Ansible Vault Secrets Documentation
Tags: ansible, redhat, devops, opensource
Published: 2024-04-19 17:48:17


This post outlines the necessary secrets required for Ansible playbooks. It includes details on how to use the [ansiblesafe](https://github.com/tosin2013/ansiblesafe) tool to manage these secrets securely.

## Red Hat Subscription Manager (RHSM) Variables

These variables are used to register the Ansible Automation Platform instance with Red Hat Subscription Manager and attach the necessary subscriptions.

- `rhsm_username`: The username for your Red Hat account. ([More info](https://access.redhat.com/solutions/253273))
- `rhsm_password`: The password for your Red Hat account. ([More info](https://access.redhat.com/solutions/253273))
- `rhsm_org`: The ID of the organization to register the system to. ([More info](https://access.redhat.com/articles/1378093))
- `rhsm_activationkey`: The activation key used to register the system. ([More info](https://access.redhat.com/articles/1378093))

## Admin User Variables

- `admin_user_password`: The password for the admin user in Virtual Machines using kcli-pipelines. ([More info](https://github.com/tosin2013/kcli-pipelines))

## Offline Token Variables

- `offline_token`: The offline token used for Red Hat Subscription Manager. ([More info](https://access.redhat.com/solutions/3868301))
- `automation_hub_offline_token`: The offline token used for Automation Hub. ([More info](https://console.redhat.com/ansible/automation-hub/token/))

## OpenShift Pull Secret

- `openshift_pull_secret`: The pull secret used to deploy OpenShift Clusters. ([More info](https://cloud.redhat.com/openshift/install/pull-secret))

## FreeIPA Server Admin Password

- `freeipa_server_admin_password`: The password for the FreeIPA server admin user using the freeipa-workshop-deployer. ([More info](https://github.com/tosin2013/freeipa-workshop-deployer))

## Managing Secrets with Ansiblesafe

`ansiblesafe` is a Go script that facilitates the encryption and decryption of YAML files using the Ansible Vault CLI. It supports various operations such as encrypting, decrypting, and syncing secrets with HashiCorp Vault.

### Installation
```
dnf install ansible-core -y 
curl -OL https://github.com/tosin2013/ansiblesafe/releases/download/v0.0.8/ansiblesafe-v0.0.8-linux-amd64.tar.gz
tar -zxvf ansiblesafe-v0.0.8-linux-amd64.tar.gz
chmod +x ansiblesafe-linux-amd64 
sudo mv ansiblesafe-linux-amd64 /usr/local/bin/ansiblesafe
```

### Usage

**If you do not pass any flags everything wil be auto generated for you**
```
$ ansiblesafe -h
Usage of /tmp/go-build1657505477/b001/exe/ansiblesafe:
  -f, --file string     Path to YAML file (default: $HOME/vault.yml)
  -o, --operation int   Operation to perform (1: encrypt, 2: decrypt, 3: Write secrets to HashiCorp Vault, 4: Read secrets from HashiCorp Vault, 5: skip encrypting/decrypting)
```


To use `ansiblesafe`, navigate to the cloned directory and perform the following commands based on your needs:

- **Encrypt a YAML file:**
  ```bash
  ./ansiblesafe -f path_to_your_file -o 1
  ```

- **Decrypt a YAML file:**
  ```bash
  ./ansiblesafe -f path_to_your_file -o 2
  ```


## Hasicorp Examples 
**Write secrets to HashiCorp Vault**
```
$ export VAULT_ADDRESS=http://127.0.0.1:8200/
$ export VAULT_TOKEN=token
$ export SECRET_PATH=ansiblesafe/example
$ ansiblesafe -o 3
```

**Read secrets from HashiCorp Vault and safe to vault.yaml**
```
$ export VAULT_ADDRESS=http://127.0.0.1:8200/
$ export VAULT_TOKEN=token
$ export SECRET_PATH=ansiblesafe/example
$ ansiblesafe -o 4
$ ansiblesafe -o 1 # Optional encrypt the file
```
## Security Considerations

**Instructions to use ansiblesale without a password prompt**
```
$ touch ~/.vault_password
$ chmod 600 ~/.vault_password
# The leading space here is necessary to keep the command out of the command history
$  echo password >> ~/.vault_password
# Link the password file into the current working directory
$ ln ~/.vault_password .
# Set the environment variable to the location of the file
$ export ANSIBLE_VAULT_PASSWORD_FILE=.vault_password
```

Remember to keep your vault password and tokens secure and limit access to authorized users only.

## More Information

For more details on `ansiblesafe` and its capabilities, visit the [GitHub repository](https://github.com/tosin2013/ansiblesafe.git).