Red Hat Ansible for Network Automation
After completing this section, you should be able to run a playbook that uses data or files encrypted with Ansible Vault.
To read data from encrypted files, Ansible needs to know the Vault password.
The --ask-vault-pass option can be used to prompt for interactive input of the password:
[user@host ~]$ansible-playbook --ask-vault-pass site.ymlVault password:redhat
The --vault-password-file and --vault-id options read the Vault password from the Vault password file.
Important
The Vault password file is a plain text file that contains the Vault password as a plain text string stored as a single line. This file is not encrypted, so it is vital that it be protected using file permissions or other security measures.
Use the following command to create a Vault password file for the site.yml playbook.
[user@host ~]$ansible-playbook --vault-password-file=filenamesite.yml
The Vault password must be provided when accessing files encrypted using Vault. You can be prompted, and provide it interactively, or you can automate the process by creating a Vault password file. A Vault password file stores the Vault password in plain text, so it must be protected by appropriate file system permissions.
Here are some rules for protecting a Vault password file:
It should be stored in a directory that is outside of the scope of any version control software projects. This prevents it from accidentally having a copy included in project source code.
The directory where it lives should be owner-only read/write/execute.
The file itself should be owner-only read/write.
