Encrypted Passwords with Ansible Playbooks

In a perfect world you should be using shared ssh keys in order to authenticate to your target host, without a password.  Also in that perfect world that user should be able to sudo to root without requiring a password.  Ah yes perfection ….

For the rest of us here is how to securely store your credentials using Ansibles nifty builtin encrypted vault.  You’ll need to type a password to decrypt the vault every time you run the playbook but that’s better than typing 2 passwords on the command line or having them sitting on your hard drive in a plain text file.

1. Make the directory that the ansible playbook will automatically import
   Note: You don’t feed the playbook an encrypted file.  Instead you just encrypt a file that the playbook would normally source I.E. host_vars/group_vars etc..

   user@workstation:~# mkidr host_vars
   user@workstation:~# cd host_vars
   

2. Create the encrypted file for the host

   user@workstation:~/host_vars# ansible-encrypt create <hostname>
   Vault password: <My Vault Password>
   Confirm Vault password: <My Vault Password>
   

3. Enter the secret information into the vault editor

   ---
   ansible_ssh_user: <ssh user>
   ansible_ssh_pass: <ssh password>
   ansible_sudo_pass: <sudo password>
   

4. Create a playbook that uses the vault
   *The “hosts: ” line should refer to the host in the inventory file whose name matches the hostname of the encrypted file you created*
5. Execute the playbook with a prompt for the vault password

   user@workstation:~/host_vars# ansible-playbook -i <your inventory file> --ask-vault-pass <your playbook>.yml