Ansible lookup plugin is back, rewritten for Passbolt 5

Community Feedback
1

Hi,

I give a try of the new (alpha stage) [Ansible lookup plugin is back, rewritten for Passbolt 5]( https://www.passbolt.com/blog/ansible-lookup-plugin-is-back-rewritten-for-passbolt-5 )

It’s working but it’s so slow as it’s unusable right now.

as example, i wrote a ansible-playbook test to print only a password on a debug ansible tasks with
{{ lookup('passbolt.passbolt_lookup.passbolt_lookup',...
It’s take between 3 and 4 minutes to only print 10 lookup of passbolt so it’s around 20secondes to retrieve a password with this lookup.

Otherwise it’s working as expected but can’t use as it as it’s far too slow to be used on a production env.

Regards

2

Hello @roumano,
Thank you for your honest feedback :slight_smile:

We were definitely aware of the performances limitation and therefore we iterated on it some weeks ago, just to be sure, did you pull the last changes? These changes include the existing metadata session keys which drastically improve the performances, the only thing needed is that one of your client already populated that cache. Also, we recommend using UUIDs for faster performances.

If you confirm that you are already using the latest change and that the cache is populated already, I’m definitely happy to investigate any logs/output you can share to reproduce the issues.

Best regards

3

Hi Antony,

Thanks for your feedback

i’m sure we are using the last changes with your performance improvement :

$ grep -A5 'class GnuPGService'  collections/ansible_collections/passbolt/passbolt_lookup/plugins/module_utils/passbolt/cryptography/gnupg_service.py 
class GnuPGService:
    _thread_local = threading.local()

    @classmethod
    def _gpg(cls) -> gnupg.GPG:
        instance = getattr(cls._thread_local, "gpg", None)

We check again and fix a major issue with I/O wait on the mariadb of the passbolt (increase innodb_buffer_pool_size) and now it’s faster but also much more constant so it’s easier to check.

Now, when using the lookup, the passbolt server is mostly idle: cpu max usage 30% with 4 cpu, without bottleneck in memory/disk/network

Example of the code used:

---
- hosts: localhost
  gather_facts: false
  vars_files:
    - conf/passbolt_new_TESTZ
  tasks:

    - name: "Passbolt lookup plugin / loop with filters"
      debug:
        var: item
      loop:
        - "{{ lookup('passbolt.passbolt_lookup.passbolt_lookup', '6d4c2ca5-dffa-487a-b318-9597083c9479') }}"
        - "{{ lookup('passbolt.passbolt_lookup.passbolt_lookup', '6d4c2ca5-dffa-487a-b318-9597083c9479') }}"
        - "{{ lookup('passbolt.passbolt_lookup.passbolt_lookup', '6d4c2ca5-dffa-487a-b318-9597083c9479') }}"
        - "{{ lookup('passbolt.passbolt_lookup.passbolt_lookup', '6d4c2ca5-dffa-487a-b318-9597083c9479') }}"
        - "{{ lookup('passbolt.passbolt_lookup.passbolt_lookup', '6d4c2ca5-dffa-487a-b318-9597083c9479') }}"
        - "{{ lookup('passbolt.passbolt_lookup.passbolt_lookup', '6d4c2ca5-dffa-487a-b318-9597083c9479') }}"
        - "{{ lookup('passbolt.passbolt_lookup.passbolt_lookup', '6d4c2ca5-dffa-487a-b318-9597083c9479') }}"
        - "{{ lookup('passbolt.passbolt_lookup.passbolt_lookup', '6d4c2ca5-dffa-487a-b318-9597083c9479') }}"
        - "{{ lookup('passbolt.passbolt_lookup.passbolt_lookup', '6d4c2ca5-dffa-487a-b318-9597083c9479') }}"
        - "{{ lookup('passbolt.passbolt_lookup.passbolt_lookup', '6d4c2ca5-dffa-487a-b318-9597083c9479') }}"
  • “Previously” with `daniel_lynch.passbolt.get_password` with search on name + username and gpgkey & passphrase on ansilble-vault, the example with 10 output of the same password take 16-17 seconds (tested 5 times to ensure we have something stable)
  • “now” with passbolt_lookup & uid, it’s take 27-28 seconds (tested 5 times to ensure we have something stable)
    • But we don’t want to use it like this as it’s will be a pain for us to known with entrie is using ansible and a uuid meaning nothing for use. It’s much more easy to use `name=CephFS client sql, username=sql` instead.
  • “now” with passbolt_lookup & name search, it’s take 40-41 seconds (tested 5 times to ensure we have something stable)
    • So it’s 2.5 slower than on current system.
  • It’s search with name & username, it’s the same performance as name search only

Detail of ansible-playbook in debug mode :

