{"id":3966,"date":"2023-11-11T16:15:55","date_gmt":"2023-11-11T16:15:55","guid":{"rendered":"https:\/\/geekmungus.co.uk\/?p=3966"},"modified":"2023-11-11T16:15:56","modified_gmt":"2023-11-11T16:15:56","slug":"using-ansible-vault-to-encrypt-a-string","status":"publish","type":"post","link":"https:\/\/geekmungus.co.uk\/?p=3966","title":{"rendered":"Using Ansible Vault to Encrypt a String"},"content":{"rendered":"\n
There are a number of ways to protect secrets you wish to use in your Playbooks. I’ll show a simple example here of how you can encrypt a string, copy it into your Playbook for use and then run the Playbook, where the string is de-crypted in-line and used without exposing it in plain text within any of the Ansible YAML files. If you are using version control to store your Ansible Playbooks (you are right? \ud83d\ude00 ), then you’ll not want to be storing the plain text passwords direct into the YAML.<\/p>\n\n\n\n
Create the Encrypted String<\/h2>\n\n\n\n
First we need to create an encrypted string, in this example we’re using Ansible Vault for this, we’ll run the following command which will take the string we wish to be encrypted for later use in our Playbook.<\/p>\n\n\n\n
You’ll be prompted for the vault password, you’ll need to enter this to encrypt the string, and you’ll also need to provide it when you run the Playbook, or the string will not be able to be de-crypted and used. When run you’ll see an output something like this:<\/p>\n\n\n\n<\/figure>\n\n\n\n
Add to the Playbook<\/h2>\n\n\n\n
Within your Playbook you then need to include the encrypted text (ciphertext) in say a variable, where you can then call upon the variable within a task to use it for something. Here is a very simple example playbook that consists of three files, you add the encrypted text into a variable called “secretstring” in the vault-play.yml file. Note the name of the server is because i’m using it to build a Kubernetes cluster, so just using it for this example.<\/p>\n\n\n\n
Okay, great we’re ready to run the Playbook.<\/p>\n\n\n\n
Run the Playbook<\/h2>\n\n\n\n
Now, you can’t just run the Playbook as you normally would otherwise when Ansible reaches the encrypted string it will barf because it is unable to decrypt the string. So to get round this all we need to do is supply the vault password when we run the Playbook as follows:<\/p>\n\n\n\n
And there you go, as you can see Ansible first asks you for your vault password then runs the Playbook and decrypts the string in-line, okay this isn’t very helpful, we’re just printing the secret to the string, but think of what else you could do, such as feeding this secret into a command to perform some privileged operation such as become\/sudo etc.<\/p>\n\n\n\n
Although simple, it is powerful. As mentioned there are other methods to protect secrets in your Playbooks, a downside of this method is that the Vault password is a shared password, i.e. anyone who needs to run the Playbook needs to know it, but if you are a small team or its just you, it can be an excellent way to protect your secrets without too much hassle.<\/p>\n","protected":false},"excerpt":{"rendered":"
![\"\"](\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2023\/11\/image.png\")
<\/figure>\n\n\n\n