Ansible vault is a tool that helps to encrypt, decrypt and manage sensitive data such as passwords, playbooks, files, etc.<\/p>\n
If a playbook is encrypted, ansible-navigator will prompt for the password if ones tries to execute it. One of the use case is that it will block junior system admins to run critical playbooks, while may allow non-critical playbooks that are not encrypted.<\/p>\n
Below are few of the commands used with ansible vault:<\/p>\n
The below command creates a new encrypted file and prompts for the new Vault password. It then opens a file using the default vi editor.<\/p>\n
[root@centos9vm ~]#<\/strong> ansible-vault create sampleplaybook.yml [root@centos9vm ~]#<\/strong> ansible-vault view sampleplaybook.yml Below command encrypts an existing file<\/p>\n [root@centos9vm ~]#<\/strong> ansible-vault encrypt shijuplaybook.yml [root@centos9vm ~]#<\/strong> ansible-vault view shijuplaybook.yml ==== ==== === – name: Install httpd server ==== ==== ===<\/p>\n [root@centos9vm ~]#<\/strong> ansible-vault edit sampleplaybook.yml playbook: \/root\/shijuplaybook.yml<\/p>\n [root@centos9vm ~]#\u00a0<\/strong>ansible-navigator run -m stdout shijuplaybook.yml –ask-vault-pass –enable-prompt ===== =====<\/p>\n PLAY [shiju sample playbook] ********************************************************************************************************************************<\/em><\/p>\n TASK [Gathering Facts] **************************************************************************************************************************************<\/em> TASK [Add a user shiju100] **********************************************************************************************************************************<\/em> TASK [Install httpd server] *********************************************************************************************************************************<\/em> PLAY RECAP **************************************************************************************************************************************************<\/em> ===== =====<\/p>\n Changing the encryption password<\/span><\/p>\n [root@centos9vm ~]#<\/strong> ansible-vault rekey shijuplaybook.yml Creating a password file to encrypt paybooks<\/span><\/p>\n [root@centos9vm ~]#<\/strong> echo “this is a password file %#$#” > secret [root@centos9vm ~]#<\/strong> ansible-vault decrypt shijuplaybook.yml [root@centos9vm ~]#<\/strong> ansible-navigator run -m stdout shijuplaybook.yml –syntax-check –enable-prompts –vault-password-file=secret<\/p>\n playbook: \/root\/shijuplaybook.yml<\/p>\n The below command creates a new file using the password stored in the above used secret file:<\/p>\n [root@centos9vm ~]#<\/strong>\u00a0ansible-vault create theplaybook.yml –vault-password-file=secret
\nNew Vault password:
\nConfirm New Vault password:<\/p>\n
\nVault password:
\ntest<\/p>\n
\nNew Vault password:
\nConfirm New Vault password:
\nEncryption successful<\/p>\n
\nVault password:<\/p>\n
\n—
\n– name: shiju sample playbook
\nhosts: testGRP
\ntasks:
\n– name: Add a user shiju100
\nansible.builtin.user:
\nname: “{{ theUser }}”
\nstate: present<\/p>\n
\nansible.builtin.dnf:
\nname: httpd
\nstate: present<\/p>\n
\nVault password:
\n[root@centos9vm ~]#<\/strong>\u00a0ansible-navigator run -m stdout shijuplaybook.yml –syntax-check –ask-vault-password –enable-prompts
\nVault password:<\/p>\n
\nVault password:<\/p>\n
\nok: [192.168.132.130]<\/em><\/p>\n
\nok: [192.168.132.130]<\/em><\/p>\n
\nok: [192.168.132.130]<\/em><\/p>\n
\n192.168.132.130 : ok=3 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0<\/em><\/p>\n
\nVault password:<\/em>
\nNew Vault password:<\/em>
\nConfirm New Vault password:<\/em>
\nRekey successful<\/em><\/p>\n
\n[root@centos9vm ~]#<\/strong> ls -ltr | grep secret
\n-rw-r–r–. 1 root root 28 Feb 27 11:20 secret<\/p>\n
\nVault password:
\nDecryption successful
\n[root@centos9vm ~]#<\/strong> ansible-vault encrypt shijuplaybook.yml –vault-password-file=secret
\nEncryption successful<\/p>\n
\nEncryption successful<\/p>\n","protected":false},"excerpt":{"rendered":"