Ansible/Vaults - Revision history

Admin: /* Encrypted data embedded in yaml */

2018-12-08T20:18:10Z

Encrypted data embedded in yaml

← Older revision		Revision as of 20:18, 8 December 2018
Line 37:		Line 37:

	<pre>		<pre>
	ansible-vault encrypt_string --vault-id a_password_file 'foobar' --name 'the_secret'		ansible-vault encrypt_string --vault-id a_password_file 'foobar' --name 'the_secret'
			^^^^^^^^^^^ ^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^ ^^^^^^ ^^^^^^^^^
			the command the action name of a file secret value secret key
			containing just
			plaintext password

	</pre>		</pre>

Admin: /* Basic Usage */

2018-12-08T20:16:45Z

Basic Usage

← Older revision		Revision as of 20:16, 8 December 2018
Line 10:		Line 10:

	This encrypted data can be stored in a public place, as it can only be decrypted with the appropriate passphrase.		This encrypted data can be stored in a public place, as it can only be decrypted with the appropriate passphrase.

			Side note: this is a useful guide: https://www.digitalocean.com/community/tutorials/how-to-use-vault-to-protect-sensitive-ansible-data-on-ubuntu-16-04


	==Basic Usage==		==Basic Usage==

Admin at 20:09, 6 December 2018

2018-12-06T20:09:47Z

← Older revision		Revision as of 20:09, 6 December 2018
Line 11:		Line 11:
	This encrypted data can be stored in a public place, as it can only be decrypted with the appropriate passphrase.		This encrypted data can be stored in a public place, as it can only be decrypted with the appropriate passphrase.

	~~To encrypt, call <code>ansible-vault create foo.yml</code>~~		==Basic Usage==

	~~To edit, call <code>ansible-~~vault ~~edit foo~~.~~yml</code>~~		There are actually two ways to use encrypted variables: one is to create a standalone vault file; the other is to embed encrypted variables directly in yaml files.

	~~To view, call <code>ansible-vault view foo~~.~~yml bar.yml baz.yml</code>~~		We cover both methods below.

	==~~Basic usage~~==		===Standalone Vault File===

	~~===Encrypting~~ a ~~string using~~ ansible-vault~~===~~		To create a vault, call <code>ansible-vault create foo.yml</code>

	~~To encrypt~~ a ~~string, use the ansible-vault encrypt_string command.~~		This will prompt you for a password

	~~Link: https://docs.ansible.com/ansible/latest/cli/~~ansible-vault.~~html#ansible-vault-encrypt-string~~		To edit a vault, call <code>ansible-vault edit foo.yml</code>

	===Using a playbook with vault encrypted data===		To view a vault, call <code>ansible-vault view foo.yml bar.yml baz.yml</code>

			===Encrypted data embedded in yaml===

			To embed encrypted data directly into yaml, use the command line to encrypt a string, then copy and paste into the yaml file.

			In the following command lines, the <code>--vault-id a_password_file</code> bit just specifies that

			<pre>
			ansible-vault encrypt_string --vault-id a_password_file 'foobar' --name 'the_secret'
			</pre>

			==Using a playbook with vault encrypted data==

	Example of a call to a playbook that uses vault-encrypted data:		Example of a call to a playbook that uses vault-encrypted data:

Admin at 19:48, 6 December 2018

2018-12-06T19:48:54Z

← Older revision		Revision as of 19:48, 6 December 2018
Line 1:		Line 1:
	Ansible Vaults are ways of storing encrypted, sensitive data like passwords or keys.		Ansible Vaults are ways of storing encrypted, sensitive data like passwords or keys.

	~~The encrypted data can be stored in (e~~.g.~~) a Github repo, and only decrypted by Ansible~~.		Link: https://docs.ansible.com/ansible/latest/user_guide/vault.html

	To use, ~~call the <code>~~ansible-vault~~</code> tool~~ and ~~give~~ it the ~~password using either~~ <code>~~--ask~~-vault~~-pass~~</code> or <code>--vault~~-password-file~~</code>~~. Or set the location of the vault password file in~~ <code>ansible.~~cfg~~</code>.		==How does it work==

			To use ansible vault, you execute a command to tell ansible you want to create a vault (an encrypted chunk of plain text).

			Ansible prompts you for a password, then opens a text editor, where you enter your sensitive information. This way, your sensitive information will only exist in a temporary buffer. When you are done editing, you save and close, and the file is automatically encrypted before being written to disk.

			This encrypted data can be stored in a public place, as it can only be decrypted with the appropriate passphrase.

			To encrypt, call <code>ansible-vault create foo.yml</code>

			To edit, call <code>ansible-vault edit foo.yml</code>

			To view, call <code>ansible-vault view foo.yml bar.yml baz.yml</code>

	==Basic usage==		==Basic usage==

Admin at 22:07, 13 November 2018

2018-11-13T22:07:02Z

← Older revision		Revision as of 22:07, 13 November 2018
Line 32:		Line 32:
	ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt ansible-playbook site.yml		ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt ansible-playbook site.yml
	</pre>		</pre>




			==Flags==

			{{AnsibleFlag}}

Admin at 22:06, 13 November 2018

2018-11-13T22:06:40Z

← Older revision		Revision as of 22:06, 13 November 2018
Line 4:		Line 4:

	To use, call the <code>ansible-vault</code> tool and give it the password using either <code>--ask-vault-pass</code> or <code>--vault-password-file</code>. Or set the location of the vault password file in <code>ansible.cfg</code>.		To use, call the <code>ansible-vault</code> tool and give it the password using either <code>--ask-vault-pass</code> or <code>--vault-password-file</code>. Or set the location of the vault password file in <code>ansible.cfg</code>.

			==Basic usage==

			===Encrypting a string using ansible-vault===

			To encrypt a string, use the ansible-vault encrypt_string command.

			Link: https://docs.ansible.com/ansible/latest/cli/ansible-vault.html#ansible-vault-encrypt-string

			===Using a playbook with vault encrypted data===

	Example of a call to a playbook that uses vault-encrypted data:		Example of a call to a playbook that uses vault-encrypted data:

Admin: Created page with "Ansible Vaults are ways of storing encrypted, sensitive data like passwords or keys. The encrypted data can be stored in (e.g.) a Github repo, and only decrypted by Ansible...."

2018-11-13T22:00:14Z

Created page with "Ansible Vaults are ways of storing encrypted, sensitive data like passwords or keys. The encrypted data can be stored in (e.g.) a Github repo, and only decrypted by Ansible...."

New page

Ansible Vaults are ways of storing encrypted, sensitive data like passwords or keys.

The encrypted data can be stored in (e.g.) a Github repo, and only decrypted by Ansible.

To use, call the <code>ansible-vault</code> tool and give it the password using either <code>--ask-vault-pass</code> or <code>--vault-password-file</code>. Or set the location of the vault password file in <code>ansible.cfg</code>.

Example of a call to a playbook that uses vault-encrypted data:

<pre>
ansible-playbook site.yml --ask-vault-pass
</pre>

Alternative that uses a file containing the password:

<pre>
ansible-playbook site.yml --vault-password-file ~/.vault_pass.txt
</pre>

Third alternative is to use an environment variable:

<pre>
ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt ansible-playbook site.yml
</pre>