Remove vars_prompt, add info to README to re-enable and for ansible-vault

3 files changed, 79 insertions, 30 deletions

diff --git a/roles/subscription-manager/README.md b/roles/subscription-manager/README.md
index a5dd1ac44..748de282c 100644
--- a/roles/subscription-manager/README.md
+++ b/roles/subscription-manager/README.md
@@ -20,7 +20,48 @@ Default: none
 
 Subscription Manager password. Required for RHSM Hosted. Can be optionally used for Satellite, but it may be better to use **rhsm_activationkey** for this. 
 
-NOTE: This variable is prompted for at the start of the playbook run. This is for security purposes so the password is not left in the command history. If specified on the command-line or set in a variable file it will be ignored and the value captured from the prompt will overwrite it instead.
+NOTE: If this variable is specified on the command-line or set in a variable file it may leave your password exposed. For this reason you may perfer to use an Activation Key if using Satellite. For RHSM Hosted, your password must be specified. There are two ways to provide the password to the Ansible playbook without exposing it to prying eyes.
+
+1. The first method is to use a **vars_prompt** to collect the password up front one time for the playbook. Ansible will not display the password if the prompt is configured as **private** and the task will not display the password on the CLI. This is the a good method as it supports automating the task to every host with only one password entry. To enable **vars_prompt** add the following to the very top of your playbook after the **hosts** declaration and before any **pre_tasks** section:
+
+    ```
+    - hosts: localhost
+      # Add the following lines after a -hosts: declaration and before pre_tasks:
+      # Start of vars_prompt code block
+      vars_prompt:
+        - name: "rhsm_password"
+          prompt: "Subscription Manager password"
+          confirm: yes
+          private: yes
+      # End of vars_prompt code block
+      pre_tasks:
+    ```
+
+2. A second method is to use an encrypted file via **ansible-vault**. This does does not require modifying any code as the previous method, but does require more work to create and encrypt the file. To accomplish this, first create a file containing at least the **rhsm_password** variable (it is also possible to specify additional variables to encrypt them all as well):
+  1. Create a file to contain the variable such as **secrets.yml**:
+
+    ```
+    ---
+    rhsm_password: "my_secret_password"
+    # other variables can optionally be placed here as well
+    ```
+
+  2. Encrypt the file with **ansible-vault**:
+
+    ```
+    $ ansible-vault encrypt secrets.yml
+    Vault password: 
+    Confirm Vault password: 
+    Encryption successful
+    ```
+
+  3. When executing **ansible-playbook** specify **--ask-vault-pass** to be prompted for the decryption password, and also specify the location of the **secrets.yml** as such:
+
+    ```
+    $ ansible-playbook --ask-vault-pass --extra-vars=@secrets.yml --extra-vars="rhsm_username=myusername" <other playbook options>
+    ```
+
+  NOTE: Optionally the file containing the encrypted variables can be decrypted with **ansible-vault** and the **--ask-vault-pass** option omitted to prevent any password prompting (for automated runs) and the file can be encrypted after the run. This can be used if an external system such as Jenkins would handle the decryption/encryption outside of Ansible.
 
 Default: none
 
@@ -53,21 +94,24 @@ rhsm_repos='["rhel-7-server-rpms", "rhel-7-server-ose-3.1-rpms", "rhel-7-server-
 Default: none
 
 ## Calling This Role
-Calling this role requires adding a **vars_prompt**, **pre_tasks**, and **roles** section of a play
+Calling this role is done at both **pre_tasks** and **roles** sections of a playbook and optionally a **vars_prompt**.
 
 ### vars_prompt
-Unfortunately **vars_prompt** can only be used at the play level before role tasks are executed, so this is the only place it can go. See http://stackoverflow.com/questions/25466675/ansible-to-conditionally-prompt-for-a-variable
+Unfortunately **vars_prompt** can only be used at the play level before role tasks are executed, so this is the only place it can go. It also cannot be shown conditionally. For this reason it is not included in this role by default. A better method may be using a file containing the password variable encrypted with **ansible-vault**. See the **rhsm_password** section for more details.
 
-Add a prompt to capture **rhsm_password**
+To Add a prompt to capture **rhsm_password**:
 
 ```
 - hosts: localhost
+  # Add the following lines after a -hosts: declaration and before pre_tasks:
+  # Start of vars_prompt code block
   vars_prompt:
-  # Unfortunately vars_prompt can only be used at the play level before role tasks, so this is the only place it can go. See http://stackoverflow.com/questions/25466675/ansible-to-conditionally-prompt-for-a-variable
     - name: "rhsm_password"
-      prompt: "Subscription Manager password (enter blank if using rhsm_activationkey or to disable registration)"
+      prompt: "Subscription Manager password"
       confirm: yes
       private: yes
+  # End of vars_prompt code block
+  pre_tasks:
 ```
 
 ### pre-tasks
@@ -75,8 +119,8 @@ Add a prompt to capture **rhsm_password**
 A number of variable checks are performed before any tasks to ensure the proper parameters are set. To include these checks call the pre_task yaml before any roles:
 
 ```
-  pre_tasks:
-  - include: roles/subscription-manager/pre_tasks/pre_tasks.yml 
+pre_tasks:
+- include: roles/subscription-manager/pre_tasks/pre_tasks.yml 
 ```
 
