Ansible Vault

 Ansibel Vault

Ansible Vault performs various operations. Specifically, it can

Encrypt/Decrypt a file

View an encrypted file without breaking the encryption

Edit an encrypted file

Create an encrypted file

Generate or reset the encrypted key

Ansible Vault uses AES256 encryption

The ansible-vault create command is used to create the encrypted file.

# ansible-vault create test_vault # it will prompt for a password

New Vault password:

Confirm New Vault password:

# cat test_vault

$ANSIBLE_VAULT;1.1;AES256

34363365356262323333626363616366383161393739663331373231386563306632323163336231

6537393461353932353035373561636461633738396662640a316165346666303439303030623032

62653534643866343465313134373862343839646434353130393764366632393237656265303531

3062613639663865310a383137316133653435643236336635626661323736646336323434643164

6162

Ansibel Vault id

# ansible-vault create --vault-id password@prompt multi_vault.yml

New vault password (password):

Confirm new vault password (password):

Edit File

# ansible-vault edit multi_vault.yml

Decrypting File

# ansible-vault edit multi_vault.yml

once decrypt the file can be opened using cat

While running playbook

# ansible-playbook --ask-vault-pass multi_vault.yml

Change/reset password for vault

# ansible-vault rekey multi_vault.yml

Vault password:

New Vault password:

Confirm New Vault password:

Rekey successful

Multi Vault

Ansible Vault allows operators to work with multiple vaults, each uniquely identified by a vault ID.

Vault IDs provide a “hint” to indicate the correct password to use when decrypting a vault file.

# Encrypt staging config with "mte & prod" vault ID

# ansible-vault encrypt --vault-id mte@prompt config/sec_mte.yml

# ansible-vault encrypt --vault-id prod@prompt config/sec_prod.yml

# ansible-playbook site.yml -i inventory.ini --vault-id staging@prompt --vault-id prod@vault_prod_pass.txt

Configuring Vault IDs in ansible.cfg

# ansible.cfg

[defaults]

# Comma-separated list of vault identity sources

vault_identity_list = dev@~/.vault_pass_dev, staging@~/.vault_pass_staging, prod@~/.vault_pass_prod