Questions tagged [ansible-vault]

For questions about Ansible Vault - an Ansible feature that allows keeping sensitive data in encrypted files rather than in plain text in various configuration files.

Filter by
Sorted by
Tagged with
3 votes
2 answers
2k views

How to store/retrieve multiple ansible-vault passwords within/from a single file

Update: As @yaobin pointed out. It appears they removed the part about the multiple passwords being in a single file. It was here as can be seen from web archive: https://web.archive.org/web/...
user avatar
  • 131
4 votes
2 answers
1k views

Including vault-encrypted variables in a task

I just recently started to use Ansible, and am trying to deploy a configuration file that contains a secret key and email (for credentials to use with an API). I encrypted them with ansible-vault ...
user avatar
1 vote
1 answer
204 views

ansible-pull ignore group_vars vault

How do I ignore the group_vars vault file when running ansible-pull? My repository (among other stuff) does machine init, joining the domain and software updates. I would like the software part to be ...
user avatar
1 vote
0 answers
89 views

Per machine credentials for privileges escalation using AWX [duplicate]

I have an inventory with a lot of hosts in it using the same credentials, but one host needs a different approach. For the ssh connection a different user is used, after the connection is established, ...
user avatar
2 votes
1 answer
104 views

Preventing accidental production deployments

Last night I ran a playbook from a wrong branch that referenced an old inventory file with old IPs for each server, and deployed a dev build to a production machine. What would be a a good practice to ...
user avatar
  • 123
13 votes
2 answers
3k views

How do I run Ansible Azure playbooks while avoiding storing credentials in files?

Background We use Ansible to provision and manage Azure infrastructure. At the moment we run Ansible "manually" i.e. we manually execute playbooks for various automated tasks. No CI infrastructure. ...
user avatar
  • 601
32 votes
5 answers
20k views

Where to put ansible-vault password

We are planning to use ansible vault in our project to prevent leaking passwords or keys in git. The idea is to put all our sensitive data into a plain file then encrypt this file with ansible-vault ...
user avatar
  • 1,689
8 votes
2 answers
2k views

What are best practices of structuring encrypting variables since Ansible 2.3.0?

This document indicates that since Ansible 2.3 it should be possible to encrypt certain vars using a !vault | prefix instead of putting a variable and keys in a vault file and encrypt it completely. ...
user avatar
  • 12.6k
10 votes
3 answers
9k views

Why could the encrypted Ansible files not be decrypted although the vault password file has been set?

Follow-up to this Q&A. According to this and this documentation it should be possible to define a default vault password file by specifying vault_password_file = ~/.vault_pass.txt in one of the ...
user avatar
  • 12.6k
14 votes
3 answers
7k views

What are best practices for using Ansible Vault on public CI's and Source Control Repositories like BitBucket?

Introduction On a private CI's and Source Control Repositories like Gitlab-ce it is possible to copy an ~/.vault_pass.txt to the server and let it use by the CI to decrypt files using Ansible. ...
user avatar
  • 12.6k
21 votes
1 answer
877 views

Git clean/smudge filters for ansible vault secrets

I am trying to setup clean/smudge filter in git to have automatic encrypting and decrypting of files containing secrets thru ansible-vault command. Peculiarity of the ansible-vault command is that it ...
user avatar