 ### roles
@@ -84,22 +128,29 @@ A number of variable checks are performed before any tasks to ensure the proper
 The bulk of the work is performed in the main.yml for this role. The pre-task play will set a variable which can be checked to contitionally include this role as such:
 
 ```
-  roles:
-    - { role: subscription-manager, when: hostvars.localhost.rhsm_register, tags: 'subscription-manager' }
+roles:
+  - { role: subscription-manager, when: hostvars.localhost.rhsm_register, tags: 'subscription-manager' }
 ```
 
-## Running the Playbook
+## Running Playbooks with this Role
  
-To register to RHSM Hosted with username and password:
+- To register to RHSM Hosted or Satellite with a username and plain text password (NOTE: This may retain your password in your CLI history):
 
-```
-ansible-playbook -i inventory/ose-provision ose-provision.yml -e "rhsm_username=vvaldez"
-```
+    ```
+    $ ansible-playbook --extra-vars="rhsm_username=vvaldez rhsm_password=my_secret_password <other playbook otions>"
+    ```
 
-To register to a Satellite server with an activation key:
+- To register to RHSM Hosted or Satellite with username and an encrypted file containing the password:
 
-```
-ansible-playbook -i inventory/ose-provision ose-provision.yml -e "rhsm_satellite=satellite.example.com rhsm_org=example_org rhsm_activationkey=rhel-7-ose-3-1"
-```
+    ```
+    $ ansible-playbook --ask-vault-pass --extra-vars=@secrets.yml --extra-vars="rhsm_username=myusername" <other playbook options>
+
+    ```
+
+- To register to a Satellite server with an activation key:
+
+    ```
+    $ ansible-playbook --extra-vars="rhsm_satellite=satellite.example.com rhsm_org=example_org rhsm_activationkey=rhel-7-ose-3-1 <other playbook options>"
 
-To ignore any Subscription Manager activities, simply do not set any parameters. When prompted for the password, hit **Enter** to set a blank password.
+    ```
+- To ignore any Subscription Manager activities, simply do not set any parameters.
diff --git a/roles/subscription-manager/pre_tasks/pre_tasks.yml b/roles/subscription-manager/pre_tasks/pre_tasks.yml
index 31441785e..8a4d8d06d 100644
--- a/roles/subscription-manager/pre_tasks/pre_tasks.yml
+++ b/roles/subscription-manager/pre_tasks/pre_tasks.yml
@@ -1,5 +1,5 @@
 ---
-- name: Set password fact
+- name: "Set password fact"
   set_fact:
     rhsm_password: "{{ rhsm_password }}"
   no_log: true
@@ -8,11 +8,11 @@
     - rhsm_password is not none
     - rhsm_password|trim != ''
 
-- name: Initialize Subscription Manager fact
+- name: "Initialize Subscription Manager fact"
   set_fact:
     rhsm_register: true
 
-- name: Determine if Subscription Manager should be used
+- name: "Determine if Subscription Manager should be used"
   set_fact:
     rhsm_register: false
   when: 
@@ -23,7 +23,7 @@
     - rhsm_activationkey is undefined or rhsm_activationkey is none or rhsm_activationkey|trim == ''
     - rhsm_pool is undefined or rhsm_pool is none or rhsm_pool|trim == ''
 
-- name: Validate Subscription Manager organization is set
+- name: "Validate Subscription Manager organization is set"
   fail: msg="Cannot register to a Satellite server without a value for the Organization via 'rhsm_org'"
   when: 
     - rhsm_org is undefined or rhsm_org is none or rhsm_org|trim == ''
@@ -32,14 +32,14 @@
     - rhsm_satellite|trim != ''
     - rhsm_register
 
-- name: Validate Subscription Manager authentication is defined
-  fail: msg="Cannot register without ('rhsm_username' and 'rhsm_password') or 'rhsm_activationkey' variables set"
+- name: "Validate Subscription Manager authentication is defined"
+  fail: msg="Cannot register without ('rhsm_username' and 'rhsm_password') or 'rhsm_activationkey' variables set. See the README.md for details on securely prompting for a password"
   when:
     - (rhsm_username is undefined or rhsm_username is none or rhsm_username|trim == '') or (rhsm_password is undefined or rhsm_password is none or rhsm_password|trim == '')
     - rhsm_activationkey is undefined or rhsm_activationkey is none or rhsm_activationkey|trim == ''
     - rhsm_register
 
-- name: Validate activation key and Hosted are not requested together
+- name: "Validate activation key and Hosted are not requested together"
   fail: msg="Cannot register to RHSM Hosted with 'rhsm_activationkey'"
   when:
     - rhsm_satellite is undefined or rhsm_satellite is none or rhsm_satellite|trim == ''
diff --git a/roles/subscription-manager/tasks/main.yml b/roles/subscription-manager/tasks/main.yml
index adf3a8e85..bdb8ca7c4 100644
--- a/roles/subscription-manager/tasks/main.yml
+++ b/roles/subscription-manager/tasks/main.yml
@@ -3,9 +3,7 @@
   set_fact:
     rhsm_password: "{{ hostvars.localhost.rhsm_password }}"
   when:
-      - rhsm_password is defined
-      - rhsm_password is not none
-      - rhsm_password|trim != ''
+    - rhsm_password is not defined or rhsm_password is none or rhsm_password|trim == ''
   
 - name: "Initializing Subscription Manager authenticaiton method"
   set_fact: