Inicio
Productos
Red Hat Enterprise Linux
8
Automating system administration by using RHEL system roles
Chapter 3. Ansible vault

Este contenido no está disponible en el idioma seleccionado.

Chapter 3. Ansible vault

You can use Ansible vault to encrypt sensitive data, such as passwords and API keys, in your playbooks.

Storing sensitive data in plain text in variables or other Ansible-compatible files is a security risk because any user with access to those files can read the sensitive data.

With Ansible vault, you can encrypt, decrypt, view, and edit sensitive information. They could be included as:

Inserted variable files in an Ansible Playbook
Host and group variables
Variable files passed as arguments when executing the playbook
Variables defined in Ansible roles

You can use Ansible vault to securely manage individual variables, entire files, or even structured data like YAML files. This data can then be safely stored in a version control system or shared with team members without exposing sensitive information.

Important

Files are protected with symmetric encryption of the Advanced Encryption Standard (AES256), where a single password or passphrase is used both to encrypt and decrypt the data. Note that the way this is done has not been formally audited by a third party.

To simplify management, it makes sense to set up your Ansible project so that sensitive variables and all other variables are kept in separate files, or directories. Then you can protect the files containing sensitive variables with the ansible-vault command.

Creating an encrypted file

The following command prompts you for a new vault password. Then it opens a file for storing sensitive variables using the default editor.

ansible-vault create vault.yml

# ansible-vault create vault.yml
New Vault password: <vault_password>
Confirm New Vault password: <vault_password>

Copy to Clipboard

Toggle word wrap

Viewing an encrypted file

The following command prompts you for your existing vault password. Then it displays the sensitive contents of an already encrypted file.

ansible-vault view vault.yml

# ansible-vault view vault.yml
Vault password: <vault_password>
my_secret: "yJJvPqhsiusmmPPZdnjndkdnYNDjdj782meUZcw"

Copy to Clipboard

Toggle word wrap

Editing an encrypted file

The following command prompts you for your existing vault password. Then it opens the already encrypted file for you to update the sensitive variables using the default editor.

ansible-vault edit vault.yml

# ansible-vault edit vault.yml
Vault password: <vault_password>

Copy to Clipboard

Toggle word wrap

Encrypting an existing file

The following command prompts you for a new vault password. Then it encrypts an existing unencrypted file.

ansible-vault encrypt vault.yml

# ansible-vault encrypt vault.yml
New Vault password: <vault_password>
Confirm New Vault password: <vault_password>
Encryption successful

Copy to Clipboard

Toggle word wrap

Decrypting an existing file

The following command prompts you for your existing vault password. Then it decrypts an existing encrypted file.

ansible-vault decrypt vault.yml

# ansible-vault decrypt vault.yml
Vault password: <vault_password>
Decryption successful

Copy to Clipboard

Toggle word wrap

Changing the password of an encrypted file

The following command prompts you for your original vault password, then for the new vault password.

ansible-vault rekey vault.yml

# ansible-vault rekey vault.yml
Vault password: <vault_password>
New Vault password: <vault_password>
Confirm New Vault password: <vault_password>
Rekey successful

Copy to Clipboard

Toggle word wrap

Basic application of Ansible vault variables in a playbook

---
- name: Create user accounts for all servers
  hosts: managed-node-01.example.com
  vars_files:
    - ~/vault.yml
  tasks:
    - name: Create user from vault.yml file
      user:
        name: "{{ username }}"
        password: "{{ pwhash }}"

---
- name: Create user accounts for all servers
  hosts: managed-node-01.example.com
  vars_files:
    - ~/vault.yml
  tasks:
    - name: Create user from vault.yml file
      user:
        name: "{{ username }}"
        password: "{{ pwhash }}"

Copy to Clipboard

Toggle word wrap

You read-in the file with variables (vault.yml) in the vars_files section of your Ansible Playbook, and you use the curly brackets the same way you would do with your ordinary variables. Then you either run the playbook with the ansible-playbook --ask-vault-pass command and you enter the password manually. Or you save the password in a separate file and you run the playbook with the ansible-playbook --vault-password-file /path/to/my/vault-password-file command.

Volver arriba

Este contenido no está disponible en el idioma seleccionado.

Chapter 3. Ansible vault

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Hacer que el código abierto sea más inclusivo

Acerca de Red Hat

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links