Vault and Secrets
Part of the Ansible course
Everything you have written so far has been safe to show anybody. Inventories, templates, role defaults: none of it would hurt you if a stranger read it. Then you reach the task that creates the database user, and it needs a password. You type it into group_vars/db.
Ansible's answer is Vault, a small encryption tool built into the ansible-vault command. It lets a file live in your repository as unreadable ciphertext, and lets Ansible decrypt it in memory at the moment a playbook runs. The file is safe to commit. The passphrase is the one thing you keep out of the repository, and it is one secret instead of fifty. ...
Want to learn Ansible Vault and Secrets in a real environment?
Click below, get a fresh Linux box with Ansible ready to go, and work through Vault and Secrets hands-on with an AI tutor that knows your code.
Start this lessonVault and SecretsWhat you'll learn
- Ansible-vault encrypt
- Ansible-vault edit
- Vault password file
- Encrypted variables
- Vault id labels
Read this lesson in your language
All lessons in this course
12 lessons- 1What Is Ansible20 min
- 2Inventory and Ad Hoc Commands25 min
- 3Your First Playbook30 min
- 4Tasks, Modules, and Handlers30 min
- 5Variables and Facts30 min
- 6Templates with Jinja230 min
- 7Loops and Conditionals30 min
- 8Roles and Galaxy35 min
- 9Vault and Secrets25 min
- 10Tags and Debugging25 min
- 11Collections and Plugins25 min
- 12Capstone: Multi Host Deploy60 min
Explore other courses
