0 / 13 lessons — 0%
Lesson 10 / 13
Ansible Vault — secrets management
A database password sitting in plain text in group_vars/prod.yml, committed to git, is a problem the moment that repo is anything but fully private forever. Ansible Vault encrypts files (or single values) at rest, so they can live in version control safely.
# create a new encrypted file — prompts for a vault password ansible-vault create group_vars/prod/vault.yml # edit it later (decrypts in your editor, re-encrypts on save) ansible-vault edit group_vars/prod/vault.yml # encrypt a file you already wrote in plain text ansible-vault encrypt secrets.yml # peek at an encrypted file without editing it ansible-vault view group_vars/prod/vault.yml
# running a playbook that needs vaulted variables ansible-playbook site.yml --ask-vault-pass # or, non-interactively, from a password file (chmod 600 it, keep it out of git) ansible-playbook site.yml --vault-password-file ~/.vault_pass
A common pattern: keep normal variables in group_vars/prod/vars.yml in plain text, and only the sensitive ones in a separate group_vars/prod/vault.yml — same variable scope, only one file needs decrypting.
The vault password itself is now your single point of failure. Don't email it, don't Slack it, don't commit it. A password manager, a CI secret store, or a dedicated secrets manager (Vault by HashiCorp, AWS Secrets Manager) are all better homes for it than a text file on someone's laptop.
Try it yourselfRun
ansible-vault encrypt_string 'hunter2' --name 'db_password'. It prints a ready-to-paste, encrypted YAML block you can drop straight into a playbook without encrypting the whole file around it.