Ansible: using secrets for user password

 I guess we all have a bootstrap which creates the ansible user and give it password less sudo rights. There are ways around that, but that is not what this is about.

I create my use with:

- name: create andible user user: name: ansible state: present password: "{{ my_secret_password | string | password_hash('sha512') }}" update_password: on_create shell: /bin/bash groups: sudo append: yes  

notice the 'ansible_user_password', that is variable set somewhere else:

 

vars: ansible_user_password: !vault | $ANSIBLE_VAULT;1.1;AES256 ..... 353064646365326663373339393239363735  

 

But where does the encrypted value come from, using 'ansible-vault' one can create encrypted values, which either are kept in password vault files, or just in your playbook (like above): 

$ ansible-vault encrypt_string

Give it a password (this is the vault password which you need to unlock it when you run your playbook!!

New Vault password:
Confirm New Vault password:

Reading plaintext input from stdin. (ctrl-d to end input, twice if your content does not already have a newline)

Type in the text you want to encrypte, like the password for your ansible user, and finish with CTRL+d, and you'll get:

Encryption successful
!vault |
          $ANSIBLE_VAULT;1.1;AES256
          31326437316636616....

$ ansible-vault encrypt_string New Vault password: Confirm New Vault password: Reading plaintext input from stdin. (ctrl-d to end input, twice if your content does not already have a newline) this is a test Encryption successful !vault | $ANSIBLE_VAULT;1.1;AES256 31326437316636616432653738376531636436653463346363366661656334646532313036346563 6131636231646365383865336139306266323732343264350a363362663337303434653161393161 32623661393736666462646461356334626439623262656136383265393238316264373364666531 3732336534633165390a613839373737346439363866623436303366393237613833303034336438 6537 

Now in your playbook add:

vars: my_secret_password: !vault | $ANSIBLE_VAULT;1.1;AES256 313264373166366164326....  

 

And as shown above, you use with:

password: "{{ ansible_user_password | string | password_hash('sha512') }}"

Now when you run your playbook you need to give it the vault password, which you do with '--ask-vault-pass'

$ ansible-playbook my-playbook.yml -l localhost --ask-vault-pass

btw. notice the 'string' in the above, it will not work without it.

That's it.