Ansible: Encrypt passwords and keys used in playbooks with Ansible Vault

[ricsanfre]

Enhancement Request

Encrypt all passwords/keys that currently and stored in plain-text within ansible variables.

Use Ansible Vault capability for that.

References

• Ansible Documentation- Encrypting content with Ansible Vault
• Ansible Best practices: Tip for variables and vaults
• Secure group variables with Ansible vault
• How to include variables from ansible vault file

[ricsanfre]

Solution implemented

1. Include all secrets, keys in a specific var yaml file: vautl.yml located in vars directory

  ---
  # Encrypted variables - Ansible Vault
  vault:
    # SAN
    san:
      iscsi:
        node_pass: s1cret0
        password_mutual: 0tr0s1cret0
    # K3s secrets
    k3s:
      k3s_token: s1cret0
    # traefik secrets
    traefik:
      basic_auth_passwd: s1cret0
    # Minio S3 secrets
    minio:
      root_password: supers1cret0
      longhorn_key: supers1cret0
      velero_key: supers1cret0
      restic_key: supers1cret0
    # elastic search
    elasticsearch:
      admin_password: s1cret0
    # Fluentd
    fluentd:
      shared_key: s1cret0
    # Grafana
    grafana:
      admin_password: s1cret0

2. Encrypt the file with Ansible vault

   ansible-vault encrypt vault.yml

   Provide ansible vault password to encrypt the file.

   The file can be decrypted using the following command

   ansible-vault decrypt vault.yml

3. Reference the vault variables in playbooks, group_vars, etc.

   For example in: k3s_cluster group variables.

    # k3s shared token
     k3s_token: "{{ vault.k3s.k3s_token }}"

   All referenced variables that are encrypted by ansible vault belong to vault yaml dictionary, so they can be clearly identified and their values located in vault.yml file.

4. Include task to load vault variables file in each playbook's pre-task section:

   - name: my_playbook
     hosts: my_server
     pre_tasks:
       - name: Include vault variables
         include_vars: "vars/vault.yml"
         tags: ["always"]
     roles:
     ....

5. Execute ansible playbooks with --ask-vault-pass argument, so the password used to encrypt vault file can be provided when starting the playbook.

   ansible-playbook my-playbook.yml --ask-vault-pass