api_keys must be in clear text?

[systeminsightsbuild]

We use ansible vault to store things like api keys -- datadog keys included. But it seems that the callback expects the api_key value to be in cleartext and does not try to translate it as a variable, eg

api_key: "{{datadog_api_key}}"

[olivielpeau]

Thanks @systeminsightsbuild for opening this issue!

Currently the callback doesn't use the vars that are set by Ansible (host_vars, group_vars, etc), and that can come from ansible vault.

We could try to make the callback find the datadog_api_key var and use it. The implementation seems to differ between 1.x and 2.0 but here are a few resources that we could get some inspiration from:

• on Ansible 1.x: https://gist.github.com/sivel/bf217f2465523fb8d548#file-hipchat-py-L30-L40 retrieves a variable from the host_vars
• for Ansible 2.0: this discussion on ansible-devel describes how to do the same thing on 2.0.

@systeminsightsbuild What do you think? If you have time to work on a PR feel free to contribute! :)
In all cases I'm adding this in our backlog.

[irabinovitch]

@systeminsightsbuild Do you have any thoughts on the correct approach here?

[omgjlk]

Searching for the variable would be useful to us as well. We do not want to have this secret sitting in plain text on the filesystem.

[szponek]

#25 ready for a review

[hush-hush]

This was fix by merging #25.