6

I have an inventory file with one host:

10.1.32.123 ansible_ssh_user=vagrant ansible_ssh_pass=vagrant

My yaml file:

- hosts: all
  sudo: yes
  gather_facts: yes
  serial: 20

  roles:

It's not the yaml file I wish to password protect but my inventory file, since it contains user credentials. It's although not possible, as when I run the playbook, the content in the inventory file doesn't decrypt. It does if I have the yaml file encrypted.

ansible-playbook inventory site.yml --ask-vault-pass
  1. Is there a way to add the credentials: ansible_ssh_user=vagrant ansible_ssh_pass=vagrant to the yaml file and just keep the IP in the inventory file.

DOCS:

VAULT

  • Did you create your inventory file with ansible-vault? Like ansible-vault create foo.yml? What error do you see when you say 'file doesnt decrypt' ? – Zasz Mar 15 '15 at 5:31
  • It's not the foo.yml file I wish to encrypt, but the inventory file, that keeps the IP's and credentials of the VM's. foo.yml is possible to password protect. The error I get is decryption errors. For Ansible the inventory is still encrypted when running it, with stated password. – nicoX Mar 16 '15 at 14:15
5

I don't think you can encrypt the hosts file. A much better approach would be to have any sensitive information like credentials stored in a secondary vars file that's encrypted with ansible-vault and then just include that file in your playbook:

- hosts: all
  sudo: yes
  gather_facts: yes
  vars_files:
    - /path/to/encrypted/vars.yml

Your inventory file contains a host:

10.1.1.2

Your vars/vars.yml will store your credentials:

ansible_ssh_user: vagrant
ansible_ssh_password: vagrant

To use more than one host you can add groups in the inventory file. The hosts that are in the specific group are sharing the same credentials:

[group1]
10.1.1.2
10.1.1.3

[group2]
10.1.1.4
10.1.1.5

Your playbook will now have two hosts sections:

- hosts: group1
  vars_files:
    - vars/group1.yml

- hosts: group2
  vars_files:
    - vars/group2.yml

The group1.yml and group2.yml files must share the same password.

|improve this answer|||||
  • Should vars.yml have the IP and credentials of the hosts? What info would the (hosts) inventory file contain now? And what would my inventory file contain? I got: vars.yml must be stored as a dictionary/hash when I ran ansible-playbook -i hosts playbook.yml --ask-vault-pass – nicoX Mar 18 '15 at 9:54
  • 1
    You can put as much or as little in the inventory file & the vars file(s) as you determine is necessary. Personally I think it's better to keep host-related things like IP addresses, etc. in the inventory file, non-sensitive variables in one vars file and sensitive variables in a second encrypted vars file. With a little searching you can find lots of examples, like this one. – Bruce P Mar 18 '15 at 13:23
  • I extended your answer with description on how to set it up. – nicoX Mar 19 '15 at 9:48
  • ansible_ssh_password was not working for me, had to replace it with ansible_ssh_pass. – Daniel t. Apr 20 '15 at 22:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.