This document indicates that since Ansible 2.3 it should be possible to encrypt certain vars using a
!vault | prefix instead of putting a variable and keys in a vault file and encrypt it completely.
notsecret: myvalue mysecret: !vault | $ANSIBLE_VAULT;1.1;AES256 66386439653236336462626566653063336164663966303231363934653561363964363833313662 6431626536303530376336343832656537303632313433360a626438346336353331386135323734 62656361653630373231613662633962316233633936396165386439616533353965373339616234 3430613539666330390a313736323265656432366236633330313963326365653937323833366536 34623731376664623134383463316265643436343438623266623965636363326136 other_plain_text: othervalue
At the moment the structure is as follows:
When an encrypted variable is moved from the vault to the vars directory and
ansible-vault decrypt ansible/group_vars/testing/vars is run it returns:
ERROR! input is not vault encrypted data for ansible/group_vars/testing/vars
This vaulted variable be decrypted with the supplied vault secret and used as a normal variable. The ansible-vault command line supports stdin and stdout for encrypting data on the fly, which can be used from your favorite editor to create these vaulted variables; you just have to be sure to add the !vault tag so both Ansible and YAML are aware of the need to decrypt. The | is also required, as vault encryption results in a multi-line string.
- Should variables that need to be encrypted, be encrypted one by one using the command line?
- What are best practices to restructure the old Ansible structure? E.g. remove the vault files and put all encrypted vars in the vars file?