While
working with automation it is necessary to have a secure system to store
various details like Password, variable, SSH keys etc. Ansible does provide a
facility called vault which helps sys admin to store sensitive data and use the
vault while running playbooks on remote machines. In this article we will how
we can use Ansible vault in securing things. We will be seeing on how
1)
To encrypt data using Vault
2)
Using Ansible valut while running Playbooks
While
using Ansible as a configuration management system or a orchestration engine,
it is necessary to pass certain data like passwords, keys etc to run the
playbooks. These details can be common most times and used multiple times. An
automated system that prompts the operator for passwords all the time is not
very efficient. To maximize the power of
Ansible, secret data has to be written to a file that Ansible can read and
utilize the data from within. Though they are stored on the vault we can have
these hacked.
For
these ansible provides a facility to protect your data at rest. That facility
is Vault, which allows for encrypting text files so that they are
stored "at rest" in encrypted format. Without the key or a
significant amount of computing power, the data is indecipherable.ansible-vault
command is provided by Ansible in securing things
Encrypt Data
1)
Create a Sample file to encrypt
[root@vx111a
vault]# ansible-vault create
sample_passwd.yml
Vault password:
Confirm Vault
password:
We created a file
sample_passwd.yml file which will ask for vault password. If we check the file
type and contents,
[root@vx111a
vault]# file sample_passwd.yml
sample_passwd.yml:
ASCII text
[root@vx111a vault]#
cat sample_passwd.yml
$ANSIBLE_VAULT;1.1;AES256
31643134323761626464336334333461636135656435333161636538326132356166303536353838
3661376665336163613139613836313765633836333838320a626262323565653837363735336163
36396639336239383566306439396262383965623338613664383434663765366639636534393634
6239376138303763610a363165323630326231626334633931323732316564316135643033383730
62666630333233366234633366623331326266633932363166656130373164333335
We
see that the file is a ASCII file with encrypted contents.
2)
Edit the Encrypted file to change the conents of the file
In Oder to edit the encypted file, we need
touse the edit command with the valut.
[root@vx111a
vault]# ansible-vault edit
sample_passwd.yml
Vault password:
When you try to
edit the conents, it will ask for the vault password.
3) Decypt the file
contents
[root@vx111a
vault]# ansible-vault decrypt
sample_passwd.yml
Vault password:
Decryption
successful
Once decrypted we
can see the conents of the file as,
[root@vx111a
vault]# cat sample_passwd.yml
password: vagrant
We can then use the
encrypt command to encypt the contents again as,
[root@vx111a
vault]# ansible-vault encrypt
sample_passwd.yml
Vault password:
Confirm Vault
password:
Encryption
successful
Ansible does also
provide the rekey facility to change the valut password using
[root@vx111a
vault]# ansible-vault rekey
sample_passwd.yml
Vault password:
New Vault password:
Confirm New Vault
password:
Rekey successful
Using
vault with Playbooks
Until now we have
seen how we can use the Ansible vault in encrypting data. Its no use when the
data is encrypted and not being used.
Now we will see how we pass the encrypted data to the Ansible playbooks
while running on remote machine.
1) Create a sample
yml file with 2 variables as
[root@vx111a
vault]# cat main.yml
version: 8.0.32
http_port: 8084
Now encrypt the
file using the Ansible-vault,
[root@vx111a
vault]# ansible-vault decrypt main.yml
Vault password:
Decryption
successful
Check the
encryption
[root@vx111a
vault]# cat main.yml
$ANSIBLE_VAULT;1.1;AES256
34333132653430616138313235366435613232653662653865663264346632616664666665356437
6133633063396434326538373531326231623536373465360a326334303832366530373535356334
32376162336164643561343462643063326366653039303433666439633064383364633064303939
3139663363366336610a336566353664613536643933633166356536336634363734626664363261
34373865613831646339333866613564373937326262643432353866316339306263346430643434
3030633864663837613934663166616630623966653533383733
Now
once the file is encrypted write a playbook as,
[root@vx111a
vault]# cat sample-playbook.yml
---
- hosts: cent
vars_files:
- main.yml
tasks:
- name: run echo Command
local_action: shell echo {{ http_port }}
register: local_process
- debug: msg="{{ local_process.stdout }}"
---
- hosts: cent
vars_files:
- main.yml
tasks:
- name: run echo Command
local_action: shell echo {{ http_port }}
register: local_process
- debug: msg="{{ local_process.stdout }}"
Now we have written
a playbook which includes the main.yml file (which is encrypted using
Ansible-vault) containing the variables. When we run the playbook as
[root@vx111a
vault]# ansible-playbook sample-playbook.yml
ERROR: A vault
password must be specified to decrypt /work/vault/main.yml
It clearly says
that we need to pass the vault password in running the playbook. The correct
way to run that playbook is
[root@vx111a
vault]# ansible-playbook
sample-playbook.yml --ask-vault-pass
Vault password:
PLAY [cent]
*******************************************************************
GATHERING FACTS
***************************************************************
ok: [172.16.202.96]
TASK: [run echo
Command] ******************************************************
changed:
[172.16.202.96 -> 127.0.0.1]
TASK: [debug
msg="{{ local_process.stdout }}"] ********************************
ok: [172.16.202.96]
=> {
"msg": "8084"
}
PLAY RECAP
********************************************************************
172.16.202.96 : ok=3 changed=1
unreachable=0 failed=0
We can see that
Ansible asks for the vault password in order to run the playbook. Once the
password is provided, it run the playbook and also the Portt 8084 is replaced
with values from main.yml file.
This is how we can
use the Ansible valut with playbooks.
Password
File
Though we provide
the vault password every time while running the playbooks, there are some times
with cases where we need to run the playbook with out any manual intervention.
Ansible does provide an option to create a password file with the vault
password and pass the file to Ansible command line as argument.
1) use the same
above mail.yml file and encrypt that
[root@vx111a vault]#
ansible-vault encrypt main.yml
Vault password:
Confirm Vault
password:
Encryption
successful
Now create a
password file with password as “redhat”. Save in the home location and provide
it with correct permissions.
[root@vx111a
vault]# echo "redhat" >> ~/.vault_password
[root@vx111a
vault]# chmod -R 600 ~/.vault_password
Now run the
playbook by passing the password file as argument as,
[root@vx111a
vault]# ansible-playbook
sample-playbook.yml --vault-password-file ~/.vault_password
PLAY [cent]
*******************************************************************
GATHERING FACTS
***************************************************************
ok: [172.16.202.96]
TASK: [run echo
Command] ******************************************************
changed:
[172.16.202.96 -> 127.0.0.1]
TASK: [debug
msg="{{ local_process.stdout }}"] ********************************
ok: [172.16.202.96]
=> {
"msg": "8084"
}
PLAY RECAP
********************************************************************
172.16.202.96 : ok=3 changed=1
unreachable=0 failed=0
This is how we can
use the Ansible vault and secure data.
