// learn · linux · rhce · 8 min

Ansible Vault.

Playbooks belong in git — passwords don't. Ansible Vault encrypts secrets with AES256 so the ciphertext is safe to commit, then decrypts them in memory the moment a play runs. Watch a secrets file flip between plaintext and an encrypted blob, and learn to run with the vault password.

Ansible Vault animated tutorial. Encrypting and editing secrets files with ansible-vault create, encrypt, edit, view, decrypt, and rekey, running playbooks with the vault password via --ask-vault-pass, --vault-password-file, and --vault-id, encrypt_string for a single inline secret, the $ANSIBLE_VAULT;1.1;AES256 header, group_vars/all/vault.yml convention, and password file hygiene with chmod 600. RHCE EX294 ready.
// ansible · vault & secrets

Passwords and tokens can't live in plaintext YAML if your playbooks are in git. Watch a secrets file flip between readable plaintext and an AES256 vault blob, then get decrypted in memory the moment a play runs.

// before you start
you should know
  • ·Comfortable writing and running Ansible playbooks
  • ·Know what a vars file / group_vars looks like
  • ·Basic git + file permissions (chmod 600)
by the end you'll

Encrypt and edit vault files, run playbooks that supply the vault password, encrypt a single value with encrypt_string, and lay out vaults with vault-id and good password hygiene.

pace: 8 minutes

ansible — step 1 / 5 · the idea
view:● plaintext↔○ encrypted
📄 secrets.yml⚠️ plaintext
⚠️ secrets in the clear — do NOT commit this
---
db_password: hunter2
api_token: abc123

Why Vault — secrets don't belong in plaintext

Playbooks live in git, but passwords, tokens, and keys must not sit there in the clear. Ansible Vault encrypts files (or single values) with a password, using AES256, so the ciphertext is safe to commit. The file stays valid YAML — only the readable secret is replaced by an opaque vault blob. Encrypt a brand-new file with `create`, or wrap an existing one with `encrypt`.

$ansible-vault create secrets.yml
$ansible-vault encrypt existing.yml
$head -1 secrets.yml
// key insight

Vault lets you commit secrets to git safely — the file stays valid YAML, but the sensitive value is an AES256 blob until a password unlocks it at runtime. Encrypt a whole file with `create`/`encrypt`, or just one value with `encrypt_string`; either way Ansible decrypts transparently when you supply the password.

// exam-ready · ansible-vault & running with secrets
$ansible-vault create FILE
$ansible-vault encrypt FILE
$ansible-vault decrypt FILE
$ansible-vault view FILE
$ansible-vault edit FILE
$ansible-vault rekey FILE
$ansible-vault encrypt_string 'val' --name 'k'
$ansible-playbook --ask-vault-pass
$--vault-password-file FILE
$--vault-id label@source
$vars_files: [secrets.yml]
$group_vars/all/vault.yml
$$ANSIBLE_VAULT;1.1;AES256
$chmod 600 ~/.vault_pass
// check yourself
4 quick questions
Q1

What does Ansible Vault protect, and how?

Q2

You need to run a playbook whose vars_files includes a vaulted file. What must you provide?

Q3

You want ONE encrypted value inside an otherwise-readable vars file. Which command?

Q4

What's the difference between `ansible-vault view` and `ansible-vault decrypt`?

These aren't graded — they're just for active recall, which is what actually makes the lesson stick.

🚑
// next: when things fail

Ansible error handling

Plays don't always go to plan. Learn block / rescue / always and failed_when to catch failures, run cleanup, and decide for yourself what "failed" even means.

open →

Read this lesson as text5 chapters · quiz answers

  1. 01Why Vault — secrets don't belong in plaintext

    Playbooks live in git, but passwords, tokens, and keys must not sit there in the clear. Ansible Vault encrypts files (or single values) with a password, using AES256, so the ciphertext is safe to commit. The file stays valid YAML — only the readable secret is replaced by an opaque vault blob. Encrypt a brand-new file with create, or wrap an existing one with encrypt.

    • $ ansible-vault create secrets.yml — new encrypted file in $EDITOR
    • $ ansible-vault encrypt existing.yml — encrypt a file you already have
    • $ head -1 secrets.yml — file stays valid YAML; value is the blob

  2. 02Create, edit, view, decrypt

    create makes a new encrypted file; edit opens it in $EDITOR decrypted, then re-encrypts on save. view prints the plaintext without editing, and decrypt/encrypt convert the file permanently. rekey changes the vault password without exposing the contents. The whole lifecycle never leaves a plaintext copy on disk unless you ask for one.

