plugin.'
fragments:
- 0.1.0.yml
modules:
- description: Load sops-encrypted variables from files, dynamically within
a task
name: load_vars
namespace: ''
- description: Encrypt data with sops
name: sops_encrypt
namespace: ''
plugins:
lookup:
- description: Read sops encrypted file contents
name: sops
namespace: null
vars:
- description: Loading sops-encrypted vars files
name: sops
namespace: null
release_date: '2020-10-23'
0.2.0:
changes:
minor_changes:
- community.sops.sops lookup plugin - add ``empty_on_not_exist`` option which
allows to return an empty string instead of an error when the file does
not exist (https://github.com/ansible-collections/community.sops/pull/33).
- community.sops.sops vars plugin - add option to control caching (https://github.com/ansible-collections/community.sops/pull/32).
- community.sops.sops vars plugin - add option to determine when vars are
loaded (https://github.com/ansible-collections/community.sops/pull/32).
release_summary: This release adds features for the lookup and vars plugins.
fragments:
- 0.2.0.yml
- 32-vars-stage.yml
- 33-lookup-empty_on_not_exist.yml
release_date: '2020-12-16'
1.0.0:
changes:
minor_changes:
- 'All plugins and modules: allow to pass generic sops options with new options
``config_path``, ``enable_local_keyservice``, ``keyservice``. Also allow
to pass AWS parameters with options ``aws_profile``, ``aws_access_key_id``,
``aws_secret_access_key``, and ``aws_session_token`` (https://github.com/ansible-collections/community.sops/pull/47).'
- community.sops.sops_encrypt - allow to pass encryption-specific options
``kms``, ``gcp_kms``, ``azure_kv``, ``hc_vault_transit``, ``pgp``, ``unencrypted_suffix``,
``encrypted_suffix``, ``unencrypted_regex``, ``encrypted_regex``, ``encryption_context``,
and ``shamir_secret_sharing_threshold`` to sops (https://github.com/ansible-collections/community.sops/pull/47).
release_summary: First stable release. This release is expected to be included
in Ansible 3.0.0.
fragments:
- 1.0.0.yml
- 47-sops-options.yml
release_date: '2021-01-14'
1.0.1:
changes:
release_summary: Re-release of 1.0.0 to counteract error during release.
release_date: '2021-01-14'
1.0.2:
changes:
release_summary: Fix of 1.0.1 release which had no changelog entry.
fragments:
- 1.0.2.yml
release_date: '2021-01-14'
1.0.3:
changes:
bugfixes:
- community.sops.sops lookup plugins - fix wrong format of Ansible variables
so that these are actually used (https://github.com/ansible-collections/community.sops/pull/51).
- community.sops.sops vars plugins - remove non-working Ansible variables
(https://github.com/ansible-collections/community.sops/pull/51).
release_summary: This release include some fixes to Ansible docs and required
changes for inclusion in Ansible.
fragments:
- 1.0.3.yml
- 51-fix-vars-arguments.yml
release_date: '2021-01-22'
1.0.4:
changes:
release_summary: This is a security release, fixing a potential information
leak in the ``community.sops.sops_encrypt`` module.
security_fixes:
- community.sops.sops_encrypt - mark the ``aws_secret_access_key`` and ``aws_session_token``
parameters as ``no_log`` to avoid leakage of secrets (https://github.com/ansible-collections/community.sops/pull/54).
fragments:
- 1.0.4.yml
- 54-no_log-fixes.yml
release_date: '2021-02-06'
1.0.5:
changes:
bugfixes:
- community.sops.sops_encrypt - use output type ``yaml`` when path ends with
``.yaml`` (https://github.com/ansible-collections/community.sops/pull/56).
release_summary: This release fixes a bug that prevented correct YAML file to
be created when the output was ending in ``.yaml``.
fragments:
- 1.0.5.yml
- 56-sops_encrypt-yaml-output.yaml
release_date: '2021-03-05'
1.0.6:
changes:
bugfixes:
- action_module plugin helper - make compatible with latest changes in ansible-core
2.11.0b3 (https://github.com/ansible-collections/community.sops/pull/58).
- community.sops.load_vars - make compatible with latest changes in ansible-core
2.11.0b3 (https://github.com/ansible-collections/community.sops/pull/58).
release_summary: This release makes the collection compatible to the latest
beta release of ansible-core 2.11.
fragments:
- 1.0.6.yml
- 58-actionmodule-plugin-utils-ansible-core-2.11.yml
release_date: '2021-03-21'
1.1.0:
changes:
minor_changes:
- Avoid internal ansible-core module_utils in favor of equivalent public API
available since at least Ansible 2.9 (https://github.com/ansible-collections/community.sops/pull/73).
release_summary: A minor release for inclusion in Ansible 4.2.0.
fragments:
- 1.1.0.yml
- 71-decrypt-filter.yml
- ansible-core-_text.yml
plugins:
filter:
- description: Decrypt sops-encrypted data
name: decrypt
namespace: null
release_date: '2021-06-29'
1.2.0:
changes:
bugfixes:
- Fix error handling in calls of the ``sops`` binary when negative errors
are returned (https://github.com/ansible-collections/community.sops/issues/82,
https://github.com/ansible-collections/community.sops/pull/83).
minor_changes:
- sops lookup and vars plugin - allow to configure almost all generic options
by ansible.cfg entries and environment variables (https://github.com/ansible-collections/community.sops/pull/81).
release_summary: 'Collection release for inclusion in Ansible 4.9.0 and 5.1.0.
This release contains a change allowing to configure generic plugin options
with ansible.cfg keys and env variables.'
fragments:
- 1.2.0.yml
- 81-plugin-options.yml
- 83-fix-error-handling.yml
release_date: '2021-11-16'
1.2.1:
changes:
release_summary: Maintenance release with updated documentation.
fragments:
- 1.2.1.yml
release_date: '2022-03-22'
1.2.2:
changes:
bugfixes:
- Include ``simplified_bsd.txt`` license file for the ``sops`` module utils.
release_summary: Maintenance release.
fragments:
- 1.2.2.yml
- simplified-bsd-license.yml
release_date: '2022-06-02'
1.2.3:
changes:
release_summary: Fix formatting bug in documentation. No code changes.
fragments:
- 1.2.3.yml
release_date: '2022-06-29'
1.3.0:
changes:
minor_changes:
- All software licenses are now in the ``LICENSES/`` directory of the collection
root, and the collection repository conforms to the `REUSE specification
<https://reuse.software/spec/>`__ except for the changelog fragments (https://github.com/ansible-collections/community.crypto/sops/108,
https://github.com/ansible-collections/community.sops/pull/113).
- sops vars plugin - added a configuration option to temporarily disable the
vars plugin (https://github.com/ansible-collections/community.sops/pull/114).
release_summary: Feature release.
fragments:
- 1.3.0.yml
- 108-licenses.yml
- 114-disable-vars-plugin.yml
release_date: '2022-08-23'
1.4.0:
changes:
minor_changes:
- Allow to specify age keys as ``age_key``, or age keyfiles as ``age_keyfile``
(https://github.com/ansible-collections/community.sops/issues/116, https://github.com/ansible-collections/community.sops/pull/117).
- sops_encrypt - allow to specify age recipients (https://github.com/ansible-collections/community.sops/issues/116,
https://github.com/ansible-collections/community.sops/pull/117).
release_summary: Feature release.
fragments:
- 1.4.0.yml
- 117-age.yml
release_date: '2022-09-11'
1.4.1:
changes:
bugfixes:
- load_vars - ensure compatibility with newer versions of ansible-core (https://github.com/ansible-collections/community.sops/pull/121).
release_summary: Maintenance release to improve compatibility with future ansible-core
releases.
fragments:
- 1.4.1.yml
- 121-action-module-compat.yml
release_date: '2022-09-23'
1.5.0:
changes:
minor_changes:
- Automatically install GNU Privacy Guard (GPG) in execution environments.
To install Mozilla sops a manual step needs to be added to the EE definition,
see the collection's documentation for details (https://github.com/ansible-collections/community.sops/pull/98).
release_summary: Feature release.
fragments:
- 1.5.0.yml
- 98-playbooks.yml
objects:
playbook:
- description: Installs sops and GNU Privacy Guard on all remote hosts
name: install
namespace: null
- description: Installs sops and GNU Privacy Guard on localhost
name: install_localhost
namespace: null
role:
- description: Install Mozilla sops
name: install
namespace: null
release_date: '2022-12-02'
1.6.0:
changes:
minor_changes:
- install role - add ``sops_github_latest_detection`` option that allows to
configure which method to use for detecting the latest release on GitHub.
By default (``auto``) first tries to retrieve a list of recent releases
using the API, and if that fails due to rate limiting, tries to obtain the
latest GitHub release from a semi-documented URL (https://github.com/ansible-collections/community.sops/pull/133).
- install role - add ``sops_github_token`` option to allow passing a GitHub
token. This can for example be used to avoid rate limits when using the
role in GitHub Actions (https://github.com/ansible-collections/community.sops/pull/132).
- install role - implement another method to determine the latest release
on GitHub than using the GitHub API, which can make installation fail due
to rate-limiting (https://github.com/ansible-collections/community.sops/pull/131).
release_summary: Feature release improving the installation role.
fragments:
- 1.6.0.yml
- 131.yml
- 132.yml
- 133.yml
release_date: '2023-01-01'
1.6.1:
changes:
bugfixes:
- action plugin helper - fix handling of deprecations for ansible-core 2.14.2
(https://github.com/ansible-collections/community.sops/pull/136).
- various plugins - remove unnecessary imports (https://github.com/ansible-collections/community.sops/pull/133).
release_summary: Maintenance release.
fragments:
- 1.6.1.yml
- 136-action-module.yml
- remove-unneeded-imports.yml
release_date: '2023-02-20'
1.6.2:
changes:
bugfixes:
- install role - make sure that the ``pkg_mgr`` fact is definitely available
when installing on ``localhost``. This can improve error messages in some
cases (https://github.com/ansible-collections/community.sops/issues/145,
https://github.com/ansible-collections/community.sops/pull/146).
release_summary: Maintenance release.
fragments:
- 1.6.2.yml
- 146-install-facts.yml
release_date: '2023-06-15'
1.6.3:
changes:
known_issues:
- Ansible markup will show up in raw form on ansible-doc text output for ansible-core
before 2.15. If you have trouble deciphering the documentation markup, please
upgrade to ansible-core 2.15 (or newer), or read the HTML documentation
on https://docs.ansible.com/ansible/devel/collections/community/sops/.
release_summary: 'Maintenance release with updated documentation.
From this version on, community.sops is using the new `Ansible semantic markup
<https://docs.ansible.com/ansible/devel/dev_guide/developing_modules_documenting.html#semantic-markup-within-module-documentation>`__
in its documentation. If you look at documentation with the ansible-doc CLI
tool
from ansible-core before 2.15, please note that it does not render the markup
correctly. You should be still able to read it in most cases, but you need
ansible-core 2.15 or later to see it as it is intended. Alternatively you
can
look at `the devel docsite <https://docs.ansible.com/ansible/devel/collections/community/sops/>`__
for the rendered HTML version of the documentation of the latest release.
'
fragments:
- 1.6.3.yml
- semantic-markup.yml
release_date: '2023-06-27'
1.6.4:
changes:
bugfixes:
- install role - fix ``sops_github_latest_detection=latest-release``, which
broke due to sops moving to another GitHub organization (https://github.com/ansible-collections/community.sops/pull/151).
release_summary: Maintenance/bugfix release for the move of sops to the new
`getsops GitHub organization <https://github.com/getsops>`__.
fragments:
- 1.6.4.yml
- 151-github.yml
release_date: '2023-06-30'
1.6.5:
changes:
bugfixes:
- Avoid pre-releases when picking the latest version when using the GitHub
API method (https://github.com/ansible-collections/community.sops/pull/159).
- Fix changed DEB and RPM URLs for 3.8.0 and its prerelease(s) (https://github.com/ansible-collections/community.sops/pull/159).
release_summary: Make compatible with and test against sops 3.8.0-rc.1.
fragments:
- 1.6.5.yml
- 159-new-releases.yml
release_date: '2023-08-25'
1.6.6:
changes:
bugfixes:
- Fix RPM URL for the 3.8.0 release (https://github.com/ansible-collections/community.sops/pull/161).
release_summary: Make fully compatible with and test against sops 3.8.0.
fragments:
- 1.6.6.yml
- 161-rhel-3.8.0.yml
release_date: '2023-09-15'
1.6.7:
changes:
bugfixes:
- sops_encrypt - ensure that output-type is set to ``yaml`` when the file
extension ``.yml`` is used. Now both ``.yaml`` and ``.yml`` files use the
SOPS ``--output-type=yaml`` formatting (https://github.com/ansible-collections/community.sops/issues/164).
release_summary: Bugfix release.
fragments:
- 1.6.7.yml
- 165-yaml-output-for-yml-extension.yaml
release_date: '2023-10-29'
1.7.0:
changes:
bugfixes:
- Fix RPM URL for the 3.9.0 release (https://github.com/ansible-collections/community.sops/pull/188).
minor_changes:
- sops vars plugin - allow to configure the valid extensions with an ``ansible.cfg``
entry or with an environment variable (https://github.com/ansible-collections/community.sops/pull/185).
release_summary: Bugfix and feature release to fix installation issues with
SOPS 3.9.0.
fragments:
- 1.7.0.yml
- 185-vars-valid-extensions.yml
- 188-sops-3.9.0.yml
release_date: '2024-06-28'
1.8.0:
changes:
bugfixes:
- sops_encrypt - properly support ``path_regex`` in ``.sops.yaml`` when SOPS
3.9.0 or later is used (https://github.com/ansible-collections/community.sops/issues/153,
https://github.com/ansible-collections/community.sops/pull/190).
minor_changes:
- Detect SOPS 3.9.0 and use new ``decrypt`` and ``encrypt`` subcommands (https://github.com/ansible-collections/community.sops/pull/190).
- sops vars plugin - new option ``handle_unencrypted_files`` allows to control
behavior when encountering unencrypted files with SOPS 3.9.0+ (https://github.com/ansible-collections/community.sops/pull/190).
release_summary: Feature release for supporting improvements coming with SOPS
3.9.0.
fragments:
- 1.8.0.yml
- 190-sops-3.9.0.yml
release_date: '2024-07-09'
1.8.1:
changes:
bugfixes:
- Pass ``config_path`` on SOPS 3.9.0 before the subcommand instead of after
it (https://github.com/ansible-collections/community.sops/issues/195, https://github.com/ansible-collections/community.sops/pull/197).
release_summary: Bugfix release.
fragments:
- 1.8.1.yml
- 197-sops-3.9.0-order.yml
release_date: '2024-07-18'
1.8.2:
changes:
deprecated_features:
- The collection deprecates support for all Ansible/ansible-base/ansible-core
versions that are currently End of Life, `according to the ansible-core
support matrix <https://docs.ansible.com/ansible-core/devel/reference_appendices/release_and_maintenance.html#ansible-core-support-matrix>`__.
This means that the next major release of the collection will no longer
support Ansible 2.9, ansible-base 2.10, ansible-core 2.11, ansible-core
2.12, ansible-core 2.13, and ansible-core 2.14.
release_summary: Maintenance release with updated documentation and changelog.
fragments:
- 1.8.2.yml
- deprecate-eol-ansible-core.yml
release_date: '2024-08-13'
1.9.0:
changes:
minor_changes:
- decrypt filter plugin - now supports the input and output type ``ini`` (https://github.com/ansible-collections/community.sops/pull/204).
- sops lookup plugin - new option ``extract`` allows extracting a single key
out of a JSON or YAML file, equivalent to sops' ``decrypt --extract`` (https://github.com/ansible-collections/community.sops/pull/200).
- sops lookup plugin - now supports the input and output type ``ini`` (https://github.com/ansible-collections/community.sops/pull/204).
release_summary: Feature release.
fragments:
- 1.9.0.yml
- 200-lookup-extract.yaml
- 204-input-output-type-ini.yml
release_date: '2024-09-09'
1.9.1:
changes:
bugfixes:
- sops_encrypt - pass absolute paths to ``module.atomic_move()`` (https://github.com/ansible/ansible/issues/83950,
https://github.com/ansible-collections/community.sops/pull/208).
release_summary: Bugfix release.
fragments:
- 1.9.1.yml
- 208-atomic.yml
release_date: '2024-10-04'
2.0.0:
changes:
release_summary: Major verison that drops support for End of Life Ansible/ansible-base/ansible-core
versions.
removed_features:
- The collection no longer supports Ansible 2.9, ansible-base 2.10, ansible-core
2.11, ansible-core 2.12, ansible-core 2.13, and ansible-core 2.14. If you
need to continue using End of Life versions of Ansible/ansible-base/ansible-core,
please use community.sops 1.x.y (https://github.com/ansible-collections/community.sops/pull/206).
fragments:
- 2.0.0.yml
release_date: '2024-10-20'
2.0.1:
changes:
release_summary: Maintenance release with updated documentation.
fragments:
- 2.0.1.yml
release_date: '2024-12-31'
2.0.2:
changes:
bugfixes:
- install role - when used with Debian on ARM architecture, the architecture
name is now correctly translated from ``aarch64`` to ``arm64`` (https://github.com/ansible-collections/community.sops/issues/220,
https://github.com/ansible-collections/community.sops/pull/221).
release_summary: Bugfix release.
fragments:
- 2.0.2.yml
- 221-install-architecture.yml
release_date: '2025-02-09'
2.0.3:
changes:
bugfixes:
- install role - ``sops_install_on_localhost=false`` was not working properly
if the role was running on more than one host due to a bug in ansible-core
(https://github.com/ansible-collections/community.sops/issues/223, https://github.com/ansible-collections/community.sops/pull/224).
release_summary: Bugfix release.
fragments:
- 2.0.3.yml
- 224-install.yml
release_date: '2025-03-03'
2.0.4:
changes:
bugfixes:
- load_vars - make evaluation compatible with Data Tagging in upcoming ansible-core
release (https://github.com/ansible-collections/community.sops/pull/225).
release_summary: Maintenance release with Data Tagging support.
fragments:
- 2.0.4.yml
- 225-data-tagging.yml
release_date: '2025-04-14'
2.0.5:
changes:
release_summary: Maintenance release with updated SOPS version test coverage.
fragments:
- 2.0.5.yml
release_date: '2025-04-21'
2.1.0:
changes:
minor_changes:
- Now supports specifying SSH private keys for age with the new ``age_ssh_private_keyfile``
option (https://github.com/ansible-collections/community.sops/pull/241).
release_summary: Feature release.
fragments:
- 2.1.0.yml
- 241-support-ssh-keys-for-age.yaml
release_date: '2025-06-14'
2.2.0:
changes:
minor_changes:
- load_vars - expressions can now be lazily evaluated when using ansible-core
2.19 or newer (https://github.com/ansible-collections/community.sops/pull/229).
release_summary: Feature release.
fragments:
- 2.2.0.yml
- 229-lazy-evaluation.yml
release_date: '2025-07-21'
2.2.1:
changes:
bugfixes:
- install role - avoid deprecated parameter value for the ``ansible.builtin.uri``
module (https://github.com/ansible-collections/community.sops/pull/255).
release_summary: Bugfix release.
fragments:
- 2.2.1.yml
- 255-install-redirects.yml
release_date: '2025-08-03'
2.2.2:
changes:
bugfixes:
- Avoid deprecated functionality in ansible-core 2.20 (https://github.com/ansible-collections/community.sops/pull/260).
- all modules and plugins - the default of ``enable_local_keyservice`` changed
from ``false`` to ``true``, and explicitly setting it to ``false`` now passes
``--enable-local-keyservice=false``. SOPS' default has always been ``true``,
and when setting this option to ``true`` so far it resulted in passing ``--enable-local-keyservice``,
which is equivalent to ``--enable-local-keyservice=true`` and had no effect.
This means that from now on, setting ``enable_local_keyservice`` explicitly
to ``false`` has an effect. If ``enable_local_keyservice`` was not set before,
or was set to ``true``, nothing will change (https://github.com/ansible-collections/community.sops/issues/261,
https://github.com/ansible-collections/community.sops/pull/262).
release_summary: Bugfix release.
fragments:
- 2.2.2.yml
- 260-deprecations.yml
- 262-local-keyservice.yml
release_date: '2025-08-31'
2.2.3:
changes:
bugfixes:
- Avoid using ``ansible.module_utils.six`` to avoid deprecation warnings with
ansible-core 2.20 (https://github.com/ansible-collections/community.sops/pull/268).
minor_changes:
- Note that some new code in ``plugins/module_utils/_six.py`` is MIT licensed
(https://github.com/ansible-collections/community.sops/pull/268).
release_summary: Maintenance release.
fragments:
- 2.2.3.yml
- 268-six.yml
release_date: '2025-10-03'
2.2.4:
changes:
bugfixes:
- Fix accidental type extensions (https://github.com/ansible-collections/community.sops/pull/269).
release_summary: Maintenance release.
fragments:
- 2.2.4.yml
- 269-fix.yml
release_date: '2025-10-05'
2.2.5:
changes:
bugfixes:
- load_vars action - avoid another deprecated module utils from ansible-core
(https://github.com/ansible-collections/community.sops/pull/270).
- load_vars action - avoid deprecated import from ansible-core that will be
removed in ansible-core 2.21 (https://github.com/ansible-collections/community.sops/pull/272).
release_summary: Maintenance release.
fragments:
- 2.2.5.yml
- 270-deprecate.yml
- 272-ansible-core-2.21.yml
release_date: '2025-10-25'
2.2.6:
changes:
bugfixes:
- Clean up plugin code that does not run on the target (https://github.com/ansible-collections/community.sops/pull/275).
- Note that the MIT licenced code in ``plugins/module_utils/_six.py`` has
been removed (https://github.com/ansible-collections/community.sops/pull/275).
- sops vars plugin - ensure that loaded vars are evaluated also with ansible-core
2.19+ (https://github.com/ansible-collections/community.sops/pull/273).
release_summary: Bugfix and maintenance release.
fragments:
- 2.2.6.yml
- 273-vars-eval.yml
- 275-py3.yml
release_date: '2025-10-25'
2.2.7:
changes:
known_issues:
- When using the ``community.sops.load_vars`` with ansible-core 2.20, note
that the deprecation of ``INJECT_FACTS_AS_VARS`` causes deprecation warnings
to be shown every time a variable loaded with ``community.sops.load_vars``
is used. This is due to ansible-core deprecating ``INJECT_FACTS_AS_VARS``
without providing an alternative for modules like ``community.sops.load_vars``
to use. If you do not like these deprecation warnings, you have to explicitly
set ``INJECT_FACTS_AS_VARS`` to ``true``. **DO NOT** change the use of SOPS
encrypted variables to ``ansible_facts``. The situation will hopefully improve
in ansible-core 2.21 through the promised API that allows action plugins
to set variables; community.sops will adapt to use it, which will make the
warning go away. (The API was originally promised for ansible-core 2.20,
but then delayed.)
release_summary: Maintenance release.
fragments:
- 2.2.7.yml
- ansible-core-2.20-warning.yml
release_date: '2025-11-02'

