Managing secrets with Ansible Vault
This recipe aims to provide guidance on leveraging Ansible Vault for secrets management.
There are multiple ways to store secrets in Ansible. When starting out, you may be inclined to encrypt the entire hosts file. This works and keeps everything secure in the context of using a version control system without compromising your secrets/passwords; however, it is not manageable, nor does it provide any useful information in version control systems because all you’re left with is a long nonsensical string of encrypted characters.
Getting started
You will need the following for this recipe:
- Oracle Linux
- Ansible
Refer to the Technical requirements section at the beginning of this chapter if you need help installing Ansible.
How to do it…
First, let’s take a look at whole-file encryption. To begin, we’ll first need to define our Ansible host file in plain text.
Whole-file encryption
Typically...