SUKAATO's Hypomnema

20250516155653-Storing_Sensitive_Information_for_Ansible

2 min read

Storing Sensitive Information for Ansible

From bib. source

For the best security, use Ansible Vault to encrypt the file. […]

To encrypt the file with Vault, run:

ansible-vault encrypt vars/api_key.yml

Enter a secure password for the file, and Ansible will encrypt it.

An Ansble vault is a YAML variables file or inventory group or per-host variable file to be referenced in a playbook, that has been encrypted using the ansible-vault command. A secret is a variable definition within a variable file that has been made into a vault.

Encrypting via ansible-vault involves using the subcommand encrypt with a file path to a YAML variables file (Geerling 2023, 104-105):

ansible-vault encrypt $PATH_TO_VAR_FILE

Then, when running the playbook that makes use of the given vault one would need to use the flag ask-vault-pass on the ansible-playbook command (refer to 20250514154644-Running_Ansible_Playbooks) (Geerling 2023, 105):

ansible-playbook $PLAYBOOK_FILE_PATH --ask-vault-pass

Alternatively, a text file can be used to store the password for the vault, in which case it should have strict permissions similar to that of secure SSH keys found in the directory path ~/.ssh in Linux in addition to not checking them into source or version control (Geerling 2023, 106). This file can then be used in place of typing in the password when prompted (Ibid):

ansible-playbook $PLAYBOOK_FILE_PATH --vault-password-file $VAULT_PASSWORD_TEXT_FILE_PATH

There are other ansible-vault subcommands (Ibid):

  • edit, to edit the vault
  • rekey, to change the password for a vault
  • create, to create a new vault
  • view, to view the content of an existing vault
  • decrypt, to–well–decrypt the file

file_path Yet_Another_Markup_Language YAML_Aint_Markup_Language ad-hoc_command ad-hoc_commands command_line command_lines commands command_line_interface command_line_interfaces secret secrets vaults text_file text_files directory_path SSH secure_keys Secure_Shell_protocol source_control version_control plaintext plaintext_file plaintext_files

bibliography

  • “Ansible Playbooks - Beyond the Basics.” In Ansible for DevOps: Server and Configuration Management for Humans, 2nd ed., 84–122. Leanpub, 2023.

Graph View