3
ansible_collections/community/sops/changelogs/changelog.yaml.license Normal file
View file

@ -0,0 +1,3 @@
GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
SPDX-License-Identifier: GPL-3.0-or-later
SPDX-FileCopyrightText: Ansible Project

43
ansible_collections/community/sops/changelogs/config.yaml Normal file
View file

@ -0,0 +1,43 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
changelog_filename_template: ../CHANGELOG.rst
changelog_filename_version_depth: 0
changes_file: changelog.yaml
changes_format: combined
ignore_other_fragment_extensions: true
keep_fragments: false
mention_ancestor: true
new_plugins_after_name: removed_features
notesdir: fragments
output_formats:
- rst
- md
prelude_section_name: release_summary
prelude_section_title: Release Summary
sections:
- - major_changes
- Major Changes
- - minor_changes
- Minor Changes
- - breaking_changes
- Breaking Changes / Porting Guide
- - deprecated_features
- Deprecated Features
- - removed_features
- Removed Features (previously deprecated)
- - security_fixes
- Security Fixes
- - bugfixes
- Bugfixes
- - known_issues
- Known Issues
title: Community SOPS
trivial_section_name: trivial
use_fqcn: true
add_plugin_period: true
changelog_nice_yaml: true
changelog_sort: version
vcs: auto

0
ansible_collections/community/sops/changelogs/fragments/.keep Normal file
View file

7
ansible_collections/community/sops/codecov.yml Normal file
View file

@ -0,0 +1,7 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
fixes:
- "ansible_collections/community/sops/::"

7
ansible_collections/community/sops/docs/docsite/config.yml Normal file
View file

@ -0,0 +1,7 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
changelog:
write_changelog: true

9
ansible_collections/community/sops/docs/docsite/extra-docs.yml Normal file
View file

@ -0,0 +1,9 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
sections:
- title: Scenario Guide
toctree:
- guide

33
ansible_collections/community/sops/docs/docsite/links.yml Normal file
View file

@ -0,0 +1,33 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
edit_on_github:
repository: ansible-collections/community.sops
branch: main
path_prefix: ''
extra_links:
- description: Ask for help (SOPS)
url: https://forum.ansible.com/tags/c/help/6/none/sops
- description: Submit a bug report
url: https://github.com/ansible-collections/community.sops/issues/new?assignees=&labels=&template=bug_report.md
- description: Request a feature
url: https://github.com/ansible-collections/community.sops/issues/new?assignees=&labels=&template=feature_request.md
communication:
matrix_rooms:
- topic: General usage and support questions
room: '#users:ansible.im'
irc_channels:
- topic: General usage and support questions
network: Libera
channel: '#ansible'
forums:
- topic: "Ansible Forum: General usage and support questions"
# The following URL directly points to the "Get Help" section
url: https://forum.ansible.com/c/help/6/none
- topic: "Ansible Forum: Discussions about SOPS"
# The following URL directly points to the "sops" tag
url: https://forum.ansible.com/tag/sops

495
ansible_collections/community/sops/docs/docsite/rst/guide.rst Normal file
View file

@ -0,0 +1,495 @@
..
Copyright (c) Ansible Project
GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
SPDX-License-Identifier: GPL-3.0-or-later
.. _ansible_collections.community.sops.docsite.guide:
Protecting Ansible secrets with SOPS
====================================
`CNCF SOPS <https://github.com/getsops/sops>`_ allows to encrypt and decrypt files using various key sources (GPG, AWS KMS, GCP KMS, ...). For structured data, such as YAML, JSON, INI and ENV files, it will encrypt values, but not mapping keys. For YAML files, it also encrypts comments. This makes it a great tool for encrypting credentials with Ansible: you can easily see which files contain which variable, but the variables themselves are encrypted.
The ability to utilize various keysources makes it easier to use in complex environments than :ref:`Ansible Vault <vault_guide_index>`.
.. contents::
:local:
:depth: 1
Installing SOPS
---------------
You can find binaries and packages `on the project's release page <https://github.com/getsops/sops/releases>`_. Depending on your operating system, you might also be able to install it with your system's package manager.
This collection provides a :ansplugin:`role community.sops.install <community.sops.install#role>` which allows to install SOPS and `GNU Privacy Guard (GPG) <https://en.wikipedia.org/wiki/GNU_Privacy_Guard>`__. The role allows to install SOPS from the system's package manager or from GitHub; see :ansopt:`community.sops.install#role:main:sops_source` for details. Both SOPS and GPG can be installed on the remote hosts or the Ansible controller; see :ansopt:`community.sops.install#role:main:sops_install_on_localhost` for details.
.. code-block:: yaml
- name: Playbook to install SOPS
hosts: all
tasks:
# To use the sops_encrypt module on a remote host, you need to install SOPS on it:
- name: Install SOPS on remote hosts
ansible.builtin.include_role:
name: community.sops.install
vars:
sops_version: 2.7.0 # per default installs the latest version
# To use the lookup plugin, filter plugin, vars plugin, or the load_vars action,
# you need SOPS installed on localhost:
- name: Install SOPS on localhost
ansible.builtin.include_role:
name: community.sops.install
vars:
sops_install_on_localhost: true
When using ansible-core 2.11 or later, you can also use two convenience playbooks:
.. code-block:: console
# Install SOPS on Ansible controller
$ ansible-playbook community.sops.install_localhost
# Install SOPS on remote servers
$ ansible-playbook community.sops.install --inventory /path/to/inventory
Installing community.sops in an Execution Environment
-----------------------------------------------------
When building an execution environment containing community.sops, please note that by default SOPS is not automatically installed. This is due to a limitation of the dependency specification system for execution environments. If you are building an execution environment that contains community.sops, you should make sure that SOPS is installed in it.
The simplest way of ensuring this is to use the ``community.sops.install_localhost`` playbook. When defining an execution environment, you can add a ``RUN`` additional build step to your ``execution-environment.yml``:
.. code-block:: yaml
---
version: 3
dependencies:
galaxy: requirements.yml
additional_build_steps:
append_final:
# Ensure that SOPS is installed in the EE, assuming the EE is for ansible-core 2.11 or newer
- RUN ansible-playbook -v community.sops.install_localhost
Note that this only works if the execution environment is built with ansible-core 2.11 or newer. When using an execution environment with Ansible 2.9, you have to use the :ansplugin:`community.sops.install#role` role manually. Also note that you need to make sure that Ansible 2.9 uses the correct Python interpreter to be able to install system packages with; in the below example we are assuming a RHEL/CentOS based execution environment base image:
.. code-block:: yaml
---
version: 3
dependencies:
galaxy: requirements.yml
additional_build_steps:
append_final:
# Special step needed for Ansible 2.9 based EEs
- >-
RUN ansible localhost -m include_role -a name=community.sops.install
-e sops_install_on_localhost=true
-e ansible_python_interpreter=/usr/libexec/platform-python
Once this step has been taken care of, you can use all plugins and modules (on ``localhost``) from community.sops in the execution environment.
Setting up SOPS
---------------
From now on this guide assumes that you have installed SOPS.
For simplicity, you can work with GPG keys. If you do not have one, or do not want to use yours, you can run ``gpg --quick-generate-key me@example.com`` to create a GPG key for the user ID ``me@example.com``. You will need its 40 hex-digit key ID that is printed at the end. The first step is to create a ``.sops.yaml`` file in the directory tree you are working in:
.. code-block:: yaml
creation_rules:
- pgp: 'FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4'
Here, ``FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4`` is the 40 hex-digit key ID. With this file you can create a SOPS-encrypted file by running the following in the directory where ``.sops.yaml`` was placed, or a subdirectory of it:
.. code-block:: console
$ sops test.sops.yaml
This will open an editor window with an example YAML file. Put the following content in:
.. code-block:: yaml
# This is a comment
hello: world
foo:
- bar
- baz
After closing the editor, SOPS will create ``test.sops.yaml`` with the encrypted contents:
.. code-block:: yaml
#ENC[AES256_GCM,data:r6Ok05DzzHBO4tonlz2t49CF,iv:Y0P39iXwaGYU9NG5oRC3NuaGVL40uruSze0CxbDTpTk=,tag:EzoG+X+BJAHbxE0asSyGlQ==,type:comment]
hello: ENC[AES256_GCM,data:onBZqWk=,iv:bwj4bwaeh3vpVDYqY2AnYo1thF955i5vbFpCC1DwJtM=,tag:4qbVzuHTaPrXm64r2Rqz1Q==,type:str]
foo:
- ENC[AES256_GCM,data:UsY8,iv:USv71rKfvbTF+3a5T2WO56wGVu609/0uigqkO0pa6U4=,tag:s8NdqLp+8OOQg4xDfE78oA==,type:str]
- ENC[AES256_GCM,data:Dhmo,iv:qWs5gN2SCXYq0EfGelZhODsdViKB9w2taQMhsqy0D2g=,tag:I+ZFvuxnsvQmywqz+a/M9w==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age: []
lastmodified: "2021-06-15T19:36:34Z"
mac: ENC[AES256_GCM,data:HAvLeOvt7xWI7B5TCeDEsL6sOSzGGeTbgBSJaZkwadmoAm3Ny4IZPF8JAbFaPPLmN8FJVAt4D61aIWa6Xwi3xMj1g6DmxFfgK6JFJqWqW122UlMhqZ/WuMWFV6yVxpTLDXgemndgGDJqUTUi14FMh/MzPDg4f6kFP64kA9fpLrY=,iv:LdhswnMymZG8J9na/jnF3WYnX0DvzvoBlvjUCu4nI6c=,tag:Qt4d7L3FXsgfmg9iOs8P4A==,type:str]
pgp:
- created_at: "2021-06-15T19:36:01Z"
enc: |-
-----BEGIN PGP MESSAGE-----
wcBMAyUpShfNkFB/AQgAT8OAKnWLBQRG3kT5lZCmyoPzK6RwF0zRkwCzJkLNl6xg
nQjUjpD03ZD4FtiRidspXEj7NvCLDghJ0UETtDjmrwsTeJ5YAK/JxouWmoNhVVdF
p0qOlj/THXIV+ypVaqrisZGZiTqeWjUNFuayknvjm3XduOOPZA1MIJ14pQxcgca4
NWmKwPwXTWEy3RJ0ZsnjjjYvKHjHyvbHdbDgARu8R1jEgdNPKPBRVpEY6RNeafXI
gFBVRfrhPKD6HmnmNvjHwUc/K+wOa1ciIYVrT4mPXoyBsFkyV0egh/QRf0JO8+X7
Ut/jEtCrl9BXJCNYGmC5EU3PPiFlAu1MRxlCiPNWltLmASn2w62wMpgih6f+OpI/
zyEOdz0qx80LEfhv3+jBbDfBwz4GqpAHUr0fCXDzeDiKfzlU6isagoIAhJfwX6oG
NeQ47ktk1XhPmgIwxxuvonG14iQoU2cA
=GoXQ
-----END PGP MESSAGE-----
fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4
unencrypted_suffix: _unencrypted
version: 3.7.1
The first line contains the encrypted content. The second line contains the unencrypted key of ``hello: world``, and the encrypted string value ``world``. The next few lines contain the unencrypted key ``foo`` with the encrypted list elements.
At the end, the ``sops`` section contains metadata, which includes the private key needed to decrypt the file encrypted with the public key of the GPG key ID ``FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4``. If you had multiple GPG keys configured, or also other key sources, you can also find the file secret key encrypted with these keys here.
Working with encrypted files
----------------------------
You can decrypt SOPS-encrypted files with the :ansplugin:`community.sops.sops lookup plugin <community.sops.sops#lookup>`, and dynamically encrypt data with the :ansplugin:`community.sops.sops_encrypt module <community.sops.sops_encrypt#module>`. Being able to encrypt is useful when you create or update secrets in your Ansible playbooks.
Assume that you have an encrypted private key ``keys/private_key.pem.sops``, which was in PEM format before being encrypted by SOPS:
.. code-block:: console
$ openssl genrsa -out keys/private_key.pem 2048
$ sops --encrypt keys/private_key.pem > keys/private_key.pem.sops
$ wipe keys/private_key.pem
To use it in a playbook, for example to pass it to the :ansplugin:`community.crypto.openssl_csr module <community.crypto.openssl_csr#module>` to create a certificate signing request (CSR), you can use the :ansplugin:`community.sops.sops lookup plugin <community.sops.sops#lookup>` to load it:
.. code-block:: yaml+jinja
---
- name: Load SOPS-encrypted private key
hosts: localhost
gather_facts: false
tasks:
- name: Create CSR with encrypted private key
community.crypto.openssl_csr:
# The private key is provided with SOPS:
privatekey_content: "{{ lookup('community.sops.sops', 'keys/private_key.pem.sops') }}"
# Store the CSR on disk unencrypted:
path: ansible.com.csr
# This is going to be a CSR for ansible.com and www.ansible.com
subject_alt_name:
- DNS:ansible.com
- DNS:www.ansible.com
use_common_name_for_san: false
This results in the following output:
.. code-block:: ansible-output
PLAY [Load SOPS-encrypted private key] ***************************************************************************
TASK [Create CSR with encrypted private key] *********************************************************************
ok: [localhost]
PLAY RECAP *******************************************************************************************************
localhost : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Afterwards, you will have a CSR ``ansible.com.csr`` for the encrypted private key ``keys/private_key.pem.sops``.
If you want to use Ansible to generate (or update) the encrypted private key, you can use the :ansplugin:`community.crypto.openssl_privatekey_pipe module <community.crypto.openssl_privatekey_pipe#module>` to generate (or update) the private key, and use the :ansplugin:`community.sops.sops_encrypt module <community.sops.sops_encrypt#module>` to write it to disk in encrypted form:
.. code-block:: yaml+jinja
---
- name: Create SOPS-encrypted private key
hosts: localhost
gather_facts: false
tasks:
- block:
- name: Create private key
community.crypto.openssl_privatekey_pipe:
size: 2048
no_log: true # Always use this with openssl_privatekey_pipe!
register: private_key
- name: Write encrypted key to disk
community.sops.sops_encrypt:
path: keys/private_key.pem.sops
content_text: "{{ private_key.privatekey }}"
always:
- name: Wipe private key from Ansible's facts
# This is particularly important if the playbook doesn't end here!
set_fact:
private_key: ''
This playbook creates a new key on every run. If you want the private key creation to be idempotent, you need to do a little more work:
.. code-block:: yaml+jinja
---
- name: Create SOPS-encrypted private key
hosts: localhost
gather_facts: false
tasks:
- block:
- name: Create private key
community.crypto.openssl_privatekey_pipe:
size: 2048
content: >-
{{ lookup(
'community.sops.sops',
'keys/private_key.pem.sops',
empty_on_not_exist=true
) }}
no_log: true # Always use this with openssl_privatekey_pipe!
register: private_key
- name: Write encrypted key to disk
community.sops.sops_encrypt:
path: keys/private_key.pem.sops
content_text: "{{ private_key.privatekey }}"
when: private_key is changed
always:
- name: Wipe private key from Ansible's facts
# This is particularly important if the playbook doesn't end here!
set_fact:
private_key: ''
The :ansopt:`community.sops.sops#lookup:empty_on_not_exist=true` flag is needed to avoid the lookup to fail when the key does not yet exist. When this playbook is run twice, the output will be:
.. code-block:: ansible-output
PLAY [Create SOPS-encrypted private key] *************************************************************************
TASK [Create private key] ****************************************************************************************
ok: [localhost]
TASK [Write encrypted key to disk] *******************************************************************************
skipping: [localhost]
TASK [Wipe private key from Ansible's facts] *********************************************************************
ok: [localhost]
PLAY RECAP *******************************************************************************************************
localhost : ok=2 changed=0 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0
Working with encrypted data from other sources
----------------------------------------------
You can use the :ansplugin:`community.sops.decrypt Jinja2 filter <community.sops.decrypt#filter>` to decrypt arbitrary data. This can be data read earlier from a file, returned from an action, or obtained through some other means.
For example, assume that you want to decrypt a file retrieved from a HTTPS server with the :ansplugin:`ansible.builtin.uri module <ansible.builtin.uri#module>`. To use the :ansplugin:`community.sops.sops lookup <community.sops.sops#lookup>`, you have to write it to a file first. With the filter, you can directly decrypt it:
.. code-block:: yaml+jinja
---
- name: Decrypt file fetched from URL
hosts: localhost
gather_facts: false
tasks:
- name: Fetch file from URL
ansible.builtin.uri:
url: https://raw.githubusercontent.com/getsops/sops/master/functional-tests/res/comments.enc.yaml
return_content: true
register: encrypted_content
- name: Show encrypted data
debug:
msg: "{{ encrypted_content.content | ansible.builtin.from_yaml }}"
- name: Decrypt data and decode decrypted YAML
set_fact:
decrypted_data: "{{ encrypted_content.content | community.sops.decrypt | ansible.builtin.from_yaml }}"
- name: Show decrypted data
debug:
msg: "{{ decrypted_data }}"
The output will be:
.. code-block:: ansible-output
PLAY [Decrypt file fetched from URL] *****************************************************************************
TASK [Fetch file from URL] ***************************************************************************************
ok: [localhost]
TASK [Show encrypted data] ***************************************************************************************
ok: [localhost] => {
"msg": {
"dolor": "ENC[AES256_GCM,data:IgvT,iv:wtPNYbDTARFE810PH6ldOLzCDcAjkB/dzPsZjpgHcko=,tag:zwE8P+AwO1hrHkgF6pTbZw==,type:str]",
"lorem": "ENC[AES256_GCM,data:PhmSdTs=,iv:J5ugEWq6RfyNx+5zDXvcTdoQ18YYZkqesDED7LNzou4=,tag:0Qrom6J6aUnZMZzGz5XCxw==,type:str]",
"sops": {
"age": [],
"azure_kv": [],
"gcp_kms": [],
"hc_vault": [],
"kms": [],
"lastmodified": "2020-10-07T15:49:13Z",
"mac": "ENC[AES256_GCM,data:2dhyKdHYSynjXPwYrn9356wA7vRKw+T5qwBenI2vZrgthpQBOCQG4M6f7eeH3VLTxB4mN4CAchb25dsNRoGr6A38VruaSSAhPco3Rh4AlvKSvXuhgRnzZvNxE/bnHX1D4K5cdTb4FsJg/Ue1l7UcWrlrv1s3H3SwLHP/nf+suD0=,iv:6xBYURjjaQzlUOKOrs2NWOChiNFZVAGPJZQZ59MwX3o=,tag:uXD5VYme+c8eHcCc5TD2YA==,type:str]",
"pgp": [
{
"created_at": "2019-08-29T21:52:32Z",
"enc": "-----BEGIN PGP MESSAGE-----\n\nhQEMAyUpShfNkFB/AQgAlvpTj0NYqF4mQyIeM7wX2SHLb4U07/flpqDpp2W/30Pz\nAHA7sYrgP0l8BrjT2kwtgCN0cdfoIHJudezrNjANp2P5TbP2b9kYYNxpehzB9PFj\nFixnCS7Zp8WIt1yXr1TX+ANZoXLopVcRbMaQ5OdH7CN1pNQtMR+R3FR3X/IqKxiU\nDo1YLaooRJICUC8LJw2Tb4K+lYnTSqd/HalLGym++ivFvdDB1Ya1GhT1FswXidXK\nIRjsOVbxV0q5VeNOR0zxsheOvuHyCje16c7NXJtATJVWtTFABJB8u7CY5HhZSgq+\nrXJHyLHqVLzJ8E4WqHQkMNUlVcrqAz7glZ6xbAhfI9JeAYk5SuBOQOQ4yvASqH4K\nb0N3+/abluBY7YPqKuRZBiEtmcYlZ+zIHuOTP1rD/7L5VY8CwE5U8SFlEqwM7nQJ\n6/vtl6qngOFjwt34WrhZzUfLPB/wRV/m1Qv2kr0RNA==\n=Ykiw\n-----END PGP MESSAGE-----\n",
"fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4"
}
],
"unencrypted_suffix": "_unencrypted",
"version": "3.6.1"
}
}
}
TASK [Decrypt data] **********************************************************************************************
ok: [localhost]
TASK [Show decrypted data] ***************************************************************************************
ok: [localhost] => {
"msg": {
"dolor": "sit",
"lorem": "ipsum"
}
}
PLAY RECAP *******************************************************************************************************
localhost : ok=4 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Please note that if you put a Jinja2 expression in a variable, it will be evaluated **every time it is used**. Decrypting data takes a certain amount of time. If you need to use an expression multiple times, it is better to store its evaluated form as a fact with :ansplugin:`ansible.bulitin.set_fact <ansible.builtin.set_fact#module>` first. This can be important if decrypted data should be passed to a role
.. code-block:: yaml+jinja
---
- name: Decrypt file fetched from URL
hosts: localhost
gather_facts: false
tasks:
- name: Fetch file from URL
ansible.builtin.uri:
url: https://raw.githubusercontent.com/getsops/sops/master/functional-tests/res/comments.enc.yaml
return_content: true
register: encrypted_content
# BAD: every time the role uses decrypted_data, the data will be decrypted!
- name: Call role with decrypted data
include_role:
name: myrole
vars:
role_parameter: "{{ encrypted_content.content | community.sops.decrypt | ansible.builtin.from_yaml }}"
# GOOD: the data is decrypted once before the role is called,
- name: Store decrypted data as fact
set_fact:
decrypted_data: "{{ encrypted_content.content | community.sops.decrypt | ansible.builtin.from_yaml }}"
- name: Call role with decrypted data
include_role:
name: myrole
vars:
role_parameter: "{{ decrypted_data }}"
Working with encrypted variables
--------------------------------
You can load encrypted variables similarly to the :ansplugin:`ansible.builtin.host_group_vars vars plugin <ansible.builtin.host_group_vars#vars>` with the :ansplugin:`community.sops.sops vars plugin <community.sops.sops#vars>`. If you need to load variables dynamically similarly to the :ansplugin:`ansible.builtin.include_vars action <ansible.builtin.include_vars#module>`, you can use the :ansplugin:`community.sops.load_vars action <community.sops.load_vars#module>`.
To use the vars plugin, you need to enable it in your Ansible config file (``ansible.cfg``):
.. code-block:: ini
[defaults]
vars_plugins_enabled = host_group_vars,community.sops.sops
See :ref:`VARIABLE_PLUGINS_ENABLED <VARIABLE_PLUGINS_ENABLED>` for more details on enabling vars plugins. Then you can put files with the following extensions into the ``group_vars`` and ``host_vars`` directories:
- ``.sops.yaml``
- ``.sops.yml``
- ``.sops.json``
(The list of extensions can be adjusted with :ansopt:`community.sops.sops#vars:valid_extensions`.) The vars plugin will decrypt them and you can use their unencrypted content transparently.
If you need to dynamically load encrypted variables, similar to the built-in :ansplugin:`ansible.builtin.include_vars action <ansible.builtin.include_vars#module>`, you can use the :ansplugin:`community.sops.load_vars action <community.sops.load_vars#module>` action. Please note that it is not a perfect replacement, since the built-in action relies on some hard-coded special casing in ansible-core which allows it to load the variables actually as variables (more precisely: as "unsafe" Jinja2 expressions which are automatically evaluated when used). Other action plugins, such as :ansplugin:`community.sops.load_vars#module`, cannot do that and have to load the variables as facts instead.
This is mostly relevant if you use Jinja2 expressions in the encrypted variable file. When :ansplugin:`ansible.builtin.include_vars#module` loads a variable file with expressions, these expressions will only be evaluated when the variable that defines them needs to be evaluated (lazy evaluation). Since :ansplugin:`community.sops.load_vars#module` returns facts, it has to directly evaluate expressions at load time. (For this, set its :ansopt:`community.sops.load_vars#module:expressions` option to :ansval:`evaluate-on-load`.) This is mostly relevant if you want to refer to other variables from the same file: this will not work, since Ansible does not know the other variable yet while evaluating the first. It will only "know" them as facts after all have been evaluated and the action finishes.
For the following example, assume you have the encrypted file ``keys/credentials.sops.yml`` which decrypts to:
.. code-block:: yaml
encrypted_password: foo
expression: "{{ inventory_hostname }}"
Consider the following playbook:
.. code-block:: yaml+jinja
---
- name: Create SOPS-encrypted private key
hosts: localhost
gather_facts: false
tasks:
- name: Load encrypted credentials
community.sops.load_vars:
file: keys/credentials.sops.yml
expressions: ignore # explicitly do not evaluate expressions
# on load (this is the default)
- name: Show password
debug:
msg: "The password is {{ encrypted_password }}"
- name: Show expression
debug:
msg: "The expression is {{ expression }}"
Running it produces:
.. code-block:: ansible-output
PLAY [Create SOPS-encrypted private key] *************************************************************************
TASK [Load encrypted credentials] ********************************************************************************
ok: [localhost]
TASK [Show password] *********************************************************************************************
ok: [localhost] => {
"msg": "The password is foo"
}
TASK [Show expression] *******************************************************************************************
ok: [localhost] => {
"msg": "The expression is {{ inventory_hostname }}"
}
PLAY RECAP *******************************************************************************************************
localhost : ok=3 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
If you change the variable loading task to:
.. code-block:: yaml+jinja
- name: Load encrypted credentials
community.sops.load_vars:
file: keys/credentials.sops.yml
expressions: evaluate-on-load
The last task will now show the evaluated expression:
.. code-block:: ansible-output
TASK [Show expression] *******************************************************************************************
ok: [localhost] => {
"msg": "The expression is localhost"
}

