Ansible - Encrypting Sensitive Data with Vault

Ansible Vault is a feature within Ansible that allows you to keep sensitive data such as passwords, API keys, and certificates encrypted within your playbooks. This ensures that your sensitive information is not exposed in plaintext.

Step 1: Test Connection to Hosts

First, ensure you can connect to your hosts using Ansible:

ansible all -i inventory.ini -m ping

Step 2: Create a Vault File

Next, create a YAML file to store your sensitive data:

vi vault.yaml

Add your variables (e.g., username and password) inside this file:

You can check the content of the file with:

cat vault.yaml

Step 3: Create a Playbook

Create a playbook (pass.yaml) that references the vault file:

vi pass.yaml

Include the following content in your playbook:

- hosts: all
  remote_user: ubuntu
  become: yes
  vars_files:
    - vault.yaml

  tasks:
    - name: Trying out echo command
      debug:
        msg: "Hello my username is {{ username }} & pass is {{ password }}"

Step 4: Run the Playbook

Run the playbook to verify that it works with the variables from the vault file:

 ansible-playbook -i inventory.ini pass.yaml

Step 5: Encrypt the Vault File

To protect your sensitive data, encrypt the vault.yaml file:

ansible-vault encrypt vault.yaml

You can check that the file is encrypted by running:

cat vault.yaml

Step 6: Run the Playbook with Encrypted Vault

Even with the vault file encrypted, you can still run your playbook as usual:

 ansible-playbook -i inventory.ini pass.yaml

Alternatively, if you want to be prompted for the vault password at runtime, use:

ansible-playbook -i inventory.ini pass.yaml --ask-vault-password

Step 7: View the Encrypted Vault

If you need to view the contents of the encrypted vault, use:

ansible-vault view vault.yaml

Step 8: Decrypt the Vault File

To decrypt the vault file, run:

ansible-vault decrypt vault.yaml

Finally, verify the decryption by checking the content of the file:

cat vault.yaml

Conclusion

Following these steps, you can effectively use Ansible Vault to manage and secure sensitive data in your playbooks.

Ansible - Encrypting Sensitive Data with Vault

Comments

DevOps

Kubernetes Architecture and Components

More from this blog

Day 32 - Kubernetes Interview Q&A

Day 31 - KUBERNETES MONITORING USING PROMETHEUS & GRAFANA

Day 30 - Kubernetes ConfigMaps & Secrets

Day 29 - Kubernetes Custom Resources

Day 28 - Kubernetes Service, Ingress, TLS & Ingress Controllers

Conclusion

Command Palette

Comments

DevOps

Kubernetes Architecture and Components

More from this blog

Conclusion