Managing secrets using Ansible Vault

Ansible Vault is very flexible, as we can encrypt, view, decrypt, or change the Vault password (as in, rekey it) at any time as needed. The Vault password must be stored safely, as you will not be able to retrieve the encrypted Vault content without the Vault password.

Creating Vault files

In the following exercise, we will learn how to create an encrypted file using Ansible Vault:

1. To create a Vault file from scratch, use the ansible-vault create command, as shown in Figure 13.6:

Figure 13.6 – Creating a Vault file

2. After we enter the Vault password, a new file will open in the default text editor, such as vim or nano (we can change the default editor by updating the $EDITOR environment variable). Enter the variables and values as needed, just as with a normal variable file:

   cloud_username: myusername 
   cloud_password: mysecretpassword

Refer to Figure 13.7 for further details:

...