6
ansible_collections/community/sops/meta/ee-bindep.txt Normal file
View file

@ -0,0 +1,6 @@
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
gnupg [platform:dpkg]
gnupg2 [platform:rpm]

8
ansible_collections/community/sops/meta/execution-environment.yml Normal file
View file

@ -0,0 +1,8 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
version: 1
dependencies:
system: meta/ee-bindep.txt

6
ansible_collections/community/sops/meta/runtime.yml Normal file
View file

@ -0,0 +1,6 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
requires_ansible: '>=2.15.0'

32
ansible_collections/community/sops/noxfile.py Normal file
View file

@ -0,0 +1,32 @@
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# The following metadata allows Python runners and nox to install the required
# dependencies for running this Python script:
#
# /// script
# dependencies = ["nox>=2025.02.09", "antsibull-nox"]
# ///
import sys
import nox
# We try to import antsibull-nox, and if that doesn't work, provide a more useful
# error message to the user.
try:
import antsibull_nox
except ImportError:
print("You need to install antsibull-nox in the same Python environment as nox.")
sys.exit(1)
antsibull_nox.load_antsibull_nox_toml()
# Allow to run the noxfile with `python noxfile.py`, `pipx run noxfile.py`, or similar.
# Requires nox >= 2025.02.09
if __name__ == "__main__":
nox.main()

12
ansible_collections/community/sops/playbooks/install.yml Normal file
View file

@ -0,0 +1,12 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
- name: Install SOPS
gather_facts: true
hosts: all
tasks:
- name: Install SOPS on remote hosts
ansible.builtin.include_role:
name: community.sops.install

14
ansible_collections/community/sops/playbooks/install_localhost.yml Normal file
View file

@ -0,0 +1,14 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
- name: Install SOPS on localhost
gather_facts: false
hosts: localhost
tasks:
- name: Install SOPS on localhost
ansible.builtin.include_role:
name: community.sops.install
vars:
sops_install_on_localhost: true

110
ansible_collections/community/sops/plugins/action/load_vars.py Normal file
View file

@ -0,0 +1,110 @@
# Copyright (c) 2020, Felix Fontein <felix@fontein.de>
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
from __future__ import annotations
from collections.abc import Sequence, Mapping
from ansible.module_utils.common.text.converters import to_native
from ansible.utils.display import Display
from ansible_collections.community.sops.plugins.module_utils.sops import Sops, get_sops_argument_spec
from ansible_collections.community.sops.plugins.plugin_utils.action_module import ActionModuleBase, ArgumentSpec
try:
from ansible.template import trust_as_template as _trust_as_template
HAS_DATATAGGING = True
except ImportError:
HAS_DATATAGGING = False
display = Display()
def _make_safe(value):
if HAS_DATATAGGING and isinstance(value, str):
return _trust_as_template(value)
return value
class ActionModule(ActionModuleBase):
def _load(self, filename, module):
def get_option_value(argument_name):
return module.params.get(argument_name)
output = Sops.decrypt(filename, display=display, get_option_value=get_option_value)
data = self._loader.load(output, file_name=filename, show_content=False)
if not data:
data = dict()
if not isinstance(data, dict):
# Should not happen with sops-encrypted files
raise Exception('{0} must be stored as a dictionary/hash'.format(to_native(filename)))
return data
def _evaluate(self, value):
if isinstance(value, str):
# must come *before* Sequence, as strings are also instances of Sequence
return self._templar.template(_make_safe(value))
if isinstance(value, Sequence):
return [self._evaluate(v) for v in value]
if isinstance(value, Mapping):
return dict((k, self._evaluate(v)) for k, v in value.items())
return value
def _make_safe(self, value):
if isinstance(value, str):
# must come *before* Sequence, as strings are also instances of Sequence
return _make_safe(value)
if isinstance(value, Sequence):
return [self._make_safe(v) for v in value]
if isinstance(value, Mapping):
return dict((k, self._make_safe(v)) for k, v in value.items())
return value
@staticmethod
def setup_module():
argument_spec = ArgumentSpec(
argument_spec=dict(
file=dict(type='path', required=True),
name=dict(type='str'),
expressions=dict(type='str', default='ignore', choices=['ignore', 'evaluate-on-load', 'lazy-evaluation']),
),
)
argument_spec.argument_spec.update(get_sops_argument_spec())
return argument_spec, {}
def run_module(self, module):
expressions = module.params['expressions']
if expressions == 'lazy-evaluation' and not HAS_DATATAGGING:
module.fail_json(msg='expressions=lazy-evaluation requires ansible-core 2.19+ with Data Tagging support.')
data = dict()
files = []
try:
filename = self._find_needle('vars', module.params['file'])
data.update(self._load(filename, module))
files.append(filename)
except Exception as e:
module.fail_json(msg=to_native(e))
name = module.params['name']
if name is None:
value = data
else:
value = dict()
value[name] = data
if expressions == 'evaluate-on-load':
value = self._evaluate(value)
if expressions == 'lazy-evaluation':
value = self._make_safe(value)
module.exit_json(
ansible_included_var_files=files,
ansible_facts=value,
_ansible_no_log=True,
)

88
ansible_collections/community/sops/plugins/doc_fragments/attributes.py Normal file
View file

@ -0,0 +1,88 @@
# -*- coding: utf-8 -*-
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
from __future__ import (absolute_import, division, print_function)
__metaclass__ = type
class ModuleDocFragment(object):
# Standard documentation fragment
DOCUMENTATION = r"""
options: {}
attributes:
check_mode:
description: Can run in C(check_mode) and return changed status prediction without modifying target.
diff_mode:
description: Will return details on what has changed (or possibly needs changing in C(check_mode)), when in diff mode.
idempotent:
description:
- When run twice in a row outside check mode, with the same arguments, the second invocation indicates no change.
- This assumes that the system controlled/queried by the module has not changed in a relevant way.
"""
# Should be used together with the standard fragment
IDEMPOTENT_NOT_MODIFY_STATE = r"""
options: {}
attributes:
idempotent:
support: full
details:
- This action does not modify state.
"""
# Should be used together with the standard fragment
INFO_MODULE = r'''
options: {}
attributes:
check_mode:
support: full
details:
- This action does not modify state.
diff_mode:
support: N/A
details:
- This action does not modify state.
'''
FACTS = r"""
options: {}
attributes:
facts:
description: Action returns an C(ansible_facts) dictionary that will update existing host facts.
"""
# Should be used together with the standard fragment and the FACTS fragment
FACTS_MODULE = r'''
options: {}
attributes:
check_mode:
support: full
details:
- This action does not modify state.
diff_mode:
support: N/A
details:
- This action does not modify state.
facts:
support: full
'''
FILES = r"""
options: {}
attributes:
safe_file_operations:
description: Uses Ansible's strict file operation functions to ensure proper permissions and avoid data corruption.
"""
FLOW = r"""
options: {}
attributes:
action:
description: Indicates this has a corresponding action plugin so some parts of the options can be executed on the controller.
async:
description: Supports being used with the C(async) keyword.
"""

318
ansible_collections/community/sops/plugins/doc_fragments/sops.py Normal file
View file