    • $ ansible-vault edit secrets.yml — decrypt → edit → re-encrypt on save
    • $ ansible-vault view secrets.yml — print plaintext, leave file encrypted
    • $ ansible-vault rekey secrets.yml — change the vault password

  3. 03Run a playbook that uses vaulted vars

    Ansible needs the password at runtime. Supply it with --ask-vault-pass (interactive prompt), --vault-password-file FILE (a file or executable script that prints the password), or a labelled --vault-id. Reference the encrypted file the same way as any other vars — vars_files: or group_vars. Ansible decrypts it in memory as the play runs and the secret resolves to its plaintext value.

    • $ ansible-playbook site.yml --ask-vault-pass — prompt for the password
    • $ ansible-playbook site.yml --vault-password-file ~/.vault_pass — read it from a file
    • $ vars_files:\n - secrets.yml — reference the vaulted file

  4. 04encrypt_string — one secret inline

    You don't have to encrypt a whole file — ansible-vault encrypt_string produces an encrypted scalar you paste into an otherwise-plaintext vars file. That's handy for mixing one secret into readable vars without hiding the rest. The output is a !vault tagged block under your key name. Ansible decrypts it transparently at run, exactly like a fully encrypted file.

    • $ ansible-vault encrypt_string 's3cret' --name 'db_password' — make an encrypted scalar
    • $ db_password: !vault |\n $ANSIBLE_VAULT;1.1;AES256 — paste under vars:
    • $ ansible-playbook site.yml --ask-vault-pass — decrypts automatically at run

  5. 05Best practice — vault-id & password hygiene

    Use --vault-id label@source to manage multiple vaults — e.g. dev vs prod — each with its own password. Keep the password file mode 600 and OUT of git so the ciphertext is the only thing committed. The conventional layout pairs a vaulted file beside a readable one: group_vars/all/vault.yml holds the secrets, group_vars/all/vars.yml holds everything else.

    • $ ansible-playbook site.yml --vault-id prod@prompt — labelled vault for prod
    • $ chmod 600 ~/.vault_pass — lock down the password file
    • $ group_vars/all/vault.yml — convention: vaulted vars beside vars.yml

Quiz — answers

What does Ansible Vault protect, and how?
→It encrypts sensitive data at rest with AES256 so files can be committed safely; it's decrypted only at runtime when you supply the password.Vault encrypts the data at rest (AES256). The ciphertext is safe to commit; Ansible only decrypts it in memory at runtime when the correct password is provided. Base64 is encoding, not encryption — Vault is real cryptography.
You need to run a playbook whose vars_files includes a vaulted file. What must you provide?
→The vault password — via --ask-vault-pass, --vault-password-file, or --vault-id.Ansible can't decrypt the file without the vault password. Supply it interactively (--ask-vault-pass), from a file or script (--vault-password-file), or with a labelled --vault-id. Without it the play fails to decrypt.
You want ONE encrypted value inside an otherwise-readable vars file. Which command?
→ansible-vault encrypt_stringencrypt_string produces a single encrypted scalar (a !vault block) you paste under one key, leaving the rest of the vars file readable. encrypt/create would hide the whole file.
What's the difference between ansible-vault view and ansible-vault decrypt?
→view prints the plaintext but leaves the file encrypted on disk; decrypt permanently rewrites the file back to plaintext.view is read-only: it shows the plaintext but the file on disk stays encrypted. decrypt is destructive in the sense that it writes the file back as plaintext — you'd then need to encrypt it again before committing.
// more in systems

keep going — these pair well with what you just learned.

see all systems →
🛰️

Ansible control node & inventory

Ansible is agentless — one control node pushes work to a fleet over SSH. Install ansible-core, write an inventory with groups, ping the fleet, and fire ad-hoc commands. RHCE-ready.

10 min · interactiveopen →
📜

Ansible playbooks & YAML

Plays, tasks, and idempotency. Watch a playbook run task-by-task — ok, changed, skipped — then run it again and watch everything go green with 0 changed. RHCE-ready.

12 min · interactiveopen →
🧩

Ansible core modules

file, user, copy, dnf, service — the modules that do the real work. Declare the desired state and let Ansible converge to it, idempotently. RHCE-ready.

10 min · interactiveopen →

See also

back to RHCSA / RHCE trackall lessons