Edit

Restore Ansible Vault password from Hashicorp Vault

The guide can be used for restoring Ansible Vault password for secrets.yml decryption.

1. Log in via SSH to DB server.

2. Switch to wfuser.

3. Change the directory:

   su - wfuser
   cd /opt/workfusion/
   

4. Get the Hashicorp Vault root token.

   cat vault/keys/vault_keys.json | python -c "import sys, json; print json.load(sys.stdin)['root_token']"
   c1e2f34-6b33-4321-f3a2-2a2vv332299
   

   Where: c1e2f34-6b33-4321-f3a2-2a2vv332299 is Vault-Token that should be used for Ansible Vault password retrieval.

5. Get the Ansible Vault password.

   curl -s -k -H "Accept: application/json" -H "Content-Type: application/json" \
       -H "X-Vault-Token:<ROOT_TOKEN>" \
       https://127.0.0.1:8200/v1/secret/policy/WFApplication/workfusion_WFInternal/ansible_installer | \
       python -c "import sys, json; print json.load(sys.stdin)['data']"
   

   Example:

   $ curl -s -k -H "Accept: application/json" -H "Content-Type: application/json" \
       -H "X-Vault-Token:c1e2f34-6b33-4321-f3a2-2a2vv332299" \
       https://127.0.0.1:8200/v1/secret/policy/WFApplication/workfusion_WFInternal/ansible_installer | \
       python -c "import sys, json; print json.load(sys.stdin)['data']"
   {u'ansible_vault_password': u'YOUR_STRONG_ANSIBLE_PASSWORD'}
   

6. Use this password for decryption your secrets_overrides.yml. secrets_overrides.yml can be found at /distr.