@ -0,0 +1,318 @@
# -*- coding: utf-8 -*-
# Copyright (c) 2020 Felix Fontein <felix@fontein.de>
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
from __future__ import (absolute_import, division, print_function)
__metaclass__ = type
class ModuleDocFragment(object):
DOCUMENTATION = r"""
requirements:
- A binary executable C(sops) (U(https://github.com/getsops/sops)) must exist either in E(PATH) or configured as O(sops_binary).
options:
sops_binary:
description:
- Path to the SOPS binary.
- By default uses C(sops).
type: path
version_added: 1.0.0
age_key:
description:
- One or more age private keys that can be used to decrypt encrypted files.
- Will be set as the E(SOPS_AGE_KEY) environment variable when calling SOPS.
- Requires SOPS 3.7.1+.
type: str
version_added: 1.4.0
age_keyfile:
description:
- The file containing the age private keys that SOPS can use to decrypt encrypted files.
- Will be set as the E(SOPS_AGE_KEY_FILE) environment variable when calling SOPS.
- By default, SOPS looks for C(sops/age/keys.txt) inside your user configuration directory.
- Requires SOPS 3.7.0+.
type: path
version_added: 1.4.0
age_ssh_private_keyfile:
description:
- The file containing the SSH private key that SOPS can use to decrypt encrypted files.
- Will be set as the E(SOPS_AGE_SSH_PRIVATE_KEY_FILE) environment variable when calling SOPS.
- By default, SOPS looks for C(~/.ssh/id_ed25519) and falls back to C(~/.ssh/id_rsa).
- Requires SOPS 3.10.0+.
type: path
version_added: 1.4.0
aws_profile:
description:
- The AWS profile to use for requests to AWS.
- This corresponds to the SOPS C(--aws-profile) option.
type: str
version_added: 1.0.0
aws_access_key_id:
description:
- The AWS access key ID to use for requests to AWS.
- Sets the environment variable E(AWS_ACCESS_KEY_ID) for the SOPS call.
type: str
version_added: 1.0.0
aws_secret_access_key:
description:
- The AWS secret access key to use for requests to AWS.
- Sets the environment variable E(AWS_SECRET_ACCESS_KEY) for the SOPS call.
type: str
version_added: 1.0.0
aws_session_token:
description:
- The AWS session token to use for requests to AWS.
- Sets the environment variable E(AWS_SESSION_TOKEN) for the SOPS call.
type: str
version_added: 1.0.0
config_path:
description:
- Path to the SOPS configuration file.
- If not set, SOPS will recursively search for the config file starting at the file that is encrypted or decrypted.
- This corresponds to the SOPS C(--config) option.
type: path
version_added: 1.0.0
enable_local_keyservice:
description:
- Tell SOPS to use local key service.
- When set to V(false), this corresponds to the SOPS C(--enable-local-keyservice=false) option.
type: bool
default: true
version_added: 1.0.0
keyservice:
description:
- Specify key services to use next to the local one.
- A key service must be specified in the form C(protocol://address), for example C(tcp://myserver.com:5000).
- This corresponds to the SOPS C(--keyservice) option.
type: list
elements: str
version_added: 1.0.0
"""
ANSIBLE_VARIABLES = r'''
options:
sops_binary:
vars:
- name: sops_binary
age_key:
vars:
- name: sops_age_key
age_keyfile:
vars:
- name: sops_age_keyfile
age_ssh_private_keyfile:
vars:
- name: sops_age_ssh_private_keyfile
aws_profile:
vars:
- name: sops_aws_profile
aws_access_key_id:
vars:
- name: sops_aws_access_key_id
aws_secret_access_key:
vars:
- name: sops_aws_secret_access_key
aws_session_token:
vars:
- name: sops_session_token
- name: sops_aws_session_token
version_added: 1.2.0
config_path:
vars:
- name: sops_config_path
enable_local_keyservice:
vars:
- name: sops_enable_local_keyservice
keyservice:
vars:
- name: sops_keyservice
'''
ANSIBLE_ENV = r'''
options:
sops_binary:
env:
- name: ANSIBLE_SOPS_BINARY
version_added: 1.2.0
age_key:
env:
- name: ANSIBLE_SOPS_AGE_KEY
age_keyfile:
env:
- name: ANSIBLE_SOPS_AGE_KEYFILE
age_ssh_private_keyfile:
env:
- name: ANSIBLE_SOPS_AGE_SSH_PRIVATE_KEYFILE
aws_profile:
env:
- name: ANSIBLE_SOPS_AWS_PROFILE
version_added: 1.2.0
aws_access_key_id:
env:
- name: ANSIBLE_SOPS_AWS_ACCESS_KEY_ID
version_added: 1.2.0
aws_secret_access_key:
env:
- name: ANSIBLE_SOPS_AWS_SECRET_ACCESS_KEY
version_added: 1.2.0
aws_session_token:
env:
- name: ANSIBLE_SOPS_AWS_SESSION_TOKEN
version_added: 1.2.0
config_path:
env:
- name: ANSIBLE_SOPS_CONFIG_PATH
version_added: 1.2.0
enable_local_keyservice:
env:
- name: ANSIBLE_SOPS_ENABLE_LOCAL_KEYSERVICE
version_added: 1.2.0
keyservice:
env:
- name: ANSIBLE_SOPS_KEYSERVICE
version_added: 1.2.0
'''
ANSIBLE_INI = r'''
options:
sops_binary:
ini:
- section: community.sops
key: binary
version_added: 1.2.0
# We do not provide an INI key for
# age_key
# to make sure that secrets cannot be provided in ansible.ini. Use environment variables or another mechanism for that.
age_keyfile:
ini:
- section: community.sops
key: age_keyfile
age_ssh_private_keyfile:
ini:
- section: community.sops
key: age_ssh_private_keyfile
aws_profile:
ini:
- section: community.sops
key: aws_profile
version_added: 1.2.0
aws_access_key_id:
ini:
- section: community.sops
key: aws_access_key_id
version_added: 1.2.0
# We do not provide an INI key for
# aws_secret_access_key
# to make sure that secrets cannot be provided in ansible.ini. Use environment variables or another mechanism for that.
aws_session_token:
ini:
- section: community.sops
key: aws_session_token
version_added: 1.2.0
config_path:
ini:
- section: community.sops
key: config_path
version_added: 1.2.0
enable_local_keyservice:
ini:
- section: community.sops
key: enable_local_keyservice
version_added: 1.2.0
keyservice:
ini:
- section: community.sops
key: keyservice
version_added: 1.2.0
'''
ENCRYPT_SPECIFIC = r'''
options:
age:
description:
- Age fingerprints to use.
- This corresponds to the SOPS C(--age) option.
type: list
elements: str
version_added: 1.4.0
kms:
description:
- List of KMS ARNs to use.
- This corresponds to the SOPS C(--kms) option.
type: list
elements: str
version_added: 1.0.0
gcp_kms:
description:
- GCP KMS resource IDs to use.
- This corresponds to the SOPS C(--gcp-kms) option.
type: list
elements: str
version_added: 1.0.0
azure_kv:
description:
- Azure Key Vault URLs to use.
- This corresponds to the SOPS C(--azure-kv) option.
type: list
elements: str
version_added: 1.0.0
hc_vault_transit:
description:
- HashiCorp Vault key URIs to use.
- For example, C(https://vault.example.org:8200/v1/transit/keys/dev).
- This corresponds to the SOPS C(--hc-vault-transit) option.
type: list
elements: str
version_added: 1.0.0
pgp:
description:
- PGP fingerprints to use.
- This corresponds to the SOPS C(--pgp) option.
type: list
elements: str
version_added: 1.0.0
unencrypted_suffix:
description:
- Override the unencrypted key suffix.
- This corresponds to the SOPS C(--unencrypted-suffix) option.
type: str
version_added: 1.0.0
encrypted_suffix:
description:
- Override the encrypted key suffix.
- When set to an empty string, all keys will be encrypted that are not explicitly
marked by O(unencrypted_suffix).
- This corresponds to the SOPS C(--encrypted-suffix) option.
type: str
version_added: 1.0.0
unencrypted_regex:
description:
- Set the unencrypted key suffix.
- When specified, only keys matching the regular expression will be left unencrypted.
- This corresponds to the SOPS C(--unencrypted-regex) option.
type: str
version_added: 1.0.0
encrypted_regex:
description:
- Set the encrypted key suffix.
- When specified, only keys matching the regular expression will be encrypted.
- This corresponds to the SOPS C(--encrypted-regex) option.
type: str
version_added: 1.0.0
encryption_context:
description:
- List of KMS encryption context pairs of format C(key:value).
- This corresponds to the SOPS C(--encryption-context) option.
type: list
elements: str
version_added: 1.0.0
shamir_secret_sharing_threshold:
description:
- The number of distinct keys required to retrieve the data key with
L(Shamir's Secret Sharing, https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing).
- If not set here and in the SOPS config file, will default to V(0).
- This corresponds to the SOPS C(--shamir-secret-sharing-threshold) option.
type: int
version_added: 1.0.0
'''

63
ansible_collections/community/sops/plugins/filter/_latest_version.py Normal file
View file

@ -0,0 +1,63 @@
# Copyright (c) 2022, Felix Fontein <felix@fontein.de>
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
from __future__ import annotations
DOCUMENTATION = r"""
name: _latest_version
short_description: "[INTERNAL] Get latest version from a list of versions"
version_added: 1.4.0
author:
- Felix Fontein (@felixfontein)
description:
- B(This is an internal tool and must only be used from roles in this collection!) If you use it from outside this collection,
be warned that its behavior can change and it can be removed at any time, even in bugfix releases!
- Given a list of version numbers, returns the largest of them.
options:
_input:
description:
- A list of strings. Every string must be a version number.
type: list
elements: string
required: true
"""
EXAMPLES = r"""
---
- name: Print latest version
ansible.builtin.debug:
msg: "{{ versions | community.sops._latest_version }}"
vars:
versions:
- 1.0.0
- 1.0.0rc1
- 1.1.0
"""
RETURN = r"""
_value:
description:
- The latest version from the input.
- Returns the empty string if the input was empty.
type: string
"""
from ansible.module_utils.compat.version import LooseVersion
def pick_latest_version(version_list):
'''Pick latest version from a list of versions.'''
# Remove all prereleases (versions with '+' or '-' in them)
version_list = [v for v in version_list if '-' not in v and '+' not in v]
if not version_list:
return ''
return sorted(version_list, key=LooseVersion, reverse=True)[0]
class FilterModule:
'''Helper filters.'''
def filters(self):
return {
'_latest_version': pick_latest_version,
}

173
ansible_collections/community/sops/plugins/filter/decrypt.py Normal file
View file

@ -0,0 +1,173 @@
# Copyright (c) 2021, Felix Fontein <felix@fontein.de>
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
from __future__ import annotations
DOCUMENTATION = r"""
name: decrpyt
short_description: Decrypt SOPS-encrypted data
version_added: 1.1.0
author:
- Felix Fontein (@felixfontein)
description:
- Decrypt SOPS-encrypted data.
- Allows to decrypt data that has been provided by an arbitrary source.
- Note that due to Ansible lazy-evaluating expressions, it is better to use M(ansible.builtin.set_fact) to store the result
of an evaluation in a fact to avoid recomputing the value every time the expression is used.
options:
_input:
description:
- The data to decrypt.
type: string
required: true
rstrip:
description:
- Whether to remove trailing newlines and spaces.
type: bool
default: true
input_type:
description:
- Tell SOPS how to interpret the encrypted data.
- There is no auto-detection since we do not have a filename. By default SOPS is told to treat the input as YAML. If
that is wrong, please set this option to the correct value.
- The value V(ini) is available since community.sops 1.9.0.
type: str
choices:
- binary
- json
- yaml
- dotenv
- ini
default: yaml
output_type:
description:
- Tell SOPS how to interpret the decrypted file.
- Please note that the output is always text or bytes, depending on the value of O(decode_output). To parse the resulting
JSON or YAML, use corresponding filters such as P(ansible.builtin.from_json#filter) and P(ansible.builtin.from_yaml#filter).
- The value V(ini) is available since community.sops 1.9.0.
type: str
choices:
- binary
- json
- yaml
- dotenv
- ini
default: yaml
decode_output:
description:
- Whether to decode the output to bytes.
- When O(output_type=binary), and the file is not known to contain UTF-8 encoded text, this should better be set to
V(false) to prevent mangling the data with UTF-8 decoding.
type: bool
default: true
extends_documentation_fragment:
- community.sops.sops
seealso:
- plugin: community.sops.sops
plugin_type: lookup
- plugin: community.sops.sops
plugin_type: vars
- module: community.sops.load_vars
"""
EXAMPLES = r"""
---
- name: Decrypt file fetched from URL
hosts: localhost
gather_facts: false
tasks:
- name: Fetch file from URL
ansible.builtin.uri:
url: https://raw.githubusercontent.com/getsops/sops/master/functional-tests/res/comments.enc.yaml
return_content: true
register: encrypted_content
- name: Show encrypted data
debug:
msg: "{{ encrypted_content.content | ansible.builtin.from_yaml }}"
- name: Decrypt data and decode decrypted YAML
set_fact:
decrypted_data: "{{ encrypted_content.content | community.sops.decrypt | ansible.builtin.from_yaml }}"
- name: Show decrypted data
debug:
msg: "{{ decrypted_data }}"
"""
RETURN = r"""
_value:
description:
- Decrypted data as text (O(decode_output=true), default) or binary string (O(decode_output=false)).
type: string
"""
from ansible.errors import AnsibleFilterError
from ansible.module_utils.common.text.converters import to_bytes, to_native
from ansible.utils.display import Display
from ansible_collections.community.sops.plugins.module_utils.sops import Sops, SopsError
_VALID_TYPES = set(['binary', 'json', 'yaml', 'dotenv', 'ini'])
def decrypt_filter(data, input_type='yaml', output_type='yaml', sops_binary='sops', rstrip=True, decode_output=True,
aws_profile=None, aws_access_key_id=None, aws_secret_access_key=None, aws_session_token=None,
config_path=None, enable_local_keyservice=True, keyservice=None, age_key=None, age_keyfile=None, age_ssh_private_keyfile=None):
'''Decrypt sops-encrypted data.'''
# Check parameters
if input_type not in _VALID_TYPES:
raise AnsibleFilterError('input_type must be one of {expected}; got "{value}"'.format(
expected=', '.join(sorted(_VALID_TYPES)), value=input_type))
if output_type not in _VALID_TYPES:
raise AnsibleFilterError('output_type must be one of {expected}; got "{value}"'.format(
expected=', '.join(sorted(_VALID_TYPES)), value=output_type))
# Create option value querier
def get_option_value(argument_name):
if argument_name == 'sops_binary':
return sops_binary
if argument_name == 'age_key':
return age_key
if argument_name == 'age_keyfile':
return age_keyfile
if argument_name == 'age_ssh_private_keyfile':
return age_ssh_private_keyfile
if argument_name == 'aws_profile':
return aws_profile
if argument_name == 'aws_access_key_id':
return aws_access_key_id
if argument_name == 'aws_secret_access_key':
return aws_secret_access_key
if argument_name == 'aws_session_token':
return aws_session_token
if argument_name == 'config_path':
return config_path
if argument_name == 'enable_local_keyservice':
return enable_local_keyservice
if argument_name == 'keyservice':
return keyservice
raise AssertionError('internal error: should not be reached')
# Decode
data = to_bytes(data)
try:
output = Sops.decrypt(
None, content=data, display=Display(), rstrip=rstrip, decode_output=decode_output,
input_type=input_type, output_type=output_type, get_option_value=get_option_value)
except SopsError as e:
raise AnsibleFilterError(to_native(e))
return output
class FilterModule:
'''Ansible jinja2 filters'''
def filters(self):
return {
'decrypt': decrypt_filter,
}

166
ansible_collections/community/sops/plugins/lookup/sops.py Normal file
View file

@ -0,0 +1,166 @@
# Copyright 2018 Edoardo Tenani <e.tenani@arduino.cc> (@endorama)
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
from __future__ import annotations
DOCUMENTATION = r"""
name: sops
author: Edoardo Tenani (@endorama) <e.tenani@arduino.cc>
short_description: Read SOPS-encrypted file contents
version_added: '0.1.0'
description:
- This lookup returns the contents from a file on the Ansible controller's file system.
- This lookup requires the C(sops) executable to be available in the controller PATH.
options:
_terms:
description: Path(s) of files to read.
required: true
type: list
elements: str
rstrip:
description: Whether to remove trailing newlines and spaces.
type: bool
default: true
base64:
description:
- Base64-encodes the parsed result.
- Use this if you want to store binary data in Ansible variables.
type: bool
default: false
input_type:
description:
- Tell SOPS how to interpret the encrypted file.
- By default, SOPS will chose the input type from the file extension. If it detects the wrong type for a file, this
could result in decryption failing.
- The value V(ini) is available since community.sops 1.9.0.
type: str
choices:
- binary
- json
- yaml
- dotenv
- ini
output_type:
description:
- Tell SOPS how to interpret the decrypted file.
- By default, SOPS will chose the output type from the file extension. If it detects the wrong type for a file, this
could result in decryption failing.
- The value V(ini) is available since community.sops 1.9.0.
type: str
choices:
- binary
- json
- yaml
- dotenv
- ini
empty_on_not_exist:
description:
- When set to V(true), will not raise an error when a file cannot be found, but return an empty string instead.
type: bool
default: false
extract:
description:
- Tell SOPS to extract a specific key from a JSON or YAML file.
- Expects a string with the same 'querystring' syntax as SOPS' C(--encrypt) option, for example V(["somekey"][0]).
- B(Note:) Escape quotes appropriately.
type: str
version_added: 1.9.0
extends_documentation_fragment:
- community.sops.sops
- community.sops.sops.ansible_variables
- community.sops.sops.ansible_env
- community.sops.sops.ansible_ini
notes:
- This lookup does not understand 'globbing' - use the P(ansible.builtin.fileglob#lookup) lookup instead.
seealso:
- plugin: community.sops.decrypt
plugin_type: filter
description: The decrypt filter can be used to descrypt SOPS-encrypted in-memory data.
- plugin: community.sops.sops
plugin_type: vars
description: The sops vars plugin can be used to load SOPS-encrypted host or group variables.
- module: community.sops.load_vars
"""
EXAMPLES = r"""
---
- name: Output secrets to screen (BAD IDEA!)
ansible.builtin.debug:
msg: "Content: {{ lookup('community.sops.sops', item) }}"
loop:
- sops-encrypted-file.enc.yaml
- name: Add SSH private key
ansible.builtin.copy:
# Note that rstrip=false is necessary for some SSH versions to be able to use the key
content: "{{ lookup('community.sops.sops', user + '-id_rsa', rstrip=false) }}"
dest: /home/{{ user }}/.ssh/id_rsa
owner: "{{ user }}"
group: "{{ user }}"
mode: "0600"
no_log: true # avoid content to be written to log
- name: The file file.json is a YAML file, which contains the encryption of binary data
ansible.builtin.debug:
msg: "Content: {{ lookup('community.sops.sops', 'file.json', input_type='yaml', output_type='binary') }}"
"""
RETURN = r"""
_raw:
description: Decrypted file content.
type: list
elements: str
"""
import base64
from ansible.errors import AnsibleLookupError
from ansible.plugins.lookup import LookupBase
from ansible.module_utils.common.text.converters import to_native
from ansible_collections.community.sops.plugins.module_utils.sops import Sops, SopsError
from ansible.utils.display import Display
display = Display()
class LookupModule(LookupBase):
def run(self, terms, variables=None, **kwargs):
self.set_options(var_options=variables, direct=kwargs)
rstrip = self.get_option('rstrip')
use_base64 = self.get_option('base64')
input_type = self.get_option('input_type')
output_type = self.get_option('output_type')
empty_on_not_exist = self.get_option('empty_on_not_exist')
extract = self.get_option('extract')
ret = []
def get_option_value(argument_name):
return self.get_option(argument_name)
for term in terms:
display.debug("Sops lookup term: %s" % term)
lookupfile = self.find_file_in_search_path(variables, 'files', term, ignore_missing=empty_on_not_exist)
display.vvvv(u"Sops lookup using %s as file" % lookupfile)
if not lookupfile:
if empty_on_not_exist:
ret.append('')
continue
raise AnsibleLookupError("could not locate file in lookup: %s" % to_native(term))
try:
output = Sops.decrypt(
lookupfile, display=display, rstrip=rstrip, decode_output=(not use_base64),
input_type=input_type, output_type=output_type, get_option_value=get_option_value, extract=extract)
except SopsError as e:
raise AnsibleLookupError(to_native(e))
if use_base64:
output = to_native(base64.b64encode(output))
ret.append(output)
return ret

53
ansible_collections/community/sops/plugins/module_utils/io.py Normal file
View file

@ -0,0 +1,53 @@
# Copyright (c), Yanis Guenane <yanis+ansible@guenane.org>, 2016
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
from __future__ import absolute_import, division, print_function
__metaclass__ = type
import os
import tempfile
# This is taken from community.crypto
def write_file(module, content):
'''
Writes content into destination file as securely as possible.
Uses file arguments from module.
'''
# Find out parameters for file
file_args = module.load_file_common_arguments(module.params)
# Create tempfile name
tmp_fd, tmp_name = tempfile.mkstemp(prefix=b'.ansible_tmp')
try:
os.close(tmp_fd)
except Exception:
pass
module.add_cleanup_file(tmp_name) # if we fail, let Ansible try to remove the file
try:
try:
# Create tempfile
file = os.open(tmp_name, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
os.write(file, content)
os.close(file)
except Exception as e:
try:
os.remove(tmp_name)
except Exception:
pass
module.fail_json(msg='Error while writing result into temporary file: {0}'.format(e))
# Update destination to wanted permissions
if os.path.exists(file_args['path']):
module.set_fs_attributes_if_different(file_args, False)
# Move tempfile to final destination
module.atomic_move(os.path.abspath(tmp_name), os.path.abspath(file_args['path']))
# Try to update permissions again
module.set_fs_attributes_if_different(file_args, False)
except Exception as e:
try:
os.remove(tmp_name)
except Exception:
pass
module.fail_json(msg='Error while writing result: {0}'.format(e))

436
ansible_collections/community/sops/plugins/module_utils/sops.py Normal file
View file

