I'm trying to develop a Playbook which must handle sensitive user data (SSH keys, Registry credentials, etc.).
Only a user and the Ansible controller can see the data associated with that same user.
The data will be stored in a Git repository, accessible to all users.
Thus it must be encrypted.
I'm having an issue to securely encrypt the data using Ansible vault.
The problem is that I cannot give the Ansible vault secret to the user, as the secret can decrypt the ciphertext.
The perfect solution would be to use asymmetric encryption, which I didn't find anyway to do.
The only solution can I see at the moment is this:
- User encrypt its data using a public key
- User sends ciphertext to Ansible controller
- Ansible controller decrypts the ciphertext using a private key
- Ansible controller encrypts the cleartext using ansible vault (symmetric cipher this time)
- Ansible controller commits the ciphertext to the git repository
But it'll be painful to setup this process. It would be much simpler if the user could commit the ciphertext encrypted with the public key.
- Is it possible to setup Ansible vault to use asymmetric encryption ?
- Is it possible to setup the playbook to automatically decrypt data encrypted by something else than the vault (basically a custom vault) ?
- Is there some support for encryption other than the Ansible vault ?
