Working with Ansible Vault

1. Creating Encrypted Files

To create a new encrypted file, use the ansible-vault create command. This will prompt you to enter a password and then open your default editor to write the content.

ansible-vault create secret_vars.yml

2. Encrypting Existing Files

To encrypt an existing file, use the ansible-vault encrypt command. This will prompt you for a password and then encrypt the file in place.

ansible-vault encrypt existing_file.yml

3. Decrypting Files

To decrypt an encrypted file, use the ansible-vault decrypt command. This will prompt you for a password and then decrypt the file in place.

ansible-vault decrypt secret_vars.yml

4. Editing Encrypted Files

To edit an encrypted file, use the ansible-vault edit command. This will open your default editor with the decrypted content.

ansible-vault edit secret_vars.yml

5. Viewing Encrypted Files

To view the contents of an encrypted file, use the ansible-vault view command. This will display the decrypted content without modifying the file.

ansible-vault view secret_vars.yml

6. Changing Vault Password

To change the password for an encrypted file, use the ansible-vault rekey command. This will prompt you for the current password and then ask for a new password.

ansible-vault rekey secret_vars.yml

7. Using Vault in Playbooks

To use encrypted variables in playbooks, reference them using the ansible.builtin.lookup plugin with the vault source.

- name: Use encrypted variable
  hosts: localhost
  tasks:
    - name: Print secret value
      debug:
        msg: "Secret is {{ lookup('vault', 'secret_key') }}"

8. Using Vault Password File

To avoid entering the password manually each time, you can store it in a file and use it with the --vault-password-file option.

ansible-playbook playbook.yml --vault-password-file vault_pass.txt

9. Using Multiple Vault IDs

You can use multiple vault IDs to organize encrypted content. Each ID has its own password and can be used independently.

ansible-vault create --vault-id dev@vault_pass.txt secret_vars.yml

10. Encrypting Variables

To encrypt a variable directly, use the ansible-vault encrypt_string command. This will output an encrypted string that can be used in playbooks.

ansible-vault encrypt_string 'secret_value' --name 'my_secret'

11. Using Inline Vault Variables

You can use inline vault variables in playbooks using the !vault tag.

- name: Use inline vault variable
  hosts: localhost
  tasks:
    - name: Print secret value
      debug:
        msg: "Secret is {{ my_secret }}"

12. Setting Vault ID Default

To set a default vault ID for all operations, you can configure it in the ansible.cfg file.

[defaults]
vault_id_default = dev