@ -0,0 +1,436 @@
# Copyright (c), Edoardo Tenani <e.tenani@arduino.cc>, 2018-2020
# Simplified BSD License (see LICENSES/BSD-2-Clause.txt or https://opensource.org/licenses/BSD-2-Clause)
# SPDX-License-Identifier: BSD-2-Clause
from __future__ import absolute_import, division, print_function
__metaclass__ = type
import collections
import json
import os
import re
from ansible.module_utils.common.text.converters import to_text, to_native
# Since this is used both by plugins and modules, we need subprocess in case the `module` parameter is not used
from subprocess import Popen, PIPE
# From https://github.com/getsops/sops/blob/master/cmd/sops/codes/codes.go
# Should be manually updated
SOPS_ERROR_CODES = {
1: "ErrorGeneric",
2: "CouldNotReadInputFile",
3: "CouldNotWriteOutputFile",
4: "ErrorDumpingTree",
5: "ErrorReadingConfig",
6: "ErrorInvalidKMSEncryptionContextFormat",
7: "ErrorInvalidSetFormat",
8: "ErrorConflictingParameters",
21: "ErrorEncryptingMac",
23: "ErrorEncryptingTree",
24: "ErrorDecryptingMac",
25: "ErrorDecryptingTree",
49: "CannotChangeKeysFromNonExistentFile",
51: "MacMismatch",
52: "MacNotFound",
61: "ConfigFileNotFound",
85: "KeyboardInterrupt",
91: "InvalidTreePathFormat",
100: "NoFileSpecified",
128: "CouldNotRetrieveKey",
111: "NoEncryptionKeyFound",
200: "FileHasNotBeenModified",
201: "NoEditorFound",
202: "FailedToCompareVersions",
203: "FileAlreadyEncrypted"
}
_SOPS_VERSION = re.compile(r'^sops ([0-9]+)\.([0-9]+)\.([0-9]+)')
def _add_argument(arguments_pre, arguments_post, *args, **kwargs):
pre = kwargs.pop('pre', False)
(arguments_pre if pre else arguments_post).extend(args)
def _create_single_arg(argument_name, pre=False):
def f(value, arguments_pre, arguments_post, env, version):
_add_argument(arguments_pre, arguments_post, argument_name, to_native(value), pre=pre)
return f
def _create_comma_separated(argument_name, pre=False):
def f(value, arguments_pre, arguments_post, env, version):
value = ','.join([to_native(v) for v in value])
_add_argument(arguments_pre, arguments_post, argument_name, value, pre=pre)
return f
def _create_repeated(argument_name, pre=False):
def f(value, arguments_pre, arguments_post, env, version):
for v in value:
_add_argument(arguments_pre, arguments_post, argument_name, to_native(v), pre=pre)
return f
def _create_boolean(argument_name, pre=False, invert=False):
def f(value, arguments_pre, arguments_post, env, version):
if value ^ invert:
_add_argument(arguments_pre, arguments_post, argument_name, pre=pre)
return f
def _create_env_variable(argument_name):
def f(value, arguments_pre, arguments_post, env, version):
env[argument_name] = value
return f
GENERAL_OPTIONS = {
'age_key': _create_env_variable('SOPS_AGE_KEY'),
'age_keyfile': _create_env_variable('SOPS_AGE_KEY_FILE'),
'age_ssh_private_keyfile': _create_env_variable('SOPS_AGE_SSH_PRIVATE_KEY_FILE'),
'aws_profile': _create_single_arg('--aws-profile'),
'aws_access_key_id': _create_env_variable('AWS_ACCESS_KEY_ID'),
'aws_secret_access_key': _create_env_variable('AWS_SECRET_ACCESS_KEY'),
'aws_session_token': _create_env_variable('AWS_SESSION_TOKEN'),
'config_path': _create_single_arg('--config', pre=True),
'enable_local_keyservice': _create_boolean('--enable-local-keyservice=false', invert=True),
'keyservice': _create_repeated('--keyservice'),
}
ENCRYPT_OPTIONS = {
'age': _create_comma_separated('--age'),
'kms': _create_comma_separated('--kms'),
'gcp_kms': _create_comma_separated('--gcp-kms'),
'azure_kv': _create_comma_separated('--azure-kv'),
'hc_vault_transit': _create_comma_separated('--hc-vault-transit'),
'pgp': _create_comma_separated('--pgp'),
'unencrypted_suffix': _create_single_arg('--unencrypted-suffix'),
'encrypted_suffix': _create_single_arg('--encrypted-suffix'),
'unencrypted_regex': _create_single_arg('--unencrypted-regex'),
'encrypted_regex': _create_single_arg('--encrypted-regex'),
'encryption_context': _create_comma_separated('--encryption-context'),
'shamir_secret_sharing_threshold': _create_single_arg('--shamir-secret-sharing-threshold'),
}
class SopsError(Exception):
''' Extend Exception class with sops specific information '''
def __init__(self, filename, exit_code, message, decryption=True, operation=None):
if operation is None:
operation = 'decrypt' if decryption else 'encrypt'
if exit_code in SOPS_ERROR_CODES:
exception_name = SOPS_ERROR_CODES[exit_code]
message = "error with file %s: %s exited with code %d: %s" % (
filename, exception_name, exit_code, to_native(message))
else:
message = "could not %s file %s; Unknown sops error code: %s; message: %s" % (
operation, filename, exit_code, to_native(message))
super(SopsError, self).__init__(message)
SopsFileStatus = collections.namedtuple('SopsFileStatus', ['encrypted'])
class SopsRunner(object):
def _add_options(self, command_pre, command_post, env, get_option_value, options):
if get_option_value is None:
return
for option, f in options.items():
v = get_option_value(option)
if v is not None:
f(v, command_pre, command_post, env, self.version)
def _debug(self, message):
if self.display:
self.display.vvvv(message)
elif self.module:
self.module.debug(message)
def _warn(self, message):
if self.display:
self.display.warning(message)
elif self.module:
self.module.warn(message)
def __init__(self, binary, module=None, display=None):
self.binary = binary
self.module = module
self.display = display
self.version = (3, 7, 3) # if --disable-version-check is not supported, this is version 3.7.3 or older
self.version_string = '(before 3.8.0)'
exit_code, output, err = self._run_command([self.binary, '--version', '--disable-version-check'])
if exit_code == 0:
m = _SOPS_VERSION.match(output.decode('utf-8'))
if m:
self.version = int(m.group(1)), int(m.group(2)), int(m.group(3))
self.version_string = '%d.%d.%d' % self.version
self._debug('SOPS version detected as %s' % (self.version, ))
else:
self._warn('Cannot extract SOPS version from: %s' % repr(output))
else:
self._debug('Cannot detect SOPS version efficiently, likely a version before 3.8.0')
def _run_command(self, command, env=None, data=None, cwd=None):
if self.module:
return self.module.run_command(command, environ_update=env, cwd=cwd, encoding=None, data=data, binary_data=True)
process = Popen(command, stdin=None if data is None else PIPE, stdout=PIPE, stderr=PIPE, cwd=cwd, env=env)
output, err = process.communicate(input=data)
return process.returncode, output, err
def decrypt(self, encrypted_file, content=None,
decode_output=True, rstrip=True, input_type=None, output_type=None, get_option_value=None, extract=None):
# Run sops directly, python module is deprecated
command = [self.binary]
command_post = []
env = os.environ.copy()
self._add_options(command, command_post, env, get_option_value, GENERAL_OPTIONS)
if self.version >= (3, 9, 0):
command.append("decrypt")
command.extend(command_post)
if input_type is not None:
command.extend(["--input-type", input_type])
if output_type is not None:
command.extend(["--output-type", output_type])
if self.version < (3, 9, 0):
command.append("--decrypt")
if extract is not None:
command.extend(["--extract", extract])
if content is not None:
encrypted_file = '/dev/stdin'
command.append(encrypted_file)
exit_code, output, err = self._run_command(command, env=env, data=content)
if decode_output:
# output is binary, we want UTF-8 string
output = to_text(output, errors='surrogate_or_strict')
# the process output is the decrypted secret; be cautious
# sops logs always to stderr, as stdout is used for
# file content
if err:
self._debug(u'Unexpected stderr:\n' + to_text(err, errors='surrogate_or_strict'))
if exit_code != 0:
raise SopsError(encrypted_file, exit_code, err, decryption=True)
if rstrip:
output = output.rstrip()
return output
def encrypt(self, data, cwd=None, input_type=None, output_type=None, filename=None, get_option_value=None):
# Run sops directly, python module is deprecated
command = [self.binary]
command_post = []
env = os.environ.copy()
self._add_options(command, command_post, env, get_option_value, GENERAL_OPTIONS)
self._add_options(command, command_post, env, get_option_value, ENCRYPT_OPTIONS)
if self.version >= (3, 9, 0):
command.append("encrypt")
command.extend(command_post)
if input_type is not None:
command.extend(["--input-type", input_type])
if output_type is not None:
command.extend(["--output-type", output_type])
if self.version < (3, 9, 0):
command.append("--encrypt")
if self.version >= (3, 9, 0) and filename:
command.extend(["--filename-override", filename])
command.append("/dev/stdin")
exit_code, output, err = self._run_command(command, env=env, data=data, cwd=cwd)
# sops logs always to stderr, as stdout is used for
# file content
if err:
self._debug(u'Unexpected stderr:\n' + to_text(err, errors='surrogate_or_strict'))
if exit_code != 0:
raise SopsError('to stdout', exit_code, err, decryption=False)
return output
def has_filestatus(self):
return self.version >= (3, 9, 0)
def get_filestatus(self, path):
command = [self.binary, 'filestatus', path]
exit_code, output, err = self._run_command(command)
# sops logs always to stderr, as stdout is used for
# file content
if err:
self._debug(u'Unexpected stderr:\n' + to_text(err, errors='surrogate_or_strict'))
if exit_code != 0:
raise SopsError(path, exit_code, err, operation='inspect')
try:
result = json.loads(output)
return SopsFileStatus(result['encrypted'])
except Exception as exc:
self._debug(u'Unexpected stdout:\n' + to_text(output, errors='surrogate_or_strict'))
raise SopsError(path, 0, 'Cannot decode filestatus result: %s' % exc, operation='inspect')
_SOPS_RUNNER_CACHE = dict()
class Sops():
''' Utility class to perform sops CLI actions '''
@staticmethod
def get_sops_binary(get_option_value):
cmd = get_option_value('sops_binary') if get_option_value else None
if cmd is None:
cmd = 'sops'
return cmd
@staticmethod
def get_sops_runner_from_binary(sops_binary, module=None, display=None):
candidates = _SOPS_RUNNER_CACHE.get(sops_binary, [])
for cand_module, cand_runner in candidates:
if cand_runner is module:
return cand_runner
runner = SopsRunner(sops_binary, module=module, display=display)
candidates.append((module, runner))
_SOPS_RUNNER_CACHE[sops_binary] = candidates
return runner
@staticmethod
def get_sops_runner_from_options(get_option_value, module=None, display=None):
return Sops.get_sops_runner_from_binary(Sops.get_sops_binary(get_option_value), module=module, display=display)
@staticmethod
def decrypt(encrypted_file, content=None,
display=None, decode_output=True, rstrip=True, input_type=None, output_type=None, get_option_value=None, module=None, extract=None):
runner = Sops.get_sops_runner_from_options(get_option_value, module=module, display=display)
return runner.decrypt(
encrypted_file,
content=content,
decode_output=decode_output,
rstrip=rstrip,
input_type=input_type,
output_type=output_type,
get_option_value=get_option_value,
extract=extract,
)
@staticmethod
def encrypt(data, display=None, cwd=None, input_type=None, output_type=None, get_option_value=None, module=None, filename=None):
runner = Sops.get_sops_runner_from_options(get_option_value, module=module, display=display)
return runner.encrypt(
data,
cwd=cwd,
input_type=input_type,
output_type=output_type,
get_option_value=get_option_value,
filename=filename,
)
def get_sops_argument_spec(add_encrypt_specific=False):
argument_spec = {
'sops_binary': {
'type': 'path',
},
'age_key': {
'type': 'str',
'no_log': True,
},
'age_keyfile': {
'type': 'path',
},
'age_ssh_private_keyfile': {
'type': 'path',
},
'aws_profile': {
'type': 'str',
},
'aws_access_key_id': {
'type': 'str',
},
'aws_secret_access_key': {
'type': 'str',
'no_log': True,
},
'aws_session_token': {
'type': 'str',
'no_log': True,
},
'config_path': {
'type': 'path',
},
'enable_local_keyservice': {
'type': 'bool',
'default': True,
},
'keyservice': {
'type': 'list',
'elements': 'str',
},
}
if add_encrypt_specific:
argument_spec.update({
'age': {
'type': 'list',
'elements': 'str',
},
'kms': {
'type': 'list',
'elements': 'str',
},
'gcp_kms': {
'type': 'list',
'elements': 'str',
},
'azure_kv': {
'type': 'list',
'elements': 'str',
},
'hc_vault_transit': {
'type': 'list',
'elements': 'str',
},
'pgp': {
'type': 'list',
'elements': 'str',
},
'unencrypted_suffix': {
'type': 'str',
},
'encrypted_suffix': {
'type': 'str',
},
'unencrypted_regex': {
'type': 'str',
},
'encrypted_regex': {
'type': 'str',
},
'encryption_context': {
'type': 'list',
'elements': 'str',
},
'shamir_secret_sharing_threshold': {
'type': 'int',
'no_log': False,
},
})
return argument_spec

117
ansible_collections/community/sops/plugins/modules/load_vars.py Normal file
View file

@ -0,0 +1,117 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
from __future__ import absolute_import, division, print_function
__metaclass__ = type
DOCUMENTATION = r"""
author: Felix Fontein (@felixfontein)
module: load_vars
short_description: Load SOPS-encrypted variables from files, dynamically within a task
version_added: '0.1.0'
description:
- Loads SOPS-encrypted YAML/JSON variables dynamically from a file during task runtime.
- To assign included variables to a different host than C(inventory_hostname), use C(delegate_to) and set C(delegate_facts=true).
options:
file:
description:
- The file name from which variables should be loaded.
- If the path is relative, it will look for the file in C(vars/) subdirectory of a role or relative to playbook.
type: path
name:
description:
- The name of a variable into which assign the included vars.
- If omitted (V(null)) they will be made top level vars.
type: str
expressions:
description:
- This option controls how Jinja2 expressions in values in the loaded file are handled.
- If set to V(ignore), expressions will not be evaluated, but treated as regular strings.
- If set to V(evaluate-on-load), expressions will be evaluated on execution of this module, in other words, when the
file is loaded.
- If set to V(lazy-evaluation), expressions will be lazily evaluated. This requires ansible-core 2.19 or newer
and is the same behavior than M(ansible.builtin.include_vars). V(lazy-evaluation) has been added in community.sops 2.2.0.
type: str
default: ignore
choices:
- ignore
- evaluate-on-load
- lazy-evaluation
extends_documentation_fragment:
- community.sops.sops
- community.sops.attributes
- community.sops.attributes.facts
- community.sops.attributes.flow
attributes:
action:
support: full
async:
support: none
details:
- This action runs completely on the controller.
check_mode:
support: full
diff_mode:
support: N/A
details:
- This action does not modify state.
facts:
support: full
idempotent:
support: N/A
details:
- The action has no C(changed) state.
seealso:
- module: ansible.builtin.set_fact
- module: ansible.builtin.include_vars
- ref: playbooks_delegation
description: More information related to task delegation.
- plugin: community.sops.sops
plugin_type: lookup
description: The sops lookup can be used decrypt SOPS-encrypted files.
- plugin: community.sops.decrypt
plugin_type: filter
description: The decrypt filter can be used to descrypt SOPS-encrypted in-memory data.
- plugin: community.sops.sops
plugin_type: vars
description: The sops vars plugin can be used to load SOPS-encrypted host or group variables.
"""
EXAMPLES = r"""
---
- name: Include variables of stuff.sops.yaml into the 'stuff' variable
community.sops.load_vars:
file: stuff.sops.yaml
name: stuff
expressions: evaluate-on-load # interpret Jinja2 expressions in stuf.sops.yaml on load-time!
- name: Conditionally decide to load in variables into 'plans' when x is 0, otherwise do not
community.sops.load_vars:
file: contingency_plan.sops.yaml
name: plans
expressions: ignore # do not interpret possible Jinja2 expressions
when: x == 0
- name: Load variables into the global namespace
community.sops.load_vars:
file: contingency_plan.sops.yaml
"""
RETURN = r"""
ansible_facts:
description: Variables that were included and their values.
returned: success
type: dict
sample: {'variable': 'value'}
ansible_included_var_files:
description: A list of files that were successfully included.
returned: success
type: list
elements: str
sample: [/path/to/file.sops.yaml]
"""

239
ansible_collections/community/sops/plugins/modules/sops_encrypt.py Normal file
View file

@ -0,0 +1,239 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
# Copyright (c) 2020, Felix Fontein <felix@fontein.de>
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
from __future__ import absolute_import, division, print_function
__metaclass__ = type
DOCUMENTATION = r"""
author: Felix Fontein (@felixfontein)
module: sops_encrypt
short_description: Encrypt data with SOPS
version_added: '0.1.0'
description:
- Allows to encrypt binary data (Base64 encoded), text data, JSON or YAML data with SOPS.
options:
path:
description:
- The SOPS encrypt file.
type: path
required: true
force:
description:
- Force rewriting the encrypted file.
type: bool
default: false
content_text:
description:
- The data to encrypt. Must be a Unicode text.
- Please note that the module might not be idempotent if the text can be parsed as JSON or YAML.
- Exactly one of O(content_text), O(content_binary), O(content_json), and O(content_yaml) must be specified.
type: str
content_binary:
description:
- The data to encrypt. Must be L(Base64 encoded,https://en.wikipedia.org/wiki/Base64) binary data.
- Please note that the module might not be idempotent if the data can be parsed as JSON or YAML.
- Exactly one of O(content_text), O(content_binary), O(content_json), and O(content_yaml) must be specified.
type: str
content_json:
description:
- The data to encrypt. Must be a JSON dictionary.
- Exactly one of O(content_text), O(content_binary), O(content_json), and O(content_yaml) must be specified.
type: dict
content_yaml:
description:
- The data to encrypt. Must be a YAML dictionary.
- Please note that Ansible only allows to pass data that can be represented as a JSON dictionary.
- Exactly one of O(content_text), O(content_binary), O(content_json), and O(content_yaml) must be specified.
type: dict
extends_documentation_fragment:
- ansible.builtin.files
- community.sops.sops
- community.sops.sops.encrypt_specific
- community.sops.attributes
- community.sops.attributes.files
attributes:
check_mode:
support: full
diff_mode:
support: none
safe_file_operations:
support: full
idempotent:
support: full
seealso:
- plugin: community.sops.sops
plugin_type: lookup
description: The sops lookup can be used decrypt SOPS-encrypted files.
"""
EXAMPLES = r"""
---
- name: Encrypt a secret text
community.sops.sops_encrypt:
path: text-data.sops
content_text: This is a secret text.
- name: Encrypt the contents of a file
community.sops.sops_encrypt:
path: binary-data.sops
content_binary: "{{ lookup('ansible.builtin.file', '/path/to/file', rstrip=false) | b64encode }}"
- name: Encrypt some datastructure as YAML
community.sops.sops_encrypt:
path: stuff.sops.yaml
content_yaml: "{{ result }}"
"""
RETURN = r"""#"""
import base64
import json
import os
import traceback
from ansible.module_utils.basic import AnsibleModule, missing_required_lib
from ansible.module_utils.common.text.converters import to_text
from ansible_collections.community.sops.plugins.module_utils.io import write_file
from ansible_collections.community.sops.plugins.module_utils.sops import Sops, SopsError, get_sops_argument_spec
try:
import yaml
YAML_IMP_ERR = None
HAS_YAML = True
except ImportError:
YAML_IMP_ERR = traceback.format_exc()
HAS_YAML = False
yaml = None
def get_data_type(module):
if module.params['content_text'] is not None:
return 'binary'
if module.params['content_binary'] is not None:
return 'binary'
if module.params['content_json'] is not None:
return 'json'
if module.params['content_yaml'] is not None:
return 'yaml'
module.fail_json(msg='Internal error: unknown content type')
def compare_encoded_content(module, binary_data, content):
if module.params['content_text'] is not None:
return content == module.params['content_text'].encode('utf-8')
if module.params['content_binary'] is not None:
return content == binary_data
if module.params['content_json'] is not None:
# Compare JSON
try:
return json.loads(content) == module.params['content_json']
except Exception:
# Treat parsing errors as content not equal
return False
if module.params['content_yaml'] is not None:
# Compare YAML
try:
return yaml.safe_load(content) == module.params['content_yaml']
except Exception:
# Treat parsing errors as content not equal
return False
module.fail_json(msg='Internal error: unknown content type')
def get_encoded_type_content(module, binary_data):
if module.params['content_text'] is not None:
return 'binary', module.params['content_text'].encode('utf-8')
if module.params['content_binary'] is not None:
return 'binary', binary_data
if module.params['content_json'] is not None:
return 'json', json.dumps(module.params['content_json']).encode('utf-8')
if module.params['content_yaml'] is not None:
return 'yaml', yaml.safe_dump(module.params['content_yaml']).encode('utf-8')
module.fail_json(msg='Internal error: unknown content type')
def main():
argument_spec = dict(
path=dict(type='path', required=True),
force=dict(type='bool', default=False),
content_text=dict(type='str', no_log=True),
content_binary=dict(type='str', no_log=True),
content_json=dict(type='dict', no_log=True),
content_yaml=dict(type='dict', no_log=True),
)
argument_spec.update(get_sops_argument_spec(add_encrypt_specific=True))
module = AnsibleModule(
argument_spec=argument_spec,
mutually_exclusive=[
('content_text', 'content_binary', 'content_json', 'content_yaml'),
],
required_one_of=[
('content_text', 'content_binary', 'content_json', 'content_yaml'),
],
supports_check_mode=True,
add_file_common_args=True,
)
# Check YAML
if module.params['content_yaml'] is not None and not HAS_YAML:
module.fail_json(msg=missing_required_lib('pyyaml'), exception=YAML_IMP_ERR)
# Decode binary data
binary_data = None
if module.params['content_binary'] is not None:
try:
binary_data = base64.b64decode(module.params['content_binary'])
except Exception as e:
module.fail_json(msg='Cannot decode Base64 encoded data: {0}'.format(e))
path = module.params['path']
directory = os.path.dirname(path) or None
changed = False
def get_option_value(argument_name):
return module.params.get(argument_name)
try:
if module.params['force'] or not os.path.exists(path):
# Simply encrypt
changed = True
else:
# Change detection: check if encrypted data equals new data
decrypted_content = Sops.decrypt(
path, decode_output=False, output_type=get_data_type(module), rstrip=False,
get_option_value=get_option_value, module=module,
)
if not compare_encoded_content(module, binary_data, decrypted_content):
changed = True
if changed and not module.check_mode:
input_type, input_data = get_encoded_type_content(module, binary_data)
output_type = None
if path.endswith('.json'):
output_type = 'json'
elif path.endswith(('.yml', '.yaml')):
output_type = 'yaml'
data = Sops.encrypt(
data=input_data, cwd=directory, input_type=input_type, output_type=output_type,
filename=os.path.relpath(path, directory) if directory is not None else path,
get_option_value=get_option_value, module=module,
)
write_file(module, data)
except SopsError as e:
module.fail_json(msg=to_text(e))
file_args = module.load_file_common_arguments(module.params)
changed = module.set_fs_attributes_if_different(file_args, changed)
module.exit_json(changed=changed)
if __name__ == '__main__':
main()

