Vault
Learn about the Ansible vault, which allows us to store sensitive information and passwords securely.
We'll cover the following...
The Ansible vault encrypts variables and files to protect sensitive content and lets us use them with Ansible playbooks or roles. The AES 256 cipher protects files with strong encryption in the latest versions of Ansible.
We can manage the Ansible vault using the ansible-vault command in the terminal included in all Ansible installations.
Creating an encrypted file
The create parameter of the ansible-vault command is used to create a new encrypted file. It prompts the new vault password and opens an empty file using the default editor, which is the most commonly-used Vim editor.
The command to create our Ansible vault is the following:
ansible-vault create secret.yml
The command above will create the secret.yml file.
The command doesn’t show any output when we enter the password on the terminal (not even the * symbol).
We need to enter our password twice in the terminal manually. Here is the output of the above command:
New Vault password:Confirm New Vault password:
The Ansible vault is a YAML document, so it always begins with ---. Let’s suppose we want to insert a single password variable with the value mysupersecretpassword in the encrypted file.
---password: mysupersecretpassword
Errors with the create parameter
The following two errors might occur when using the ansible-vault create command:
- Password mismatch error
- File already exists error
When the two passwords don’t ...