ansible/ansible — pull request #2348 by candeira (2013-03-10 02:43:55+00:00)
Title: password lookup plugin, with working tests and documentation

The passsword lookup plugin, as discussed on the IRC channel and explained in the documentation for advanced playbooks (copied below).

All previous tests pass, and so do a bunch of new ones except for checking that non-default lengths of passwords. This last test is commented out in case someone wants to fix it.

Copy of the plugin's documentation:

.. versionadded: 1.1

'with_password' and associated macro "$PASSWORD" generate a random plaintext password and store it in
a file at a given filepath. If the file exists previously, "$PASSWORD"/'with_password' will retrieve its contents,
behaving just like $FILE/'with_file'.

Generated passwords contain a random mix of upper and lower case letters in the ASCII alphabets, the
numbers 0-9 and the punctuation signs ".,:-_". The default length of a generated password is 30 characters.
This gives us ~ 180 bits of entropy. However, this length can be changed by passing an extra parameter.

This is how it all works, with an exemplary use case, which is generating a different random password for every
mysql database in a given server pool:

---
- hosts: all

tasks:

# create a mysql user with a random password:
- mysql_user: name=$client
password=$PASSWORD(credentials/$client/$tier/$role/mysqlpassword)
priv=$client_$tier_$role.*:ALL

(...)

# dump a mysql database with a given password
- mysql_db: name=$client_$tier_$role
login_user=$client
login_password=$item
state=dump
target=/tmp/$client_$tier_$role_backup.sql
with_password: credentials/$client/$tier/$role/mysqlpassword

# make a longer or shorter password by appending a length parameter:
- mysql_user: name=who_cares
password=$item
with_password: files/same/password/everywhere length=4