Summary

$ time ansible-playbook passbolt_perf2.yml -vvvv
ansible-playbook [core 2.16.18]
config file = /home/xxx/git/ansible/ansible.cfg
configured module search path = [‘/usr/local/lib/python3.6/site-packages/git_acp/modules’]
ansible python module location = /home/xxx/.local/share/pipx/venvs/ansible/lib/python3.12/site-packages/ansible
ansible collection location = /home/xxx/git/ansible/collections/ansible_collections
executable location = /home/xxx/.local/bin/ansible-playbook
python version = 3.12.3 (main, Jun 19 2026, 12:46:00) [GCC 13.3.0] (/home/xxx/.local/share/pipx/venvs/ansible/bin/python)
jinja version = 3.1.6
libyaml = True
Using /home/xxx/git/ansible/ansible.cfg as config file
setting up inventory plugins
Loading collection ansible.builtin from
host_list declined parsing /home/xxx/git/ansible/hosts as it did not pass its verify_file() method
script declined parsing /home/xxx/git/ansible/hosts as it did not pass its verify_file() method
auto declined parsing /home/xxx/git/ansible/hosts as it did not pass its verify_file() method
Parsed /home/xxx/git/ansible/hosts inventory source with ini plugin
Loading callback plugin default of type stdout, v2.0 from /home/xxx/.local/share/pipx/venvs/ansible/lib/python3.12/site-packages/ansible/plugins/callback/default.py
Skipping callback ‘default’, as we already have a stdout callback.
Skipping callback ‘minimal’, as we already have a stdout callback.
Skipping callback ‘oneline’, as we already have a stdout callback.

PLAYBOOK: passbolt_perf2.yml **********************************************************************************************************************
Positional arguments: passbolt_perf2.yml
verbosity: 4
connection: ssh
become_method: sudo
tags: (‘all’,)
inventory: (‘/home/xxx/git/ansible/hosts’,)
vault_password_files: (‘/home/xxx/git/ansible/conf/vault.yml’,)
forks: 5
1 plays in passbolt_perf2.yml
Read vars_file ‘conf/passbolt_new_TEST’
Read vars_file ‘conf/passbolt_new_TEST’
Read vars_file ‘conf/passbolt_new_TEST’

PLAY [localhost] **********************************************************************************************************************************
Read vars_file ‘conf/passbolt_new_TEST’
Loading collection passbolt.passbolt_lookup from /home/xxx/git/ansible/collections/ansible_collections/passbolt/passbolt_lookup
Skipping SSL validation is set to ‘False’.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Logged in
Passbolt lookup using ‘6d4c2ca5-dffa-487a-b318-9597083c9479’ as resource uuid.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Resource retrieved successfully
Logged out
Skipping SSL validation is set to ‘False’.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Logged in
Passbolt lookup using ‘6d4c2ca5-dffa-487a-b318-9597083c9479’ as resource uuid.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Resource retrieved successfully
Logged out
Skipping SSL validation is set to ‘False’.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Logged in
Passbolt lookup using ‘6d4c2ca5-dffa-487a-b318-9597083c9479’ as resource uuid.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Resource retrieved successfully
Logged out
Skipping SSL validation is set to ‘False’.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Logged in
Passbolt lookup using ‘6d4c2ca5-dffa-487a-b318-9597083c9479’ as resource uuid.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Resource retrieved successfully
Logged out
Skipping SSL validation is set to ‘False’.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Logged in
Passbolt lookup using ‘6d4c2ca5-dffa-487a-b318-9597083c9479’ as resource uuid.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Resource retrieved successfully
Logged out
Skipping SSL validation is set to ‘False’.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Logged in
Passbolt lookup using ‘6d4c2ca5-dffa-487a-b318-9597083c9479’ as resource uuid.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Resource retrieved successfully
Logged out
Skipping SSL validation is set to ‘False’.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Logged in
Passbolt lookup using ‘6d4c2ca5-dffa-487a-b318-9597083c9479’ as resource uuid.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Resource retrieved successfully
Logged out
Skipping SSL validation is set to ‘False’.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Logged in
Passbolt lookup using ‘6d4c2ca5-dffa-487a-b318-9597083c9479’ as resource uuid.
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Trying secret FileVaultSecret(filename=‘/home/xxx/git/ansible/conf/vault.yml’) for vault_id=default
Resource retrieved successfully
Logged out
…

- → remove few lines otherwise message too long to be able to post-it.

