14:01:18 #startmeeting ansible core public irc meeting 14:01:19 Meeting started Thu Jul 26 14:01:18 2018 UTC. 14:01:19 This meeting is logged and archived in a public location. 14:01:19 The chair is bcoca. Information about MeetBot at http://wiki.debian.org/MeetBot. 14:01:19 Useful Commands: #action #agreed #halp #info #idea #link #topic. 14:01:19 The meeting name has been set to 'ansible_core_public_irc_meeting' 14:01:35 #topic https://github.com/ansible/ansible/issues/38808 14:02:16 @sylr ?? 14:02:39 sylvain? 14:03:01 @akasurde ? 14:03:23 hi @bcoca 14:03:34 ^ you suggested it being added to agenda, im not sure he realizes he needs to show up as an advocate 14:03:41 yes 14:03:48 was discussing this same thing in devel earlier 14:04:18 sylr opened to two issues for adding encrypt_yaml in ansible-vault 14:04:45 I thinking this as a good idea and wanted to discuss in IRC meeting 14:05:03 What is general consensus for this idea ? 14:05:05 in devel we were discussing closer to an 'editor' 14:05:41 personally i think that creating examples of vim functions that can 'vault/devault' the current entry would be better, but then we need an emacs one, sublime, etc 14:05:58 yes, that works for me as well 14:08:10 we should actually add examples of usage in the docs 14:08:28 things like 'vault hooks on your scm' to ensure people dont check in unvaulted file (when using full file vaults) 14:08:40 OK 14:09:05 and a vim exmaple of using `ansible-vault encrypt-string` should be easy enough to add too 14:09:06 Doc example is good idea 14:09:52 then also list a few 'helper tools' i.e https://github.com/521dimensions/ansible-vault-automator 14:10:51 @alikins, thoughts? 14:11:02 I think this is the one user wants 14:11:06 bcoca++ 14:11:25 well, user is talking about 'inline' encrypted vars, that automator is for full files 14:11:25 bcoca: looking 14:11:47 alikins: didnt you have example of vim + encrypt string binding? 14:12:29 https://github.com/b4b4r07/vim-ansible-vault/blob/master/ftdetect/ansible-vault.vim 14:12:35 ^ i might be thinking of this 14:14:24 the encrypt_yaml style thing was vaguely planned, but the details of trying to preserve comments and formatting and ordering across a yaml load/dumps delayed it 14:14:58 could be done 99% with text munging/regex though 14:15:14 well, doing it in ansible-vault mostly implies you become an editor, my suggestion is to provide vim macros that do it and not get into the editor game 14:15:52 since vault takes stdin/stout and encrypt_string .. that shoudl be easy to implement on 'current line' 14:15:59 another variation was adding a !vault-plaintext tag to indicate the bits that should get encrypted post-edit, but has some of the same yaml roundtrip issues 14:16:19 yeah, that is why i wanted to avoid doing it all in ansible-vault itself 14:19:59 scripts for vim (or other editors) to do it seems like a reasonable idea. Probably some annoying details to figure out if it wants to be paranoid about writing out decrypted files to disk... 14:20:06 not sure if we are going to resolve anything here, we dont have time/bandwith to add this to roadmap, but i'm sure we'll welcome any contributions 14:20:23 alikins: it would also help with the case of the 'file owner changes' 14:20:45 and you can tell vim to not write the buffer, mostly how visudo works 14:21:21 it will still keep original backup, but wont allow an insecure copy of buffer 14:21:53 last time I looked I think I came to the conclusion of 'copy whatever hiera-eyaml does' (or whatever the current equiv is) 14:21:53 * bcoca might be confusing visudo with vipw .. vim has lotsamodes 14:22:54 bcoca: "well, doing it in ansible-vault mostly implies you become an editor" yeah, exactly 14:22:55 iirc they just implement their own yaml parser 14:24:38 hiera has the benefit of being originally designed for use outside of puppet, which decouples its interface 14:24:41 though I think hiera-eyaml has more flexibility since it's enc is asymmetric/pki iirc 14:24:54 yep, it is asym 14:25:09 if we ever do vault plugins, we could do same ... 14:25:36 yup 14:26:00 hiera is directly responsible for looking up vars from those files, where ansible-vault just does the encryption and offloads the loading of vars to ansible itself 14:27:09 if we made that into 'plugins' the plugin would then be responsible, we do have a hiera lookup already 14:29:03 #38808 would be more straightforward if yaml stuff was done with rueyaml (sp?) since it's better at preserving formatting (not really practical to switch to ruyaml for various reasons of course...) 14:30:44 agreed, but i don tthink we have time/resources to put into this right now, lets think about it for next version, for now i suggest that anyone that has time add the vim/emacs/atom/sublime/whatevs tricks they can find to the docs so users have better options 14:32:54 make sense 14:33:19 ok, going to open floor since i dont think we can take any other action on this at this time 14:33:22 #topic open floor 14:33:40 if nothing comes up, closing meeting in 1 min 14:36:43 #endmeeting