Red Hat Ansible for Network Automation
After completing this section, you should be able to run playbooks that reference multiple resources encrypted with different Ansible Vault passwords.
Plays cannot access data stored in Vault-encrypted files unless the Vault password is provided.
If the password is not provided, this message is displayed: ERROR: A vault password must be specified to decrypt secret.yml.
There are two ways to provide the Vault password:
Use the
--ask-vault-passoption to prompt for the password interactively.Use the
--vault-password-fileor--vault-idoption or theANSIBLE_VAULT_PASSWORD_FILEenvironment variable to refer to a Vault password file.Important
The Vault password file is a plain text file that contains the Vault password as a plain text string stored as a single line. This file is not encrypted, so it is vital that it be protected using file permissions or other security measures.
Prior to Ansible 2.4, all files protected by Ansible Vault used by a playbook had to be encrypted using the same password.
Ansible 2.4 and later support multiple Vault passwords because the ansible-playbook command now allows --vault-id to appear multiple times.
If multiple Vault passwords are provided, Ansible attempts to decrypt Vault content by trying each Vault secret in the order they were provided on the command line.
If the Vault content was encrypted using a
--vault-idoption, then the label of the Vault ID is stored with the Vault content. When Ansible knows the right Vault ID, it tries the matching Vault ID's secret first before trying the rest of the Vault IDs.
Incorporating Vault-protected files into Ansible projects.
Wherever you have a variables file (in group_vars or host_vars, for instance) you could consider replacing that with a vars file that contains no sensitive information.
You can use an encrypted file named vault that holds the sensitive data.
A convenient way of organizing this is to introduce new directories under group_vars and host_vars that represent individual groups or individual hosts, respectively.
Put vars files and, where appropriate, vault files, inside those directories.
. ├── ansible.cfg ├── group_vars │ ├── all │ ├── group1 │ │ ├── vars │ │ └── vault │ └── group2 │ └── vars ├── host_vars │ └── host1 │ ├── vars │ └── vault ├── inventory └── playbook.yml
By default, Ansible uses functions from the python-crypto package to encrypt and decrypt Ansible Vault files. If there are many encrypted files, decrypting them at startup may cause a perceptible delay.
To speed things up, install the python-cryptography package:
[user@host ~]$sudo yum install python-cryptography
Note
Note that python-crypto and python-cryptography are two different packages. The former is installed by default, and is required. The latter is optional.
