Ansible Vault

Sometimes working with ansible requires using sensitive information, such as:

  • Administrative passwords
  • Service account credentials
  • API tokens
  • Database connection strings
  • SSH private keys
  • TLS certificates and keys
  • Cloud provider credentials

Ansible Vault is used to securely store sensitive information within Ansible projects by encrypting data at rest. Instead of storing sensitive information in plain text, Ansible Vault encrypts them so they can be safely committed to version control systems such as Git.

Let’s see how it works. First take a look at the secrets.yml file in the playbooks directory

cat secrets.yml

Next encrypt the file and have another look.

ansible-vault encrypt secrets.yml
cat secrets.yml

Take a look at view_secrets.yml and then we’ll execute it to see it read the file while still encrypted and print out the contents.

ansible-playbook view_secrets.yml

Our .bashrc file creates and environmental variable of ANSIBLE_VAULT_PASSWORD_FILE which points to a file on the local filesystem with a super complex password. If this variable and file did not exist, vault would prompt for a password to encrypt/decrypt the file.