A password in a project can be read by anyone who has a copy of the project. A secret is encrypted with ansible-vault, and Ansible decrypts it by itself — during the run.
ansible-vault encrypt file encrypts a YAML file with the vault password: what is left of the content is the $ANSIBLE_VAULT;1.1;AES256 line and lines of digits and the letters a–f. To read such a file — ansible-vault view file, to edit it — ansible-vault edit file. A run decrypts encrypted variables if it knows the vault password: the --ask-vault-pass option asks for it in the terminal, and the vault_password_file = ~/.vault_pass line in the [defaults] section of ansible.cfg takes it from a file. ansible-vault itself takes the password from vault_password_file too (in the Wiki).
The project's ansible.cfg has the line vault_password_file = ~/.vault_pass, and the colleague who took the project has no such file. What will ansible-playbook shop.yml answer for them?
-
The
--ask-vault-passoption asks for the password in the terminal. Without it Ansible takes the file fromvault_password_file, and there is no file. -
Tasks never get the encrypted value: without the vault password the run cannot read the variables and stops with an error.
-
Ansible has no way to skip tasks because of a vault: it needs the password file before the first task, and without it the run does not start.
Ansible reads the vault password before the first task. With no file from vault_password_file the run stops at once with an error and leaves the machine alone; it works with a password file or with --ask-vault-pass.
A secret is kept in a file of its own, so the group's other variables stay readable as before. Instead of the group_vars/web.yml file you make a group_vars/web/ directory — Ansible reads every file in it:
Once there is a group_vars/web/ directory, Ansible does not read the group_vars/web.yml file next to it, and its variables are gone without a warning.
The vault password file lives outside the project, with mode 600, and colleagues get it separately: whoever gets the project together with this file can read the secrets as well.
Hide the database password in a vault
The database password db_password sits in ~/ansible-lab/group_vars/web.yml in plain text. Encrypt it with ansible-vault so that no plain-text password is left in the project. Put the vault password into the ~/.vault_pass file that only you can read — runs have to find it by themselves, without prompting. The playbooks still put the database password on the machine.
Goals · 0 of 2
- Encrypt the database password so that runs still get it not done yet
- Keep the vault password in a file for yourself only not done yet