Devnet
Managing-Secrets-and-Keys
Ansible Vault

Ansible Secure Storage

Ansible Secure Storage, known as Vault, provides a robust solution for safeguarding sensitive information within Ansible. It ensures that confidential data remains encrypted, preventing unauthorized access. With Vault, you can encrypt various types of data, be it variables or structured and unstructured files, ensuring their security. Access to encrypted content requires the vault password, commonly referred to as the key, which must be kept confidential.

Managing Vault

Ansible Vault, a command-line tool, facilitates the management of encrypted files. Below is an overview of its functionality:

cisco@machine$ ansible-vault
usage: ansible-vault [-h] [--version] [-v] {create,decrypt,edit,view,encrypt,encrypt_string,rekey} ...

Actions available:

  • create: Generates a new encrypted file.
  • decrypt: Decrypts an encrypted file.
  • edit: Allows editing an existing encrypted file.
  • view: Displays the content of an encrypted file.
  • encrypt: Encrypts a file.
  • encrypt_string: Encrypts a string.
  • rekey: Sets a new key for an existing encrypted file.

Optional arguments:

  • -h or --help: Displays help.
  • --version: Specifies Ansible version.
  • -v or --verbose: Sets verbose mode.

Creating Vault

You can create a vault file in two ways:

  1. Create Action: Generates a vault file from scratch.
cisco@machine$ ansible-vault create vault_file.yml
New Vault password:
Confirm New Vault password:
  1. Encrypt Action: Encrypts an existing file.
cisco@machine$ ansible-vault encrypt existing_file.yml
New Vault password:
Confirm New Vault password:

Editing Vault Content

You can edit vault content securely:

cisco@machine$ ansible-vault edit vault_file.yml
Vault password:

Viewing Vault Content

To view vault content:

cisco@machine$ ansible-vault view vault_file.yml
Vault password:

Key Management

Change vault key with rekey action:

cisco@machine$ ansible-vault rekey vault_file.yml
Vault password:
New Vault password:
Confirm New Vault password:

Encrypting String

Encrypt individual variables:

cisco@machine$ ansible-vault encrypt_string 'sensitive_data' --name 'variable_name'

Sharing Vault Variables

Ensure secure sharing among team members:

  • Provide an unencrypted example vault file.
  • Each member creates their encrypted vault file.
  • Add the vault file to the version control system's ignore list.

Ansible Vault offers advanced features, detailed in the official documentation. With these practices, you can effectively manage sensitive data in collaborative environments.

Integration with CI/CD Systems

Integrating Ansible Vault into CI/CD workflows requires careful consideration of security and convenience. Here's how you can streamline the process:

  • Avoid hardcoded paths by setting the ANSIBLE_VAULT_PASSWORD_FILE environment variable.
cisco@machine$ export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass
  • Run playbooks without specifying the password file location:
cisco@machine$ ansible-playbook playbook.yml

Decryption on Demand

Encrypted variables are decrypted as needed in playbooks:

---
- name: Test variable decryption
  hosts: localhost
  vars:
    encrypted_variable: !vault |
      $ANSIBLE_VAULT;1.1;AES256
      encrypted_content_here
 
  tasks:
    - name: Print decrypted variable
      debug:
        msg: "Decrypted variable: {{ encrypted_variable }}"

Conclusion

Understanding Ansible Vault's functionality and best practices is crucial for securing sensitive information in Ansible projects. By following established guidelines and integrating Vault seamlessly into CI/CD pipelines, teams can ensure the confidentiality of their data while maintaining efficiency in their development processes. Explore further possibilities and features of Ansible Vault in the official documentation for comprehensive usage.

Ansible Vault Docs (opens in a new tab)

InstallEnvironment Variable