239
ansible_collections/community/sops/plugins/plugin_utils/action_module.py Normal file
View file

@ -0,0 +1,239 @@
# Copyright (c) 2012-2013 Michael DeHaan <michael.dehaan@gmail.com>
# Copyright (c) 2016 Toshio Kuratomi <tkuratomi@ansible.com>
# Copyright (c) 2019 Ansible Project
# Copyright (c) 2020 Felix Fontein <felix@fontein.de>
# Copyright (c) 2021 Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# Parts taken from ansible.module_utils.basic and ansible.module_utils.common.warnings.
# NOTE: THIS IS ONLY FOR ACTION PLUGINS!
from __future__ import annotations
import abc
import copy
import traceback
from ansible.errors import AnsibleError
from ansible.module_utils.basic import SEQUENCETYPE, remove_values
from collections.abc import Mapping
from ansible.plugins.action import ActionBase
from ansible.module_utils.common.arg_spec import ArgumentSpecValidator
from ansible.module_utils.errors import UnsupportedError
try:
from ansible.module_utils.common.validation import (
safe_eval,
)
except ImportError:
safe_eval = None
class _ModuleExitException(Exception):
def __init__(self, result):
super().__init__()
self.result = result
class AnsibleActionModule:
def __init__(self, action_plugin, argument_spec, bypass_checks=False,
mutually_exclusive=None, required_together=None,
required_one_of=None, supports_check_mode=False,
required_if=None, required_by=None):
# Internal data
self.__action_plugin = action_plugin
self.__warnings = []
self.__deprecations = []
# AnsibleModule data
self._name = self.__action_plugin._task.action
self.argument_spec = argument_spec
self.supports_check_mode = supports_check_mode
self.check_mode = self.__action_plugin._play_context.check_mode
self.bypass_checks = bypass_checks
self.no_log = self.__action_plugin._play_context.no_log
self.mutually_exclusive = mutually_exclusive
self.required_together = required_together
self.required_one_of = required_one_of
self.required_if = required_if
self.required_by = required_by
self._diff = self.__action_plugin._play_context.diff
self._verbosity = self.__action_plugin._display.verbosity
self.aliases = {}
self._legal_inputs = []
self._options_context = list()
self.params = copy.deepcopy(self.__action_plugin._task.args)
self.no_log_values = set()
self._validator = ArgumentSpecValidator(
self.argument_spec,
self.mutually_exclusive,
self.required_together,
self.required_one_of,
self.required_if,
self.required_by,
)
self._validation_result = self._validator.validate(self.params)
self.params.update(self._validation_result.validated_parameters)
self.no_log_values.update(self._validation_result._no_log_values)
try:
error = self._validation_result.errors[0]
except IndexError:
error = None
# We cannot use ModuleArgumentSpecValidator directly since it uses mechanisms for reporting
# warnings and deprecations that do not work in plugins. This is a copy of that code adjusted
# for our use-case:
for d in self._validation_result._deprecations:
# Before ansible-core 2.14.2, deprecations were always for aliases:
if 'name' in d:
self.deprecate(
"Alias '{name}' is deprecated. See the module docs for more information".format(name=d['name']),
version=d.get('version'), date=d.get('date'), collection_name=d.get('collection_name'))
# Since ansible-core 2.14.2, a message is present that can be directly printed:
if 'msg' in d:
self.deprecate(d['msg'], version=d.get('version'), date=d.get('date'), collection_name=d.get('collection_name'))
for w in self._validation_result._warnings:
self.warn('Both option {option} and its alias {alias} are set.'.format(option=w['option'], alias=w['alias']))
# Fail for validation errors, even in check mode
if error:
msg = self._validation_result.errors.msg
if isinstance(error, UnsupportedError):
msg = "Unsupported parameters for ({name}) {kind}: {msg}".format(name=self._name, kind='module', msg=msg)
self.fail_json(msg=msg)
def safe_eval(self, value, locals=None, include_exceptions=False):
if safe_eval is None:
raise ValueError("safe_eval is not available since ansible-core 2.21")
return safe_eval(value, locals, include_exceptions)
def warn(self, warning):
# Copied from ansible.module_utils.common.warnings:
if isinstance(warning, str):
self.__warnings.append(warning)
else:
raise TypeError("warn requires a string not a %s" % type(warning))
def deprecate(self, msg, version=None, date=None, collection_name=None):
if version is not None and date is not None:
raise AssertionError("implementation error -- version and date must not both be set")
# Copied from ansible.module_utils.common.warnings:
if isinstance(msg, str):
# For compatibility, we accept that neither version nor date is set,
# and treat that the same as if version would haven been set
if date is not None:
self.__deprecations.append({'msg': msg, 'date': date, 'collection_name': collection_name})
else:
self.__deprecations.append({'msg': msg, 'version': version, 'collection_name': collection_name})
else:
raise TypeError("deprecate requires a string not a %s" % type(msg))
def _return_formatted(self, kwargs):
if 'invocation' not in kwargs:
kwargs['invocation'] = {'module_args': self.params}
if 'warnings' in kwargs:
if isinstance(kwargs['warnings'], list):
for w in kwargs['warnings']:
self.warn(w)
else:
self.warn(kwargs['warnings'])
if self.__warnings:
kwargs['warnings'] = self.__warnings
if 'deprecations' in kwargs:
if isinstance(kwargs['deprecations'], list):
for d in kwargs['deprecations']:
if isinstance(d, SEQUENCETYPE) and len(d) == 2:
self.deprecate(d[0], version=d[1])
elif isinstance(d, Mapping):
self.deprecate(d['msg'], version=d.get('version'), date=d.get('date'),
collection_name=d.get('collection_name'))
else:
self.deprecate(d) # pylint: disable=ansible-deprecated-no-version
else:
self.deprecate(kwargs['deprecations']) # pylint: disable=ansible-deprecated-no-version
if self.__deprecations:
kwargs['deprecations'] = self.__deprecations
kwargs = remove_values(kwargs, self.no_log_values)
raise _ModuleExitException(kwargs)
def exit_json(self, **kwargs):
result = dict(kwargs)
if 'failed' not in result:
result['failed'] = False
self._return_formatted(result)
def fail_json(self, msg, **kwargs):
result = dict(kwargs)
result['failed'] = True
result['msg'] = msg
self._return_formatted(result)
class ActionModuleBase(ActionBase, metaclass=abc.ABCMeta):
@abc.abstractmethod
def setup_module(self):
"""Return pair (ArgumentSpec, kwargs)."""
pass
@abc.abstractmethod
def run_module(self, module):
"""Run module code"""
module.fail_json(msg='Not implemented.')
def run(self, tmp=None, task_vars=None):
if task_vars is None:
task_vars = dict()
result = super().run(tmp, task_vars)
del tmp # tmp no longer has any effect
try:
argument_spec, kwargs = self.setup_module()
module = argument_spec.create_ansible_module_helper(AnsibleActionModule, (self, ), **kwargs)
self.run_module(module)
raise AnsibleError('Internal error: action module did not call module.exit_json()')
except _ModuleExitException as mee:
result.update(mee.result)
return result
except Exception as dummy:
result['failed'] = True
result['msg'] = 'MODULE FAILURE'
result['exception'] = traceback.format_exc()
return result
class ArgumentSpec:
def __init__(self, argument_spec, mutually_exclusive=None, required_together=None, required_one_of=None, required_if=None, required_by=None):
self.argument_spec = argument_spec
self.mutually_exclusive = mutually_exclusive or []
self.required_together = required_together or []
self.required_one_of = required_one_of or []
self.required_if = required_if or []
self.required_by = required_by or {}
def create_ansible_module_helper(self, clazz, args, **kwargs):
return clazz(
*args,
argument_spec=self.argument_spec,
mutually_exclusive=self.mutually_exclusive,
required_together=self.required_together,
required_one_of=self.required_one_of,
required_if=self.required_if,
required_by=self.required_by,
**kwargs)

246
ansible_collections/community/sops/plugins/vars/sops.py Normal file
View file

@ -0,0 +1,246 @@
# Copyright (c) 2018 Edoardo Tenani <e.tenani@arduino.cc> (@endorama)
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
from __future__ import annotations
DOCUMENTATION = r"""
name: sops
author: Edoardo Tenani (@endorama) <e.tenani@arduino.cc>
short_description: Loading SOPS-encrypted vars files
version_added: '0.1.0'
description:
- Load encrypted YAML files into corresponding groups/hosts in C(group_vars/) and C(host_vars/) directories.
- Files are encrypted prior to reading, making this plugin an effective companion to P(ansible.builtin.host_group_vars#vars)
plugin.
- Files are restricted to V(.sops.yaml), V(.sops.yml), V(.sops.json) extensions, unless configured otherwise with O(valid_extensions).
- Hidden files are ignored.
options:
valid_extensions:
default: [".sops.yml", ".sops.yaml", ".sops.json"]
description:
- Check all of these extensions when looking for 'variable' files.
- These files must be SOPS encrypted YAML or JSON files.
- By default the plugin will produce errors when encountering files matching these extensions that are not SOPS encrypted.
This behavior can be controlled with the O(handle_unencrypted_files) option.
type: list
elements: string
ini:
- key: valid_extensions
section: community.sops
version_added: 1.7.0
env:
- name: ANSIBLE_VARS_SOPS_PLUGIN_VALID_EXTENSIONS
version_added: 1.7.0
stage:
version_added: 0.2.0
ini:
- key: vars_stage
section: community.sops
env:
- name: ANSIBLE_VARS_SOPS_PLUGIN_STAGE
cache:
description:
- Whether to cache decrypted files or not.
- If the cache is disabled, the files will be decrypted for almost every task. This is very slow!
- Only disable caching if you modify the variable files during a playbook run and want the updated result to be available
from the next task on.
- 'Note that setting O(stage=inventory) has the same effect as setting O(cache=true): the variables will be loaded only
once (during inventory loading) and the vars plugin will not be called for every task.'
type: bool
default: true
version_added: 0.2.0
ini:
- key: vars_cache
section: community.sops
env:
- name: ANSIBLE_VARS_SOPS_PLUGIN_CACHE
disable_vars_plugin_temporarily:
description:
- Temporarily disable this plugin.
- Useful if ansible-inventory is supposed to be run without decrypting secrets (in AWX for instance).
type: bool
default: false
version_added: 1.3.0
env:
- name: SOPS_ANSIBLE_AWX_DISABLE_VARS_PLUGIN_TEMPORARILY
handle_unencrypted_files:
description:
- How to handle files that match the extensions in O(valid_extensions) that are not SOPS encrypted.
- The default value V(error) will produce an error.
- The value V(skip) will simply skip these files. This requires SOPS 3.9.0 or later.
- The value V(warn) will skip these files and emit a warning. This requires SOPS 3.9.0 or later.
- B(Note) that this will not help if the store SOPS uses cannot parse the file, for example because it is no valid JSON/YAML/...
file despite its file extension. For extensions other than the default ones SOPS uses the binary store, which tries
to parse the file as JSON.
type: string
choices:
- skip
- warn
- error
default: error
version_added: 1.8.0
ini:
- key: handle_unencrypted_files
section: community.sops
env:
- name: ANSIBLE_VARS_SOPS_PLUGIN_HANDLE_UNENCRYPTED_FILES
extends_documentation_fragment:
- ansible.builtin.vars_plugin_staging
- community.sops.sops
- community.sops.sops.ansible_env
- community.sops.sops.ansible_ini
seealso:
- plugin: community.sops.sops
plugin_type: lookup
description: The sops lookup can be used decrypt SOPS-encrypted files.
- plugin: community.sops.decrypt
plugin_type: filter
description: The decrypt filter can be used to decrypt SOPS-encrypted in-memory data.
- module: community.sops.load_vars
"""
import os
from collections.abc import Sequence, Mapping
from ansible.errors import AnsibleParserError
from ansible.inventory.host import Host
from ansible.inventory.group import Group
from ansible.module_utils.common.text.converters import to_bytes, to_native, to_text
from ansible.plugins.vars import BaseVarsPlugin
from ansible.utils.display import Display
from ansible.utils.vars import combine_vars
from ansible_collections.community.sops.plugins.module_utils.sops import Sops, SopsError
try:
from ansible.template import trust_as_template as _trust_as_template
HAS_DATATAGGING = True
except ImportError:
HAS_DATATAGGING = False
display = Display()
FOUND = {}
DECRYPTED = {}
def _make_safe(value):
if isinstance(value, str):
# must come *before* Sequence, as strings are also instances of Sequence
if HAS_DATATAGGING and isinstance(value, str):
return _trust_as_template(value)
return value
if isinstance(value, Sequence):
return [_make_safe(v) for v in value]
if isinstance(value, Mapping):
return dict((k, _make_safe(v)) for k, v in value.items())
return value
class VarsModule(BaseVarsPlugin):
def get_vars(self, loader, path, entities, cache=None):
''' parses the inventory file '''
if not isinstance(entities, list):
entities = [entities]
super().get_vars(loader, path, entities)
def get_option_value(argument_name):
return self.get_option(argument_name)
if cache is None:
cache = self.get_option('cache')
if self.get_option('disable_vars_plugin_temporarily'):
return {}
valid_extensions = self.get_option('valid_extensions')
handle_unencrypted_files = self.get_option('handle_unencrypted_files')
data = {}
for entity in entities:
if isinstance(entity, Host):
subdir = 'host_vars'
elif isinstance(entity, Group):
subdir = 'group_vars'
else:
raise AnsibleParserError("Supplied entity must be Host or Group, got %s instead" % (type(entity)))
# avoid 'chroot' type inventory hostnames /path/to/chroot
if not entity.name.startswith(os.path.sep):
try:
found_files = []
# load vars
b_opath = os.path.realpath(to_bytes(os.path.join(self._basedir, subdir)))
opath = to_text(b_opath)
key = '%s.%s' % (entity.name, opath)
self._display.vvvv("key: %s" % (key))
if cache and key in FOUND:
found_files = FOUND[key]
else:
# no need to do much if path does not exist for basedir
if os.path.exists(b_opath):
if os.path.isdir(b_opath):
self._display.debug("\tprocessing dir %s" % opath)
# NOTE: iterating without extension allow retrieving files recursively
# A filter is then applied by iterating on all results and filtering by
# extension.
# See:
# - https://github.com/ansible-collections/community.sops/pull/6
found_files = loader.find_vars_files(opath, entity.name, extensions=valid_extensions, allow_dir=False)
found_files.extend([file_path for file_path in loader.find_vars_files(opath, entity.name)
if any(to_text(file_path).endswith(extension) for extension in valid_extensions)])
FOUND[key] = found_files
else:
self._display.warning("Found %s that is not a directory, skipping: %s" % (subdir, opath))
for found in found_files:
if cache and found in DECRYPTED:
file_content = DECRYPTED[found]
else:
sops_runner = Sops.get_sops_runner_from_options(get_option_value, display=display)
if handle_unencrypted_files != 'error' and not sops_runner.has_filestatus():
raise AnsibleParserError(
'Cannot use handle_unencrypted_files=%s with SOPS %s' % (handle_unencrypted_files, sops_runner.version_string)
)
try:
file_content = sops_runner.decrypt(found, get_option_value=get_option_value)
except SopsError as exc:
skip = False
if sops_runner.has_filestatus():
# Check whether sops thinks the file might be encrypted. If it thinks it is not,
# skip it. Otherwise, re-raise the original error
try:
file_status = sops_runner.get_filestatus(found)
if not file_status.encrypted:
if handle_unencrypted_files == 'skip':
self._display.vvvv("SOPS vars plugin: skipping unencrypted file %s" % found)
skip = True
elif handle_unencrypted_files == 'warn':
self._display.warning("SOPS vars plugin: skipping unencrypted file %s" % found)
skip = True
elif handle_unencrypted_files == 'error':
raise AnsibleParserError("SOPS vars plugin: file %s is not encrypted" % found)
except SopsError as status_exc:
# The filestatus operation can fail for example if sops cannot parse the file
# as JSON/YAML. In that case, also re-raise the original error
self._display.warning("SOPS vars plugin: cannot obtain file status of %s: %s" % (found, status_exc))
if skip:
continue
raise
DECRYPTED[found] = file_content
new_data = _make_safe(loader.load(file_content))
if new_data: # ignore empty files
data = combine_vars(data, new_data)
except AnsibleParserError:
raise
except SopsError as e:
raise AnsibleParserError(to_native(e))
except Exception as e:
raise AnsibleParserError('Unexpected error in the SOPS vars plugin: %s' % to_native(e))
return data

7
ansible_collections/community/sops/roles/_install_age/README.md Normal file
View file

@ -0,0 +1,7 @@
<!--
GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
SPDX-License-Identifier: GPL-3.0-or-later
SPDX-FileCopyrightText: 2022, Felix Fontein
-->
See [the documentation](https://docs.ansible.com/ansible/devel/collections/community/sops/).

