ansible/ansible — pull request #3393 by jpmens (2013-07-01 09:32:33+00:00)
Title: Vault (ie. encryption) functionality

As hinted-to and dicsussed on the mailing-list, I'm adding a "vault" (thanks to @vincentvdk for the name :) functionality to Ansible, in order to allow having encrypted vars in vars files, playbooks, etc.

These encrypted vars can be decrypted in templates. This is what it looks like in a playbook:

```yaml
---
- hosts: 127.0.0.1
gather_facts: false
connection: local
vars:
- mypasswd: "AHchx1Va5fPc51B3HrbMTvO/MGfCIK3cT273PgIeoZdEAY6lg+GEmejsl4tGfCNKxMFP7tM7Y7kl"
tasks:
- action: template src=vault.in dest=/tmp/vault.out
```

The encrypted and base64-encoded variable can be used with the `vault` filter in a template:

```jinja2
My secret password: {{ mypasswd | vault }}
with explicit key: {{ mypasswd | vault('ckey') }}
```

To get this output:

```
My secret password: totallysecret
with explicit key: totallysecret
```

The first example above uses a default keyname (configured in `ansible.cfg`, whereas the
second used a specific key name. (You can have as many keys as you want.)

### Getting started

Ansible vault requires Keyzcar on the management host (`pip install python-keyczar`), which is also used by fireball mode, so you may have this requirement already.

1. Create the keystore directory. This should be *outside* of your playbook repository, obviously, but you can share it with team members who need access to the keys.

mkdir /etc/ansible/keystore

2. Choose a key name, say, `ckey`, and make its directory

mkdir /etc/ansible/keystore/ckey

3. Create an initial key set for the `ckey` key name: (`keyczart` is a utility provided by Keyczar)

keyczart create --location=/etc/ansible/keystore/ckey --purpose=crypt

4. Generate a symmetric key and store it at that location

keyczart addkey --location=/etc/ansible/keystore/ckey --size=256

5. Configure Ansible (`ansible.cfg`) to use the keystore and (optionally) the new key as default:

```ini
[vault]
keystore = /etc/ansible/keystore
key = ckey
```

### Creating encrypted vars

Now we can use that key to encrypt variables and use them in vars files, playbooks, etc.

Verify that `ansible-vault` will use your keystore and key names. It will print the defaults
it is using when you give it `-h`.

ansible-vault -h

Create a var, say, `"mypasswd"` which will be encrypted. (Note the use of `-` as filename):

```bash
echo totallysecret | ansible-vault -V mypasswd -
mypasswd: "AHchx1Va5fPc51B3HrbMTvO/MGfCIK3cT273PgIeoZdEAY6lg+GEmejsl4tGfCNKxMFP7tM7Y7kl"
```

Copy the line `mypasswd.*$` to your vars and use in a template as shown above.