14

The idea is to put all our sensitive data [...] The meaning of "all" in this sentence should be analyzed very carefully before implementing the solution that you plan. Ansible vault is a very useful tool, but it should be used only to store secrets that are: Specifically needed for the ansible deployments Easily made useless to owners that should become ...


8

--vault-password-file can instead point to an executable script that writes to stdout. This little-known feature should solve your problem. First, write a simple, executable script that prints a system environment variable, and check that into your source control. Then, use Bitbucket's encrypted variable feature to set that environment variable to your ...


8

The problem here is caused by the random salt in ansible-vault encryption. You can hack VaultEditor class to pass the salt to it from an argument in ansible-vault. The random salt is generated in lib/ansible/parsing/vault/__init__.py on this line. It is called from lib/ansible/cli/vault.py where you can easily add the argument for fixed salt. If you do ...


8

Vault password First of all, you should get familiar with the fact that vault password file can be executable script. In this case Ansible executes it and expects to receive password as its output. For example you can use gpg-agent or keychain to store your actual password and unlock it when required. Read more in this blog post: https://benincosa.com/?p=...


7

We are planning to use ansible vault in our project to prevent leaking passwords or keys in git. Since you haven't yet implemented anything, you might reconsider this. Using a system like Ansible vault has a number of security downsides: there is no audit trail of who has accessed it when an employee leaves, it is easy for them to take the secret store ...


4

This quite much goes to what internal policies you have on handling sensitive data. I'd like to tell you my approach to this and explain what I see as pros and cons. I keep the Ansible Vault password in a file on the control machine and have a environment variable pointing to it: export ANSIBLE_VAULT_PASSWORD_FILE=/deep/dark/place I have that on my ...


2

Having been working with ansible vault quite a bit recently (specifically regarding what the encrypt and how to encrypt those things without making the code unreadable) I've found very little incentive to change my habits in 2.3. If I'm going to have a series of encrypted variables, or files, keep them separate (I prefix them all with vault_) and just leave ...


2

Please read https://docs.ansible.com/ansible/2.4/vault.html Since Ansible 2.4 one could use --vault-id @prompt. Encrypt a file using ansible-vault: ansible-vault encrypt /path/to/encrypted/file Run the playbook and it will result in: fatal: [localhost]: FAILED! => {"msg": "A vault password or secret must be specified to decrypt /path/to/encrypted/file"...


1

Eventually I just got rid of the group_vars all together. I specified a new role that includes several other roles with 'include_role:' and added the vars directly to those roles with inline-vault variables: - name: include ipaclient include_role: name: ipaclient vars: my_user: user my_password: !vault | $ANSIBLE_VAULT;1.1;AES256 ...


1

The best practice is to separate production and staging(testing) inventory. See Staging vs Production. This way you pick with -i what you are targeting. To make it more robust you might want to clone a separate structure for production and restrict access to it. Pull from staging before deploying to production. In detail, this would mean to 1) put the ...


1

I have decided to remove the ansible/group_vars/testing directory and replace it with a file, i.e. ansible/group_vars/testing that contains the encrypted vars: mysecret: !vault | $ANSIBLE_VAULT;1.1;AES256 66386439653236336462626566653063336164663966303231363934653561363964363833313662 ...


1

I found an issue with Ansible/Python causing a failure to decrypt. Specifically, Ansible 2.7.10 and 2.7.13 under Python 3.6.8 on Ubuntu 18.04 would not decrypt (using ansible-vault edit -vvvvv) a vault file that was identical to file that decrypted OK on macOS 10.13 using Python 3.7.2 with same Ansible versions. Upgrading to Python 3.7.3 on Ubuntu (using ...


1

It is unclear why it failed, but setting vault_password_file = ~/.vault_pass.txt in /etc/ansible/ansible.cfg was sufficient.


1

Using ansible-playbook site.yml --vault-password-file ./mypass.sh resulted in: ERROR! Problem running vault password script / p a t h / t o / e c h o _ v a u l t _ p a s s . s h ([Errno 8] Exec format error). If this is not a script, remove the executable bit from the file. Based on this post the following was defined in bitbucket-pipelines: image: ...


Only top voted, non community-wiki answers of a minimum length are eligible