HostSEO Blog

Stories and News from IT Industry, Reviews & Tips | Technology Blog

Ansible Vault

Ansible Vault can encrypt anything inside of a YAML file, using a password of your choice which secures your sensible data such as passwords or keys. Ansible vault is mainly used for encrypting variable files and it can encrypt any YAML file.

Most common files to encrypt are:

  • A role’s defaults/main.yml file
  • A role’s vars/main.yml file
  • Files within the group_vars directory
  • Any other file used to store variables.

Creating Encrypted Files.

To create a new encrypted data file using ansible,

[root@ansible vault]# ansible-vault create sample.yml
New Vault password: 
Confirm New Vault password: 
[root@ansible vault]#

The ansible-vault command will ask you for a new password twice.

Encrypted files look like below code,

[root@ansible vault]# cat sample.yml
[root@ansible vault]#

Encrypting an Existing File.

Using ansible-vault, we can ecrypt an existing file.

[root@ansible vault]# ansible-vault encrypt test.yml
New Vault password: 
Confirm New Vault password: 
Encryption successful
[root@ansible vault]#

Editing an encrypted file.

Once you have encrypted a file then the only way to edit the same file is by using code,

[root@ansible vault]# ansible-vault edit test.yml 
Vault password: 
[root@ansible vault]# 

Decrypting a File

You can decrypt an encrypted file for getting back the plain text format as well:

[root@ansible vault]# ansible-vault decrypt test.yml 
Vault password: 
Decryption successful
[root@ansible vault]# 

Encrypting Variables specifically.

Opening an encrypted file will change the encrypted hash. Since you dont have to encrypt a whole file.openticket

[root@ansible vault]# ansible-vault encrypt_string 'sample plaintext string' --name 'new_string'
New Vault password: 
Confirm New Vault password: 
new_string: !vault |
Encryption successful
[root@ansible vault]#

You can paste the output or append into an existing YAML file for use this string

Running Ansible with Encrypted Variables.

At the time when your playbooks reference encrypted variables, then you may need to specify to Ansible the password.

[root@ansible vault]# ansible-playbook --ask-vault-pass -i inventory_file test.yml 
Vault password: 

–ask-vault-pass will instruct Ansible to ask vault password .

Also you can do store vault password on file and instruct to Ansible via code

[root@ansible vault]# cat > vault_password
Save and exit
Then run the below command,
[root@ansible vault]# ansible-vault --vault-password-file=vault_password test.yml

Subscribe Now

10,000 successful online businessmen like to have our content directly delivered to their inbox. Subscribe to our newsletter!

Archive Calendar


Born in 2004 ... Trusted By Clients n' Experts

SEO Stars

They never made me feel silly for asking questions. Help me understand how to attract more people and improve my search engine ranking.

Read More

Emily Schneller Manager at Sabre Inc
SEO Stars

Took advantage of Hostseo's superb tech support and I must say, it is a very perfect one. It is very fast, servers reliability is incredible.

Read More

Leena Mäkinen Creative producer
SEO Stars

We're operating a worldwide network of servers with high quality standards requirements, we’ve choose hostseo to be our perfect partner.

Read More

Ziff Davis CEO at Mashable
SEO Stars

It’s very comfortable to know I can rely about all technical issues on Hostseo and mostly that my website and emails are safe and secured here.

Read More

Isaac H. Entrepreneur
SEO Stars

With hostseo as a hosting partner we are more flexible and save money due to the better packages with great pricing, free SEO n' free SSL too!

Read More

Madeline E. Internet Professional