2

I'm trying to develop a Playbook which must handle sensitive user data (SSH keys, Registry credentials, etc.).

Only a user and the Ansible controller can see the data associated with that same user.

The data will be stored in a Git repository, accessible to all users.

Thus it must be encrypted.

I'm having an issue to securely encrypt the data using Ansible vault.

The problem is that I cannot give the Ansible vault secret to the user, as the secret can decrypt the ciphertext.

The perfect solution would be to use asymmetric encryption, which I didn't find anyway to do.

The only solution can I see at the moment is this:

  1. User encrypt its data using a public key
  2. User sends ciphertext to Ansible controller
  3. Ansible controller decrypts the ciphertext using a private key
  4. Ansible controller encrypts the cleartext using ansible vault (symmetric cipher this time)
  5. Ansible controller commits the ciphertext to the git repository

But it'll be painful to setup this process. It would be much simpler if the user could commit the ciphertext encrypted with the public key.

  • Is it possible to setup Ansible vault to use asymmetric encryption ?
  • Is it possible to setup the playbook to automatically decrypt data encrypted by something else than the vault (basically a custom vault) ?
  • Is there some support for encryption other than the Ansible vault ?

2 Answers 2

1

Is it possible to setup Ansible vault to use asymmetric encryption?

To setup or configure unfortunately not. It might be possible to enhance the functionality of vault.py and implement such.

Regarding

Is it possible to setup the playbook to automatically decrypt data encrypted by something else than the vault (basically a custom vault)? Is there some support for encryption other than the Ansible vault?

and since you are like to

... handle sensitive user data (SSH keys, Registry credentials, etc.).

you might take advantage from external Vaults in IdM and Chapter 76-79, "storing and retrieving secrets".

1

Another solution, which would allow you to accomplish the same goals, would be to encrypt your facts files with Mozilla SOPS.

SOPS does a good job of just encrypting parts of the files that you want to have encrypted and you can have multiple people/bots added to the key ring so a build server can decrypt or other people with the key can have it. You can check the secrets into git and it's relatively safe.

You can find more information here https://docs.ansible.com/ansible/latest/collections/community/sops/docsite/guide.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.