Managing secrets using Ansible Vault
Ansible Vault is very flexible, as we can encrypt, view, decrypt, or change the Vault password (as in, rekey it) at any time as needed. The Vault password must be stored safely, as you will not be able to retrieve the encrypted Vault content without the Vault password.
Creating Vault files
In the following exercise, we will learn how to create an encrypted file using Ansible Vault:
- To create a Vault file from scratch, use the
ansible-vault createcommand, as shown in Figure 13.6:
Figure 13.6 – Creating a Vault file
- After we enter the Vault password, a new file will open in the default text editor, such as
vimornano(we can change the default editor by updating the$EDITORenvironment variable). Enter the variables and values as needed, just as with a normal variable file:cloud_username: myusername cloud_password: mysecretpassword
Refer to Figure 13.7 for further details:
...