7
ansible_collections/community/sops/roles/_install_age/defaults/main.yml Normal file
View file

@ -0,0 +1,7 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2022, Felix Fontein
sops_install_on_localhost: false
sops_become_on_install: true

11
ansible_collections/community/sops/roles/_install_age/meta/main.yml Normal file
View file

@ -0,0 +1,11 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2022, Felix Fontein
galaxy_info:
standalone: false
description: >
[INTERNAL] Install age (https://age-encryption.org/).
dependencies: []

64
ansible_collections/community/sops/roles/_install_age/tasks/main.yml Normal file
View file

@ -0,0 +1,64 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2022, Felix Fontein
- name: Gather required information on localhost
when: sops_install_on_localhost
ansible.builtin.setup:
gather_subset:
- '!all'
- '!min'
- architecture
- distribution
- distribution_major_version
- distribution_version
- os_family
delegate_to: localhost
delegate_facts: true
run_once: true
- vars:
_community_sops_install_age_facts: >-
{{ hostvars['localhost' if sops_install_on_localhost else inventory_hostname].ansible_facts }}
block:
- name: Show system information
ansible.builtin.debug:
msg: |-
Architecture: {{ _community_sops_install_age_facts.architecture }}
Distribution: {{ _community_sops_install_age_facts.distribution }} {{ _community_sops_install_age_facts.distribution_major_version }}
Distribution version: {{ _community_sops_install_age_facts.distribution_version }}
OS family: {{ _community_sops_install_age_facts.os_family }}
- name: Include distribution specific variables
ansible.builtin.include_vars: '{{ lookup("ansible.builtin.first_found", params) }}'
vars:
params:
files:
- >-
D-{{ _community_sops_install_age_facts.distribution }}-{{ _community_sops_install_age_facts.distribution_version }}.yml
- >-
D-{{ _community_sops_install_age_facts.distribution }}-{{ _community_sops_install_age_facts.distribution_major_version }}.yml
- >-
D-{{ _community_sops_install_age_facts.distribution }}.yml
- >-
OS-{{ _community_sops_install_age_facts.os_family }}-{{ _community_sops_install_age_facts.distribution_major_version }}.yml
- >-
OS-{{ _community_sops_install_age_facts.os_family }}.yml
- default.yml
paths:
- '{{ role_path }}/vars'
- name: Install system packages
ansible.builtin.package:
name: '{{ _community_sops_install_age_system_packages }}'
become: '{{ sops_become_on_install }}'
delegate_to: '{{ "localhost" if sops_install_on_localhost else omit }}'
run_once: '{{ sops_install_on_localhost }}'
when: _community_sops_install_age_system_packages | length > 0
- name: Set results
ansible.builtin.set_fact:
age_installed: "{{ _community_sops_install_age_has_age }}"
delegate_to: '{{ "localhost" if sops_install_on_localhost else omit }}'
delegate_facts: '{{ true if sops_install_on_localhost else omit }}'

9
ansible_collections/community/sops/roles/_install_age/vars/D-Alpine.yml Normal file
View file

@ -0,0 +1,9 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
_community_sops_install_age_system_packages:
- age
_community_sops_install_age_has_age: true

9
ansible_collections/community/sops/roles/_install_age/vars/D-Archlinux.yml Normal file
View file

@ -0,0 +1,9 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
_community_sops_install_age_system_packages:
- age
_community_sops_install_age_has_age: true

1
ansible_collections/community/sops/roles/_install_age/vars/D-Debian-10.yml Symbolic link
View file

@ -0,0 +1 @@
default.yml

9
ansible_collections/community/sops/roles/_install_age/vars/D-Fedora.yml Normal file
View file

@ -0,0 +1,9 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
_community_sops_install_age_system_packages:
- age
_community_sops_install_age_has_age: true

1
ansible_collections/community/sops/roles/_install_age/vars/D-Ubuntu-16.yml Symbolic link
View file

@ -0,0 +1 @@
default.yml

1
ansible_collections/community/sops/roles/_install_age/vars/D-Ubuntu-18.yml Symbolic link
View file

@ -0,0 +1 @@
default.yml

1
ansible_collections/community/sops/roles/_install_age/vars/D-Ubuntu-20.yml Symbolic link
View file

@ -0,0 +1 @@
default.yml

9
ansible_collections/community/sops/roles/_install_age/vars/OS-Debian.yml Normal file
View file

@ -0,0 +1,9 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
_community_sops_install_age_system_packages:
- age
_community_sops_install_age_has_age: true

8
ansible_collections/community/sops/roles/_install_age/vars/default.yml Normal file
View file

@ -0,0 +1,8 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
_community_sops_install_age_system_packages: []
_community_sops_install_age_has_age: false

7
ansible_collections/community/sops/roles/install/README.md Normal file
View file

@ -0,0 +1,7 @@
<!--
GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
SPDX-License-Identifier: GPL-3.0-or-later
SPDX-FileCopyrightText: 2022, Felix Fontein
-->
See [the documentation](https://docs.ansible.com/ansible/devel/collections/community/sops/).

10
ansible_collections/community/sops/roles/install/defaults/main.yml Normal file
View file

@ -0,0 +1,10 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2022, Felix Fontein
sops_version: latest
sops_source: auto
sops_install_on_localhost: false
sops_become_on_install: true
sops_github_latest_detection: auto

103
ansible_collections/community/sops/roles/install/meta/argument_specs.yml Normal file
View file

@ -0,0 +1,103 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2022, Felix Fontein
argument_specs:
main:
short_description: Install SOPS
version_added: 1.5.0
description:
- This role installs L(SOPS,https://github.com/getsops/sops) and GNU Privacy Guard (GPG).
- >-
This role supports the following operating systems:
Alpine (new enough),
Arch Linux,
CentOS 7, Stream 8, or newer,
Debian 10 (Buster) or newer,
Fedora (new enough),
RHEL 7 or newer,
Ubuntu 16.04 or newer LTS versions
- The Ansible facts C(ansible_facts.architecture), C(ansible_facts.distribution), C(ansible_facts.distribution_major_version),
C(ansible_facts.distribution_version), and C(ansible_facts.os_family) are expected to be present if O(sops_install_on_localhost) is V(false).
author:
- Felix Fontein (@felixfontein)
options:
sops_version:
default: latest
description:
- The version of SOPS to install.
- Should be a version like V(3.7.2). The special value V(latest) will select the latest version available form the given source.
type: str
sops_source:
default: auto
description:
- Determines the source from where SOPS is installed.
- The value V(github) will install SOPS from the SOPS releases on GitHub (U(https://github.com/getsops/sops/releases/)).
- The value V(system) will install SOPS from the system packages. Note that not all system package repositories support SOPS.
- The value V(auto) will determine the best source to install SOPS from. Here, system package repositories are preferred over GitHub.
type: str
choices:
- auto
- github
- system
sops_install_on_localhost:
default: false
description:
- Installs SOPS on the Ansible controller (C(localhost)) instead of the remote host.
type: bool
sops_become_on_install:
default: true
description:
- 'Whether the role should use C(become: true) when installing packages.'
type: bool
sops_github_latest_detection:
description:
- When installing the latest SOPS version from GitHub, configures how the latest release is detected.
- V(auto) tries V(api) first and then uses V(latest-release).
- V(api) asks the GitHub API for a list of recent releases and picks the highest version. Pre-releases are avoided.
- V(latest-release) uses a not fully documented URL to retrieve the release marked as "latest" by the repository maintainers.
type: str
choices:
- auto
- api
- latest-release
version_added: 1.6.0
sops_github_token:
description:
- Token to provide when querying the GitHub API for the latest release. Without the token
there are rather strict rate limits.
- Should mainly be used in GitHub Actions.
type: str
version_added: 1.6.0
attributes:
check_mode:
description: Can run in C(check_mode) and return changed status prediction without modifying target.
support: none
details:
- The role currently does not work in check mode.
# TODO: add 'check_mode: false' to tasks that prepare something
diff_mode:
description: Will return details on what has changed (or possibly needs changing in C(check_mode)), when in diff mode.
support: partial
details:
- The role supports diff mode if the M(ansible.builtin.package) action for the system supports it.
idempotent:
description:
- When run twice in a row outside check mode, with the same arguments, the second invocation indicates no change.
- This assumes that the system controlled/queried by the module has not changed in a relevant way.
support: partial
details:
- The role is idempotent if the M(ansible.builtin.package) action for the system is idempotent.
- This is usually the case, but if packages need to be installed from GitHub (that is, through an URL), idempotence might not hold.
platform:
description: Target OS/families that can be operated against.
support: full
platforms:
- Alpine (new enough)
- Arch Linux
- CentOS 7, Stream 8, or newer
- Debian 10 (Buster) or newer
- Fedora (new enough)
- RHEL 7 or newer
- Ubuntu 16.04 or newer LTS versions

11
ansible_collections/community/sops/roles/install/meta/main.yml Normal file
View file

@ -0,0 +1,11 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2022, Felix Fontein
galaxy_info:
standalone: false
description: >
Install SOPS (https://github.com/getsops/sops).
dependencies: []

26
ansible_collections/community/sops/roles/install/tasks/detect_source.yml Normal file
View file

@ -0,0 +1,26 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2022, Felix Fontein
- name: Check whether system packages are a valid source of SOPS {{ sops_version }}
when:
- _community_sops_install_system_has_system
- not (sops_version != 'latest' and _community_sops_install_system_has_system_latest_only)
ansible.builtin.set_fact:
_community_sops_install_effective_sops_source: system
- name: Check whether GitHub is a valid source of SOPS
when:
- _community_sops_install_system_has_github
- _community_sops_install_effective_sops_source == 'auto'
ansible.builtin.set_fact:
_community_sops_install_effective_sops_source: github
- name: Ensure that something was detected
ansible.builtin.fail:
msg: >-
Was not able to determine installation source for SOPS {{ sops_version }}
for {{ _community_sops_install_facts.distribution }} {{ _community_sops_install_facts.distribution_version }}.
Please open an issue in https://github.com/ansible-collections/community.sops/issues if you think this should work.
when: _community_sops_install_effective_sops_source == 'auto'

50
ansible_collections/community/sops/roles/install/tasks/github.yml Normal file
View file

@ -0,0 +1,50 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2022, Felix Fontein
- name: Make sure that SOPS can be installed from GitHub
ansible.builtin.fail:
msg: >-
SOPS cannot be installed from GitHub for
{{ _community_sops_install_facts.distribution }} {{ _community_sops_install_facts.distribution_version }}.
when: not _community_sops_install_system_has_github
- name: Start determining SOPS version
ansible.builtin.set_fact:
_community_sops_install_effective_sops_version: '{{ "" if sops_version == "latest" else sops_version }}'
# This method uses the GitHub API, which is rate-limited.
- name: Determine latest version (fallback)
when:
- _community_sops_install_effective_sops_version == ''
- sops_github_latest_detection in ['auto', 'api']
ansible.builtin.include_tasks: github_api.yml
# This method asks GitHub for the latest release, which depends on the release to be
# correctly marked as "latest" in the GitHub UI. Fortunately this is not as aggressively
# rate-limited as the API (used in the fallback).
- name: Determine latest version
when:
- _community_sops_install_effective_sops_version == ''
- sops_github_latest_detection in ['auto', 'latest-release']
ansible.builtin.include_tasks: github_latest_release.yml
- name: Fail when latest version could not be selected
ansible.builtin.fail:
msg: Could not determine the latest GitHub release
when: _community_sops_install_effective_sops_version == ''
- name: Show selected version
ansible.builtin.debug:
msg: The latest SOPS version is SOPS {{ _community_sops_install_effective_sops_version }}.
when: sops_version == 'latest'
- name: Set variables
ansible.builtin.set_fact:
_community_sops_install_system_packages_actual: >-
{{ _community_sops_install_system_packages + _community_sops_install_system_packages_github }}
_community_sops_install_system_packages_unsigned_actual: >-
{{ _community_sops_install_system_packages_unsigned + _community_sops_install_system_packages_unsigned_github }}
_community_sops_install_system_package_deb_actual: >-
{{ _community_sops_install_system_package_deb_github }}

38
ansible_collections/community/sops/roles/install/tasks/github_api.yml Normal file
View file

@ -0,0 +1,38 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2022, Felix Fontein
- name: Fetch list of releases from GitHub
ansible.builtin.uri:
headers:
Accept: application/vnd.github+json
Authorization: "{{ ('Bearer ' ~ sops_github_token) if sops_github_token is defined and sops_github_token else '' }}"
status_code:
- 200
- 403 # "HTTP Error 403: rate limit exceeded"
url: https://api.github.com/repos/getsops/sops/releases
register: _community_sops_install_github_releases
delegate_to: localhost
run_once: true
- name: In case rate limit was exceeded, inform user
ansible.builtin.debug:
msg: >-
Rate limit exceeded! Make sure to provide a GitHub token
as `sops_github_token` to reduce the chance of this error.
when: _community_sops_install_github_releases.status == 403
- name: Determine the latest release
ansible.builtin.set_fact:
_community_sops_install_effective_sops_version: >-
{{
(
_community_sops_install_github_releases.json
| rejectattr("prerelease")
| rejectattr("draft")
| map(attribute="tag_name")
| map("ansible.builtin.regex_replace", "^v", "")
| community.sops._latest_version
) if _community_sops_install_github_releases.status == 200 else ''
}}

34
ansible_collections/community/sops/roles/install/tasks/github_latest_release.yml Normal file
View file

@ -0,0 +1,34 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2022, Felix Fontein
- name: Fetch the latest release from GitHub
ansible.builtin.uri:
follow_redirects: "none"
status_code:
- 302
- 307
url: https://github.com/getsops/sops/releases/latest/
register: _community_sops_install_github_latest_release
delegate_to: localhost
run_once: true
- name: Determine the latest release
ansible.builtin.set_fact:
_community_sops_install_effective_sops_version: >-
{{
_community_sops_install_github_latest_release.location
| default("", true)
| ansible.builtin.regex_search("(?<=/releases/tag/)([0-9a-z._-]+)")
| default("", true)
| ansible.builtin.regex_replace("^v", "")
}}
- name: In case this failed, inform user
ansible.builtin.debug:
msg: >-
Could not obtain latest version from https://github.com/getsops/sops/releases/latest/.
Please create an issue in https://github.com/ansible-collections/community.sops/issues/
if there is not already one.
when: _community_sops_install_effective_sops_version == ''

102
ansible_collections/community/sops/roles/install/tasks/main.yml Normal file
View file

@ -0,0 +1,102 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2022, Felix Fontein
- name: Gather required information on localhost
when: sops_install_on_localhost
ansible.builtin.setup:
gather_subset:
- '!all'
- '!min'
- architecture
- distribution
- distribution_major_version
- distribution_version
- os_family
- pkg_mgr
delegate_to: localhost
delegate_facts: true
run_once: true
- vars:
_community_sops_install_facts: >-
{{ hostvars['localhost' if sops_install_on_localhost else inventory_hostname].ansible_facts }}
block:
- name: Show system information
ansible.builtin.debug:
msg: |-
Architecture: {{ _community_sops_install_facts.architecture }}
Distribution: {{ _community_sops_install_facts.distribution }} {{ _community_sops_install_facts.distribution_major_version }}
Distribution version: {{ _community_sops_install_facts.distribution_version }}
OS family: {{ _community_sops_install_facts.os_family }}
System package manager: {{ _community_sops_install_facts.pkg_mgr }}
- name: Include distribution specific variables
ansible.builtin.include_vars: '{{ lookup("ansible.builtin.first_found", params) }}'
vars:
params:
files:
- >-
D-{{ _community_sops_install_facts.distribution }}-{{ _community_sops_install_facts.distribution_version }}.yml
- >-
D-{{ _community_sops_install_facts.distribution }}-{{ _community_sops_install_facts.distribution_major_version }}.yml
- >-
D-{{ _community_sops_install_facts.distribution }}.yml
- >-
OS-{{ _community_sops_install_facts.os_family }}-{{ _community_sops_install_facts.distribution_major_version }}.yml
- >-
OS-{{ _community_sops_install_facts.os_family }}.yml
- default.yml
paths:
- '{{ role_path }}/vars'
- name: Start determining source
ansible.builtin.set_fact:
_community_sops_install_effective_sops_source: '{{ sops_source }}'
- name: Auto-detect source to install SOPS from
ansible.builtin.include_tasks: detect_source.yml
when: _community_sops_install_effective_sops_source == 'auto'
- name: Install SOPS from GitHub
ansible.builtin.include_tasks: github.yml
when: _community_sops_install_effective_sops_source == 'github'
- name: Install SOPS from system package repositories
ansible.builtin.include_tasks: system.yml
when: _community_sops_install_effective_sops_source == 'system'
- name: Install system packages
ansible.builtin.package:
name: '{{ _community_sops_install_system_packages_actual }}'
allow_downgrade: '{{ true if _community_sops_install_allow_downgrade and sops_version != "latest" else omit }}'
become: '{{ sops_become_on_install }}'
delegate_to: '{{ "localhost" if sops_install_on_localhost else omit }}'
run_once: '{{ sops_install_on_localhost }}'
when: _community_sops_install_system_packages_actual | length > 0
- name: Install unsigned system packages
ansible.builtin.package:
name: '{{ _community_sops_install_system_packages_unsigned_actual }}'
allow_downgrade: '{{ true if _community_sops_install_allow_downgrade and sops_version != "latest" else omit }}'
disable_gpg_check: true
become: '{{ sops_become_on_install }}'
delegate_to: '{{ "localhost" if sops_install_on_localhost else omit }}'
run_once: '{{ sops_install_on_localhost }}'
when: _community_sops_install_system_packages_unsigned_actual | length > 0
- name: Install packages from URL/path (Debian)
ansible.builtin.apt:
deb: '{{ _community_sops_install_system_package_deb_actual }}'
allow_downgrade: '{{ true if _community_sops_install_allow_downgrade and sops_version != "latest" else omit }}'
become: '{{ sops_become_on_install }}'
delegate_to: '{{ "localhost" if sops_install_on_localhost else omit }}'
run_once: '{{ sops_install_on_localhost }}'
when: _community_sops_install_system_package_deb_actual is string
- name: Set results
ansible.builtin.set_fact:
sops_installed: true
delegate_to: '{{ "localhost" if sops_install_on_localhost else omit }}'
delegate_facts: '{{ true if sops_install_on_localhost else omit }}'

26
ansible_collections/community/sops/roles/install/tasks/system.yml Normal file
View file

@ -0,0 +1,26 @@
---
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2022, Felix Fontein
- name: Make sure that SOPS can be installed from system packages
ansible.builtin.fail:
msg: >-
SOPS cannot be installed from system packages for
{{ _community_sops_install_facts.distribution }} {{ _community_sops_install_facts.distribution_version }}.
when: not _community_sops_install_system_has_system
- name: Make sure that systems only supporting 'latest' are not told to install another version
ansible.builtin.fail:
msg: >-
SOPS version {{ sops_version }} was requested, but we can only install latest SOPS from system packages.
when: sops_version != 'latest' and _community_sops_install_system_has_system_latest_only
- name: Set variables
ansible.builtin.set_fact:
_community_sops_install_system_packages_actual: >-
{{ _community_sops_install_system_packages + _community_sops_install_system_packages_system }}
_community_sops_install_system_packages_unsigned_actual: >-
{{ _community_sops_install_system_packages_unsigned + _community_sops_install_system_packages_unsigned_system }}
_community_sops_install_system_package_deb_actual: >-
{{ _community_sops_install_system_package_deb_system }}

23
ansible_collections/community/sops/roles/install/vars/D-Alpine.yml Normal file
View file

@ -0,0 +1,23 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
_community_sops_install_system_has_system: true
_community_sops_install_system_has_system_latest_only: true
_community_sops_install_system_has_github: false
_community_sops_install_allow_downgrade: false
_community_sops_install_system_packages:
- gpg
_community_sops_install_system_packages_unsigned: []
_community_sops_install_system_package_deb_github: false
_community_sops_install_system_packages_github: []
_community_sops_install_system_packages_unsigned_github: []
_community_sops_install_system_package_deb_system: false
_community_sops_install_system_packages_system:
- sops
_community_sops_install_system_packages_unsigned_system: []

23
ansible_collections/community/sops/roles/install/vars/D-Archlinux.yml Normal file
View file

@ -0,0 +1,23 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
_community_sops_install_system_has_system: true
_community_sops_install_system_has_system_latest_only: true
_community_sops_install_system_has_github: false
_community_sops_install_allow_downgrade: false
_community_sops_install_system_packages:
- gnupg
_community_sops_install_system_packages_unsigned: []
_community_sops_install_system_package_deb_github: false
_community_sops_install_system_packages_github: []
_community_sops_install_system_packages_unsigned_github: []
_community_sops_install_system_package_deb_system: false
_community_sops_install_system_packages_system:
- sops
_community_sops_install_system_packages_unsigned_system: []

32
ansible_collections/community/sops/roles/install/vars/OS-Debian.yml Normal file
View file

