Managing sensitive data with Ansible vault
- 1. Managing sensitive data with Ansible vault
- 2. Introduction About me and our company
- 3. About Me
- 5. What we offer • Linux & AIX consulting with DevOps experience • Infrastructure Automation • official Ansible Partner • consulting & training for Ansible, Python & git
- 7. What is Ansible vault Vault is a feature of ansible that allows keeping sensitive data such as passwords or keys in encrypted files, rather than as plaintext in your playbooks or roles.
- 8. Tech Specs • Binary included in the Ansible core package • AES-256 algorithm encrypted • Decrypted on runtime • Limitation: one Vault password per Ansible playbook
- 9. getting started ansible-vault <option> create Create new encrypted file encrypt Encrypt existing file edit Edit encrypted file rekey Change encryption password view View encrypted file
- 10. How to use it 1. Create ansible-vault variable file 2. Use it in your Ansible Project 3. Run ansible / ansible-playbook with • --ask-vault-pass Option • or define a password file • define in ansible.cfg vault_password_file path • --vault-password-file Option • as variable ANSIBLE_VAULT_PASSWORD_FILE
- 11. What can be encrypted • encrypt YAML files ‣ e.g. group_vars ‣ e.g. host_vars • since Ansible v2.3 single encrypted variables • use the !vault tag
- 12. What should be encrypted • sensitive data for automated deployments ‣ SSL private keys ‣ SSH private keys ‣ secrets / credentials
- 13. Tips & Tricks make your life easier
- 14. Define your variables • layer of indirection • prefix your variables vault_<variablename> • save variables into vault files or directories implicit group_vars/dev/vault.yml group_vars/prod/vault.yml explicit vault_vars/dev.yml vault_vars/prod.yml vs
- 15. Best Practices • set ”no_log: true” per task • use different passwords per environments • only encrypt sensitive data • use a strong encryption password • always use a private git repo / restrict access
- 16. Are we safe now? • technically could be still compromised • what pushed to git, stays on git • secure your password file • owner & file permissions • outside the git repo / .gitignore
- 17. Demo
- 18. managing SSL private keys use case
- 19. managing database credentials use case
- 20. single encrypted variable short demo
- 21. confirm IT solutions Rathausstrasse 14 6340 Baar The End Thank you for listening pstauffer8 confirm.ch blog.confirm.chpstauffer https://www.xing.com/profile/Pascal_Stauffer https://www.linkedin.com/in/pascal-stauffer-5030775b
- 22. Source • http://docs.ansible.com/ansible/ playbooks_best_practices.html#variables-and-vaults • https://blog.confirm.ch/deploying-ssl-private-keys-with-ansible • http://docs.ansible.com/ansible/playbooks_vault.html • http://docs.ansible.com/ansible/playbooks_vault.html#single- encrypted-variable