9cc63326b1
* Fix refs for local_facts and various cli :option: * Fix dev_guide/testing_pep8 refs * remove ref to non-existing 'developing_test_pr' * Fix ref to ansible-vault encrypt_string * Removed hard-to-localize colloquialism. * Rename '_ansible-pull' in playbooks_intro. It was conflicting with rst/ansible-pull.rst. Nothing seems to reference it. * Add explicit targets for and update refs Replace some ':doc:' use with ':ref:'. Replace some :ref: to section names with explicit targets (:doc:`Dynamic vs. Static` -> :ref:`dynamic_vs_static` etc) * The 'YAML+Jinja' syntax lex fails here, so just use yaml Since the yaml+jinja highlight fails, code wasnt highlighted at all, but 'yaml' works more or less. * just use no lexer for the < python2.6 examples py3 will fail highlighting them, and 'python2' throws a lexer warning, and nothing actually highlights it, so just disable.
4.1 KiB
Using Vault in playbooks
Topics
New in Ansible 1.5, "Vault" is a feature of ansible that allows keeping sensitive data such as passwords or keys in encrypted files, rather than as plaintext in your playbooks or roles. These vault files can then be distributed or placed in source control.
To enable this feature, a command line tool, ansible-vault is used to edit files, and a command line flag --ask-vault-pass or --vault-password-file is used. Alternately, you may specify the location of a password file or command Ansible to always prompt for the password in your ansible.cfg file. These options require no command line flag usage.
For best practices advice, refer to best_practices_for_variables_and_vaults.
Running a Playbook With Vault
To run a playbook that contains vault-encrypted data files, you must pass one of two flags. To specify the vault-password interactively:
ansible-playbook site.yml --ask-vault-passThis prompt will then be used to decrypt (in memory only) any vault encrypted files that are accessed. Currently this requires that all files be encrypted with the same password.
Alternatively, passwords can be specified with a file or a script, the script version will require Ansible 1.7 or later. When using this flag, ensure permissions on the file are such that no one else can access your key and do not add your key to source control:
ansible-playbook site.yml --vault-password-file ~/.vault_pass.txt
ansible-playbook site.yml --vault-password-file ~/.vault_pass.pyThe password should be a string stored as a single line in the file.
Note
You can also set ANSIBLE_VAULT_PASSWORD_FILE environment variable,
e.g. ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt and
Ansible will automatically search for the password in that file.
If you are using a script instead of a flat file, ensure that it is marked as executable, and that the password is printed to standard output. If your script needs to prompt for data, prompts can be sent to standard error.
This is something you may wish to do if using Ansible from a continuous integration system like Jenkins.
(The --vault-password-file option can
also be used with the ansible-pull command if you wish, though this would
require distributing the keys to your nodes, so understand the
implications -- vault is more intended for push mode).
Single Encrypted Variable
As of version 2.3, Ansible can now use a vaulted variable that lives in an otherwise 'clear text' YAML file:
notsecret: myvalue
mysecret: !vault |
$ANSIBLE_VAULT;1.1;AES256
66386439653236336462626566653063336164663966303231363934653561363964363833313662
6431626536303530376336343832656537303632313433360a626438346336353331386135323734
62656361653630373231613662633962316233633936396165386439616533353965373339616234
3430613539666330390a313736323265656432366236633330313963326365653937323833366536
34623731376664623134383463316265643436343438623266623965636363326136
other_plain_text: othervalueTo create a vaulted variable, use the ansible-vault encrypt_string <ansible_vault_encrypt_string>
command. See encrypt_string for details.
This vaulted variable will be decrypted with the supplied vault
secret and used as a normal variable. The ansible-vault
command line supports stdin and stdout for encrypting data on the fly,
which can be used from your favorite editor to create these vaulted
variables; you just have to be sure to add the !vault tag
so both Ansible and YAML are aware of the need to decrypt. The
| is also required, as vault encryption results in a
multi-line string.
Using encrypt_string
This command will output a string in the above format ready to be included in a YAML file. The string to encrypt can be provided via stdin, command line args, or via an interactive prompt.
See encrypt_string_for_use_in_yaml.