@ -0,0 +1,32 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
_community_sops_install_system_has_system: false
_community_sops_install_system_has_system_latest_only: true
_community_sops_install_system_has_github: true
_community_sops_install_allow_downgrade: '{{ ansible_version.full is version("2.12", ">=") }}'
_community_sops_install_system_packages:
- gnupg
_community_sops_install_system_packages_unsigned: []
_community_sops_install_arch_transform:
x86_64: amd64
aarch64: arm64
_community_sops_install_system_package_deb_github: >-
https://github.com/getsops/sops/releases/download/v{{
_community_sops_install_effective_sops_version
}}/sops_{{
_community_sops_install_effective_sops_version.replace('-', '.')
}}_{{
_community_sops_install_arch_transform.get(ansible_facts.architecture, ansible_facts.architecture)
}}.deb
_community_sops_install_system_packages_github: []
_community_sops_install_system_packages_unsigned_github: []
_community_sops_install_system_package_deb_system: false
_community_sops_install_system_packages_system: []
_community_sops_install_system_packages_unsigned_system: []

37
ansible_collections/community/sops/roles/install/vars/OS-RedHat.yml Normal file
View file

@ -0,0 +1,37 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
_community_sops_install_system_has_system: false
_community_sops_install_system_has_system_latest_only: true
_community_sops_install_system_has_github: true
_community_sops_install_allow_downgrade: true
_community_sops_install_system_packages:
- gnupg2
_community_sops_install_system_packages_unsigned: []
_community_sops_install_system_package_deb_github: false
_community_sops_install_system_packages_github: []
_community_sops_install_system_packages_unsigned_github:
- >-
https://github.com/getsops/sops/releases/download/v{{
_community_sops_install_effective_sops_version
}}/sops-{{
(_community_sops_install_effective_sops_version is version('3.6.0', '<')) | ternary('v', '')
}}{{
_community_sops_install_effective_sops_version.replace('-', '.')
}}{{
(
_community_sops_install_effective_sops_version is version('3.8.0', '<') or
_community_sops_install_effective_sops_version is version('3.9.0', '>=')
) | ternary('-1', '')
}}.{{
ansible_facts.architecture
}}.rpm
_community_sops_install_system_package_deb_system: false
_community_sops_install_system_packages_system: []
_community_sops_install_system_packages_unsigned_system: []

21
ansible_collections/community/sops/roles/install/vars/default.yml Normal file
View file

@ -0,0 +1,21 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
_community_sops_install_system_has_system: false
_community_sops_install_system_has_system_latest_only: true
_community_sops_install_system_has_github: false
_community_sops_install_allow_downgrade: false
_community_sops_install_system_packages: []
_community_sops_install_system_packages_unsigned: []
_community_sops_install_system_package_deb_github: false
_community_sops_install_system_packages_github: []
_community_sops_install_system_packages_unsigned_github: []
_community_sops_install_system_package_deb_system: false
_community_sops_install_system_packages_system: []
_community_sops_install_system_packages_unsigned_system: []

9
ansible_collections/community/sops/tests/config.yml Normal file
View file

@ -0,0 +1,9 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
# See template for more information:
# https://github.com/ansible/ansible/blob/devel/test/lib/ansible_test/config/config.yml
modules:
python_requires: default

25
ansible_collections/community/sops/tests/ee/all.yml Normal file
View file

@ -0,0 +1,25 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
- hosts: localhost
tasks:
- name: Download sops test GPG key on localhost
get_url:
url: https://raw.githubusercontent.com/getsops/sops/master/pgp/sops_functional_tests_key.asc
dest: /tmp/sops_functional_tests_key.asc
- name: Import sops test GPG key on localhost
command: gpg --import /tmp/sops_functional_tests_key.asc
failed_when: false
- name: Find all roles
find:
paths:
- "{{ (playbook_dir | default('.')) ~ '/roles' }}"
file_type: directory
depth: 1
register: result
- name: Include all roles
include_role:
name: "{{ item }}"
loop: "{{ result.files | map(attribute='path') | map('regex_replace', '.*/', '') | sort }}"

7
ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/.sops.yaml Normal file
View file

@ -0,0 +1,7 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
creation_rules:
- pgp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4

25
ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/simple.sops.yaml Normal file
View file

@ -0,0 +1,25 @@
foo: ENC[AES256_GCM,data:a25L,iv:X8ILHZr+YiyLWa90Y+cwoMD1nVuel7JyTs0A5+oiOOo=,tag:GbBtp+Yqx1KEjdyztqS4EQ==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
lastmodified: '2020-02-20T10:44:32Z'
mac: ENC[AES256_GCM,data:BAwQqD9sHgHkmlxPQLKq28Xy48qPp1B/+GDLEsIxir6WNhZgw8OgjVF1u/wCAad6qHkmN02Bwenr+aay6uKfCuOEsTRSvZ7v80yAU+h0wL3zJ/KMkRsE3QP3CWxcLQxInt+YaBjR+Q0IUjDXKm3u6ZomixZe5F5pwWr36ErV6Y0=,iv:e/iiyXQiCh8C2w/bc8mr/Psv+ehmqEMqEC1/bbGFHpY=,tag:NSDo2HISIBJhYvsqrU0mSA==,type:str]
pgp:
- created_at: '2020-02-20T10:44:32Z'
enc: |-
-----BEGIN PGP MESSAGE-----
wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s
z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU
TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz
cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV
ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG
YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm
6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0
OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA=
=tcnq
-----END PGP MESSAGE-----
fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4
unencrypted_suffix: _unencrypted
version: 3.4.0

3
ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/simple.sops.yaml.license Normal file
View file

@ -0,0 +1,3 @@
GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
SPDX-License-Identifier: GPL-3.0-or-later
SPDX-FileCopyrightText: Ansible Project

2
ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/wrong.yaml Normal file
View file

@ -0,0 +1,2 @@
---
this-is-not: a sops file

3
ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/wrong.yaml.license Normal file
View file

@ -0,0 +1,3 @@
GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
SPDX-License-Identifier: GPL-3.0-or-later
SPDX-FileCopyrightText: Ansible Project

46
ansible_collections/community/sops/tests/ee/roles/lookup_sops/tasks/main.yml Normal file
View file

@ -0,0 +1,46 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
- name: Test lookup with missing file
set_fact:
sops_file_does_not_exists: "{{ lookup('community.sops.sops', 'file-does-not-exists.sops.yml') }}"
ignore_errors: true
register: sops_lookup_missing_file
- assert:
that:
- "sops_lookup_missing_file is failed"
- "'could not locate file in lookup: file-does-not-exists.sops.yml' in sops_lookup_missing_file.msg"
- name: Test lookup with missing file with empty_on_not_exist
set_fact:
sops_file_does_not_exists_empty: "{{ lookup('community.sops.sops', 'file-does-not-exists.sops.yml', empty_on_not_exist=true) }}"
register: sops_lookup_missing_file_empty_on_not_exist
- assert:
that:
- "sops_lookup_missing_file_empty_on_not_exist is success"
- "sops_file_does_not_exists_empty == ''"
- name: Test lookup of non-sops file
set_fact:
sops_wrong_file: "{{ lookup('community.sops.sops', 'wrong.yaml') }}"
ignore_errors: true
register: sops_lookup_wrong_file
- assert:
that:
- "sops_lookup_wrong_file is failed"
- "'sops metadata not found' in sops_lookup_wrong_file.msg"
- name: Test simple lookup
set_fact:
sops_success: "{{ lookup('community.sops.sops', 'simple.sops.yaml') }}"
register: sops_lookup_simple
- assert:
that:
- "sops_lookup_simple is success"
- "sops_success == 'foo: bar'"

7
ansible_collections/community/sops/tests/integration/requirements.yml Normal file
View file

@ -0,0 +1,7 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
collections:
- community.general

8
ansible_collections/community/sops/tests/integration/targets/age/aliases Normal file
View file

@ -0,0 +1,8 @@
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
gha/main
skip/aix
skip/osx
skip/freebsd

8
ansible_collections/community/sops/tests/integration/targets/age/meta/main.yml Normal file
View file

@ -0,0 +1,8 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
dependencies:
- setup_sops
- setup_remote_tmp_dir

82
ansible_collections/community/sops/tests/integration/targets/age/tasks/main.yml Normal file
View file

@ -0,0 +1,82 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
- name: Determine whether sops, age, and sops with age are supported
set_fact:
supports_sops_and_age: >-
{{ sops_installed and age_installed and sops_version_remote is version('3.7.0', '>=') }}
- when: supports_sops_and_age
block:
- name: Create local temporary directory
tempfile:
state: directory
suffix: .test
delegate_to: localhost
register: local_tmp_dir
- name: Record local temporary directory
set_fact:
local_tmp_dir: "{{ local_tmp_dir.path }}"
- name: Create age keys
command: age-keygen --output {{ local_tmp_dir }}/{{ item }}
delegate_to: localhost
loop:
- identity_1
- identity_2
- identity_3
- identity_4
- vars:
identity_files:
- name: identities_all
id_files:
- identity_1
- identity_2
- identity_3
- identity_4
- name: identities_1_2_3
id_files:
- identity_1
- identity_2
- identity_3
- name: identities_4
id_files:
- identity_4
block:
- name: Create local identity files
copy:
dest: '{{ local_tmp_dir }}/{{ item.name }}'
content: |
{% for id_file in item.id_files %}
{{ lookup('file', local_tmp_dir ~ '/' ~ id_file) }}
{% endfor %}
delegate_to: localhost
loop: '{{ identity_files }}'
- name: Create remote identity files
copy:
dest: '{{ remote_tmp_dir }}/{{ item.name }}'
content: |
{% for id_file in item.id_files %}
{{ lookup('file', local_tmp_dir ~ '/' ~ id_file) }}
{% endfor %}
loop: '{{ identity_files }}'
- name: Read identity public keys
set_fact:
identity_1: "{{ lookup('file', local_tmp_dir ~ '/identity_1') | regex_search('public key: ([a-zA-Z0-9]+)', '\\1') | first }}"
identity_2: "{{ lookup('file', local_tmp_dir ~ '/identity_2') | regex_search('public key: ([a-zA-Z0-9]+)', '\\1') | first }}"
identity_3: "{{ lookup('file', local_tmp_dir ~ '/identity_3') | regex_search('public key: ([a-zA-Z0-9]+)', '\\1') | first }}"
identity_4: "{{ lookup('file', local_tmp_dir ~ '/identity_4') | regex_search('public key: ([a-zA-Z0-9]+)', '\\1') | first }}"
- include_tasks: test.yml
always:
- name: Delete temporary directory
file:
path: '{{ local_tmp_dir }}'
state: absent
delegate_to: localhost

132
ansible_collections/community/sops/tests/integration/targets/age/tasks/test.yml Normal file
View file

@ -0,0 +1,132 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
- name: Create encrypted files
sops_encrypt:
path: '{{ remote_tmp_dir }}/{{ item.name }}.sops.yaml'
age: '{{ item.identities }}'
age_keyfile: '{{ remote_tmp_dir }}/identities_all'
content_yaml: '{{ item.data }}'
loop: '{{ data }}'
vars:
data:
- name: enc-1
identities:
- '{{ identity_1 }}'
- '{{ identity_2 }}'
- '{{ identity_3 }}'
- '{{ identity_4 }}'
data:
foo: bar
baz: this is a secret
bam: true
int: 3
- name: enc-2
identities:
- '{{ identity_1 }}'
- '{{ identity_2 }}'
- '{{ identity_4 }}'
data:
foo: 19
bar: this is another secret
- name: enc-3
identities:
- '{{ identity_4 }}'
data:
foo: 23
- name: Copy encrypted files to localhost
fetch:
src: '{{ remote_tmp_dir }}/{{ item }}.sops.yaml'
dest: '{{ local_tmp_dir }}/'
flat: true
loop:
- enc-1
- enc-2
- enc-3
- name: Decrypt some data (3.7.0+)
set_fact:
decrypt_1: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_keyfile=local_tmp_dir ~ '/identities_all') | from_yaml }}"
decrypt_1_1: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_1') | from_yaml }}"
decrypt_1_2: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_2') | from_yaml }}"
decrypt_1_3: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_3') | from_yaml }}"
decrypt_1_4: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_4') | from_yaml }}"
decrypt_1_1_2_3: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_keyfile=local_tmp_dir ~ '/identities_1_2_3') | from_yaml }}"
decrypt_2: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-2.sops.yaml', age_keyfile=local_tmp_dir ~ '/identities_all') | from_yaml }}"
decrypt_2_1: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-2.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_1') | from_yaml }}"
decrypt_2_2: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-2.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_2') | from_yaml }}"
decrypt_2_4: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-2.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_4') | from_yaml }}"
decrypt_2_1_2_3: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-2.sops.yaml', age_keyfile=local_tmp_dir ~ '/identities_1_2_3') | from_yaml }}"
decrypt_3: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-3.sops.yaml', age_keyfile=local_tmp_dir ~ '/identities_all') | from_yaml }}"
decrypt_3_4: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-3.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_4') | from_yaml }}"
- name: Validate decryption
assert:
that:
- decrypt_1.foo == 'bar'
- decrypt_1.baz == 'this is a secret'
- decrypt_1.bam == true
- decrypt_1.int == 3
- decrypt_1 == decrypt_1_1
- decrypt_1 == decrypt_1_2
- decrypt_1 == decrypt_1_3
- decrypt_1 == decrypt_1_4
- decrypt_1 == decrypt_1_1_2_3
- decrypt_2.foo == 19
- decrypt_2.bar == 'this is another secret'
- decrypt_2.bam is undefined
- decrypt_2.int is undefined
- decrypt_2 == decrypt_2_1
- decrypt_2 == decrypt_2_2
- decrypt_2 == decrypt_2_4
- decrypt_2 == decrypt_2_1_2_3
- decrypt_3.foo == 23
- decrypt_3.bar is undefined
- decrypt_3.bam is undefined
- decrypt_3.int is undefined
- decrypt_3 == decrypt_3_4
- when: >-
sops_version_controller is version('3.7.1', '>=')
block:
- name: Decrypt some data (3.7.1+)
set_fact:
decrypt_1b: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_key=lookup('file', local_tmp_dir ~ '/identities_all')) | from_yaml }}"
decrypt_1_1b: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_key=lookup('file', local_tmp_dir ~ '/identity_1')) | from_yaml }}"
decrypt_1_2b: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_key=lookup('file', local_tmp_dir ~ '/identity_2')) | from_yaml }}"
decrypt_1_3b: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_key=lookup('file', local_tmp_dir ~ '/identity_3')) | from_yaml }}"
decrypt_1_4b: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_key=lookup('file', local_tmp_dir ~ '/identity_4')) | from_yaml }}"
decrypt_1_1_2_3b: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_key=lookup('file', local_tmp_dir ~ '/identities_1_2_3')) | from_yaml }}"
- name: Validate decryption
assert:
that:
- decrypt_1 == decrypt_1b
- decrypt_1 == decrypt_1_1b
- decrypt_1 == decrypt_1_2b
- decrypt_1 == decrypt_1_3b
- decrypt_1 == decrypt_1_4b
- decrypt_1 == decrypt_1_1_2_3b
- name: Failed encryption 1
debug:
msg: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-2.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_3') | from_yaml }}"
ignore_errors: true
register: failure_1
- name: Failed encryption 2
debug:
msg: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-3.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_1') | from_yaml }}"
ignore_errors: true
register: failure_2
- name: Validate failed decryption
assert:
that:
- failure_1 is failed
- "'CouldNotRetrieveKey' in failure_1.msg"
- failure_2 is failed
- "'CouldNotRetrieveKey' in failure_2.msg"

9
ansible_collections/community/sops/tests/integration/targets/filter__latest_version/aliases Normal file
View file

@ -0,0 +1,9 @@
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
gha/main
skip/aix
skip/osx
skip/freebsd
skip/python2.6 # lookups are controller only, and we no longer support Python 2.6 on the controller

39
ansible_collections/community/sops/tests/integration/targets/filter__latest_version/tasks/main.yml Normal file
View file

@ -0,0 +1,39 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
- name: Test _latest_version filter
ansible.builtin.assert:
that:
- list_0 | community.sops._latest_version == '1.0.0'
- list_1 | community.sops._latest_version == '1.2.1'
- list_2 | community.sops._latest_version == '1.2.1'
- list_3 | community.sops._latest_version == '1.2.3'
- list_4 | community.sops._latest_version == ''
- "[] | community.sops._latest_version == ''"
vars:
list_0:
- '1'
- '1.0'
- 1.0.0
list_1:
- '1.0'
- 1.2.1
- 1.0.0
list_2:
- '1.0'
- 1.2.1
- 1.2.1-rc.1
- 1.0.0
list_3:
- '1.0'
- 1.2.3
- 1.4.0-rc.1
- 1.4.0-a1+5
- 1.4.0+5
- 1.0.0
list_4:
- 1.4.0-rc.1
- 1.4.0-a1+5
- 1.4.0+5

9
ansible_collections/community/sops/tests/integration/targets/filter_decrypt/aliases Normal file
View file

@ -0,0 +1,9 @@
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
gha/main
skip/aix
skip/osx
skip/freebsd
skip/python2.6 # lookups are controller only, and we no longer support Python 2.6 on the controller

7
ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/.sops.yaml Normal file
View file

@ -0,0 +1,7 @@
---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
creation_rules:
- pgp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4

20
ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/binary.sops Normal file
View file

@ -0,0 +1,20 @@
{
"data": "ENC[AES256_GCM,data:TrEN6YJBOg==,iv:aUozScYsBrM4khbqD2lMbGpEEXXO0Vy8YytBoG4HIf4=,tag:JlLZHqj2fsTi6v1rGeaxWw==,type:str]",
"sops": {
"kms": null,
"gcp_kms": null,
"azure_kv": null,
"hc_vault": null,
"lastmodified": "2020-10-02T18:26:32Z",
"mac": "ENC[AES256_GCM,data:m4PPDNMYOPcDECiKJLF9Hg4jIInHj/xpj5bnGUkQxMm4XO2CDPal9g1FwTzwjOK9rXLUkdhWc8FuRh542EviVV8vOyUkjVAwN0x0bpXodBXB5r/9PPDwtObe/CUWnjo90Ow7IuX/BnQI6lf1sdPHf0MeTjGN9/l7tr6xg+92bIc=,iv:7q+TxZ65n2a+Vdb9KY6ISX92c1lEG2yTpa9KCt/QcUk=,tag:uR1AfcNd1dvH6LZy2oBDiw==,type:str]",
"pgp": [
{
"created_at": "2020-10-02T18:26:31Z",
"enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAR4QrVAJ5LhfX41457whWBdB74/O4OEZ76CkUGBvCVkGb\nHjJf9PAHFYH12UVnHEK3ZHKxKrVKPM2Pf3hsMGPuruS2wDuCWLteuMfQtlvCg1Xv\nLxiOfyEUEFc7Rl7uKmvni7XBeexIYN0DpxYa1Paz28ptQJCxZ84FK9y2jrFg2bUF\nq8R1JSTiY+YDXQBKSw3XgdJjjX2Yrpe85BV/l7pgREcwKEG4ZIU8n/zH2mgCObxp\nVfa50dAs5mfooU4g+xF34INhk7L+JPF0EBAbdrPyiw/7220dQSfCW0K3rgQkL1ZE\nB0wjH3S2anRO5t8E4S/YvXerq8LwtpCMczflLsCZ89LgAeStGGLFgZU53ASmq2dt\nqwQw4dCY4CngwuG/PuCt4nYV6VPgz+V+txpuq/aKQvcuFNhGsRtm4oP/vUlhqZQA\nivnqgO/DveCH5MxW9oMGLnYj4Jkbp0gRyALiqwNRz+HfSgA=\n=3dNe\n-----END PGP MESSAGE-----",
"fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4"
}
],
"unencrypted_suffix": "_unencrypted",
"version": "3.6.1"
}
}

3
ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/binary.sops.license Normal file
View file

@ -0,0 +1,3 @@
GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
SPDX-License-Identifier: GPL-3.0-or-later
SPDX-FileCopyrightText: Ansible Project

Some files were not shown because too many files have changed in this diff Show more