…

TASK [Passbolt lookup plugin / loop with filters] *************************************************************************************************
task path: /home/xxx/git/ansible/passbolt_perf2.yml:8
ok: [localhost] => (item={‘name’: ‘test perf’, ‘password’: ‘random_password’}) => {
“ansible_loop_var”: “item”,
“item”: {
“name”: “test perf”,
“password”: “random_password”
}
}
ok: [localhost] => (item={‘name’: ‘test perf’, ‘password’: ‘random_password’}) => {
“ansible_loop_var”: “item”,
“item”: {
“name”: “test perf”,
“password”: “random_password”
}
}
ok: [localhost] => (item={‘name’: ‘test perf’, ‘password’: ‘random_password’}) => {
“ansible_loop_var”: “item”,
“item”: {
“name”: “test perf”,
“password”: “random_password”
}
}
ok: [localhost] => (item={‘name’: ‘test perf’, ‘password’: ‘random_password’}) => {
“ansible_loop_var”: “item”,
“item”: {
“name”: “test perf”,
“password”: “random_password”
}
}
ok: [localhost] => (item={‘name’: ‘test perf’, ‘password’: ‘random_password’}) => {
“ansible_loop_var”: “item”,
“item”: {
“name”: “test perf”,
“password”: “random_password”
}
}
ok: [localhost] => (item={‘name’: ‘test perf’, ‘password’: ‘random_password’}) => {
“ansible_loop_var”: “item”,
“item”: {
“name”: “test perf”,
“password”: “random_password”
}
}
ok: [localhost] => (item={‘name’: ‘test perf’, ‘password’: ‘random_password’}) => {
“ansible_loop_var”: “item”,
“item”: {
“name”: “test perf”,
“password”: “random_password”
}
}
ok: [localhost] => (item={‘name’: ‘test perf’, ‘password’: ‘random_password’}) => {
“ansible_loop_var”: “item”,
“item”: {
“name”: “test perf”,
“password”: “random_password”
}
}
ok: [localhost] => (item={‘name’: ‘test perf’, ‘password’: ‘random_password’}) => {
“ansible_loop_var”: “item”,
“item”: {
“name”: “test perf”,
“password”: “random_password”
}
}
ok: [localhost] => (item={‘name’: ‘test perf’, ‘password’: ‘random_password’}) => {
“ansible_loop_var”: “item”,
“item”: {
“name”: “test perf”,
“password”: “random_password”
}
}

PLAY RECAP ****************************************************************************************************************************************
localhost : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

real 0m27,545s
user 0m2,783s
sys 0m0,400s

PS: do you known why this output contains 15 Trying secret FileVaultSecret on the first iteration, then 12 for the second, then 15, 12, 15, 12, …

Have a nice day

4

Hello @roumano :slight_smile:
Thanks a lot for the detailed benchmarks and the full -vvvv output. That level of detail is genuinely helpful, and it let me pinpoint exactly what is happening.

I went back to our original functional and technical specification, especially the “Session handling and renewal” part, and what you are seeing is so far an expected behaviour rather than a regression. For security reasons, each lookup is fully self-contained, meaning it authenticates, reads the resource, and logs out, with no session state surviving from one lookup to the next. The JWT is treated as a strictly short-lived secret, used immediately within a single lookup and then discarded, never persisted and never reused across calls.

The important point for your case is that you are already using the fastest lookup form, a direct UUID, so the time is not going into finding the resource. It is going into re-authenticating on every single lookup. Your trace confirms it, since each item goes through a complete “Logged in … Resource retrieved successfully … Logged out” cycle. In practice, ten items in your loop mean ten full cycles of rebuilding the OpenPGP keyring from your account kit, checking the server key, performing a full JWT login, fetching and decrypting the resource, then logging out. That fixed cost does not amortize across the loop, and that is essentially what your timings are measuring.

I also understand that UUIDs are painful to work with day to day, since a bare UUID tells you nothing about the entry it points to, where metadata are far more readable (and that’s also why we iterated on it). The trade-off today is that a name lookup adds a resolution step on top of that same per-lookup authentication, which is why it comes out slower than the UUID form in your tests. The authentication itself is the common floor in both cases.

About the Trying secret FileVaultSecret lines, I belive that those come from ansible-vault decrypting your vars_file, not from the lookup plugin itself, so it seem an expected ansible behaviour. That part is an ansible-vault internal detail rather than something the plugin drives, so I would not read too much into the exact figures.

On the bigger picture, I have opened an internal ticket (PB-53256) so we can discuss retrieving several secrets within a single play, something already flagged in the original specification as a potential future improvement. The idea could be to perform a batch of reads inside one ephemeral authentication window instead of re-authenticating on every lookup, so the authentication cost is amortized across the run while keeping the exact same security guarantee of no token persistence. I cannot commit to a timeline at this stage as I need to discuss these points with our team, but I will keep you posted as soon as I know more.

Thanks again for the report and the logs, they really do help.

1 Like