Notes ansible-vault

Voir aussi :

SOPS

Ansible-vault pour crypto chiffrement

Définir la clef

Adding the vault password file option to the Ansible configuration

cat /dev/urandom | tr -dc A-Za-z0-9 | head -c32 > ~/.ansible/.vault_pass chmod 600 ~/.ansible/.vault_pass

~/.ansible.cfg

[defaults] vault_password_file = $HOME/.ansible/.vault_pass

Changer le secret

mv ~/.ansible/.vault_pass ~/.ansible/.vault_pass.old cat /dev/urandom | tr -dc A-Za-z0-9 | head -c32 > ~/.ansible/.vault_pass chmod 600 ~/.ansible/.vault_pass* ansible-vault rekey --vault-password-file=~/.ansible/.vault_pass.old --new-vault-password-file=~/.ansible/.vault_pass $(find . -type f -name "*.mdp.yml") # shred -u ~/.ansible/.vault_pass

Exemples

ansible-vault encrypt_string 'P@ssw0rd' --name 'mysql_pass_root'
mysql_pass_root: !vault | $ANSIBLE_VAULT;1.1;AES256 31313332623736393962306239386565356536663533343665653565336265373265373166326565 6166646561303163376336363834636633373538346632310a356166393237333865623863336133 64343962336462356336303239663633316364393137633263366334376533303766393262653561 6638303531626238630a613161663932376333633539656334336465383238623330393832666136 6666

Pb

secret must be unicode or bytes, not ansible.parsing.yaml.objects.AnsibleVaultEncryptedUnicode

Dans notre exemple mysecret est une chaine chiffrée par ansible-vault

fatal: [remote]: FAILED! => {"msg": "Unexpected templating type error occurred on ({{ mysecret | password_hash('sha512') }}): secret must be unicode or bytes, not ansible.parsing.yaml.objects.AnsibleVaultEncryptedUnicode"}

Solution

Source : https://gist.github.com/douglasmiranda/f21a4481d372ae54fcf4a6ff32249949

- name: "Create main user" user: name: "myuser" password: "{{ '%s' | format(mysecret) | password_hash('sha512') }}" # ...