Here is an interesting tip for all who what to protect the sensitive information with ansible. Our example is simple enough – we want to protect our private key and we want to decrypt it when installing on the server. The copy ansible module has a decrypt feature and it can decrypt the file on-the-fly when the task is executed.
Here is how to use ansible vault to encrypt the file with the private key and the ansible playbook file to copy the file.
If you are a newbie in ansible you can check this article – First ansible use – install and execute a single command or multiple tasks in a playbook There you can see how to create your inventory file (and configure sudo if you remotely log in with unprivileged user) used herein the example.
STEP 1) Encrypt the file with ansible vault
myuser@srv ~ $ ansible-vault encrypt server.key New Vault password: Confirm New Vault password: Encryption successful
You can see the file now is changed and starts with:
myuser@srv ~ $ cat server.key $ANSIBLE_VAULT;1.1;AES256 62363263663865646361643461663531373637386631646262366333663831643435633263363336 3735326665326363356566303566626638316662376432640a326362326230353966353431383164 35353531653331306430656562616165353632643330393662313535326438363964303436306639 .... ....
STEP 2) Ansible playbook file to use copy and decrypt option
---
- hosts: all
tasks:
- name: Copy server private key
copy:
src: server.key
dest: /etc/env/server.key
decrypt: yes
owner: root
group: root
mode: 400
backup: no
STEP 3) Execute the ansible playbook
myuser@srv ~ $ ansible-playbook --ask-vault-pass -l srv3 -i ./inventory.ini ./playbook-example.yml -b Vault password: PLAY [all] ***************************************************************************************************************************************************************** TASK [Gathering Facts] ***************************************************************************************************************************************************** ok: [srv3] TASK [Copy server private key] ********************************************************************************************************************************************* changed: [srv3] PLAY RECAP ***************************************************************************************************************************************************************** srv3 : ok=2 changed=1 unreachable=0 failed=0
And the file in the remote server (srv3 in the example) is unencrypted in /etc/env/server.key!