0%

Ansible part6: ansible vault encrypt file

Posted on Disqus:

Ansible Vault is a feature of ansible that allows you to keep sensitive data such as passwords or keys in encrypted files, rather than as plaintext in playbooks or roles. These vault files can then be distributed or placed in source control.

encrypt a file using ansible-vault

I created a vars file to test ansible-vault command

1
2
3
port: 443
greeting: "greeting from vars file"
ansible_user: pi

the command of ansible vault
ansible-vault encrypt filename Encrypt YAML file

1
2
3
4
5
6
7
8
9
10
11
12
13
anna@ansible-controller:~/Desktop/ansible-code/inventory/ansible-vault/vars-file$ ansible-vault encrypt vars.yml 
New Vault password: 
Confirm New Vault password: 
Encryption successful

$ANSIBLE_VAULT;1.1;AES256
32616166663766383930373164386335626133313233303037306363306135306534613764666663
6335643762616561393434613331303961373863393035340a376132363132623933623535663933
33393831666662613736616635626366383136333832633566363439343835343637663734663132
3739313466386339380a636633383133356165343335326561626338356561633432646361636639
38653737613034656134353830386239666138653734373535363033303033343232306664343330
32383139313865353930303136383636363839346338326534656663366637373834393063656236
363635613164316232346637303564663239

then decrypt this file

ansible-vault decrypt filename Decrypt a vault encrypted file

1
2
3
4
5
6
7
anna@ansible-controller:~/Desktop/ansible-code/inventory/ansible-vault/vars-file$ ansible-vault decrypt vars.yml 
Vault password: 
Decryption successful

port: 443
greeting: "greeting from vars file"
ansible_user: pi

other commands:
ansible-vault view filename View a vault encrypted file with inputting the password
ansible-vault edit filename Edit a vault encrypted file with password, and without decrypt and encrypt

argument --ask-vault-pass

after encrypt the vars file, I am going to print the variable of “ansible_usr” in varsfile, following is the playbook:

1
2
3
4
tasks: 
    - name:
      debug:
        msg: "{{ ansible_user }}"

because the varsfile is encrypted, the playbook can’t read it without password.

1
2
anna@ansible-controller:~/Desktop/ansible-code/inventory/ansible-vault$ ansible-playbook site.yml
ERROR! Attempting to decrypt but no vault secrets found

So I need give an argument --ask-vault-pass after ansible-playbook command to let user input the password to decrypt the file.

1
2
3
4
5
6
7
8
9
10
11
12
anna@ansible-controller:~/Desktop/ansible-code/inventory/ansible-vault$ ansible-playbook site.yml --ask-vault-pass
Vault password: 

PLAY [test ansible vault] **********************************************************************************************************************************************************************************************************************

TASK [debug] ***********************************************************************************************************************************************************************************************************************************
ok: [ansible-node1] => {
    "msg": "pi"
}

PLAY RECAP *************************************************************************************************************************************************************************************************************************************
ansible-node1              : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

With this argument, playbook works well.