Okay friends, let's briefly switch gears and talk about a very important topic,
and this is all
about managing secrets. What exactly is a secret? Well, the name kind of tells
you, is any information
that you do not want to just be freely shared. So this could be some type of
password information,
perhaps it is just some type of sensitive configurations. Whatever it may be,
you want to keep this
information shielded away from prying eyes. So in this particular video here,
what we're going to
be discussing is Ansible Solution for Secret Management, and this is known as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
be discussing is Ansible Solution for Secret Management, and this is known as
Ansible Vault.
The name of the tool is pretty instructive. It's going to provide you a little
vault in which you
can protect that data. So really what we're talking about here is encrypting
our data. So let's have
a look at Ansible Vault and see how it actually operates. Okay, so let's go
into the group
var directory, and we'll go into all dot yaml. So right now here, we happen to
have a DNS server.
Let's maybe say it's not exactly the most sensitive information, but let's
imagine we did have
some type of secret info right here. So we can maybe say something like say sn WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
some type of secret info right here. So we can maybe say something like say sn
mp contacts,
and let's say the name was John McGovern, and the email was john@example.com.
The phone number was
1234, 1234, 1234, a very, very memorable phone number. Now the example here is
a little bit
frivolous, but honestly, the data itself doesn't actually matter. Just
conceptualize this as
something that we're treating with a little bit of sensitivity. If say for
example, we published
this information to some type of version control system such as gets, well WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this information to some type of version control system such as gets, well
potentially, depending
on the actual configurations, this information could become public. So instead
we would like this
particular file to be at an encrypted state, when it is stored on the disk, and
when we actually
need to access the data itself, it's actually going to be decrypted in memory,
and then it can be
passed into the playbook upon execution. So let's actually see how Ansible
Vault can help us out
here. Now one thing to note, in this case here, this particular file already
exists. As in, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
exists. As in,
the information here is already written to disk, it is not a brand new file. So
the command we
actually want to specify here in this case here is Ansible Vault with the
option incorrect. So check
this out then. What I will see here, if I just cat the file, we can see the
content, if I now say
Ansible Vault, and then encrypts, and then specify the file that I want to
actually encrypt, which
in this case here is all dot yml. Notice it's going to prompt me to enter a
vault password.
This is going to be a password that is going to protect this particular file. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is going to be a password that is going to protect this particular file.
So let's just say
in this case here, the password is john. So john, oh, hn, and I'm going to have
to confirm it,
jio hn, and enter. Now the encryption is successful. If I now cat the file,
check this out right here,
we just get this garbled gibberish, because the actual file itself has been
encrypted using
advanced encryption standard 256. So you're thinking, well, okay, that looks
pretty good.
If anyone happened to read this particular file, they would just see this gib
berish. They couldn't
actually see the sensitive information such as the contact details here. But WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
actually see the sensitive information such as the contact details here. But
how do we actually
access this with respect to our playbooks? Say for example, I wanted to print
out this information
within the playbook itself, or maybe just call the DNS server, that type of
thing. What we are
going to do is to decrypt this in memory and pass it into the playbook on the
fly. So let's
actually see how this is going to work. So what I will do is I will create a
little file just called
encrypt example dot yml going to insert mode, have our free hyphens, give it a
name, just say testing
some vault stuff, or specify the host is going to be all. And the tasks here, I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
some vault stuff, or specify the host is going to be all. And the tasks here, I
'll just give it a
name saying pulling var from encrypted file. Now all I'm going to do here is to
print out the
contents of the variable just so I can prove that I can access them. So I will
use a debug
module with the message parameter. And I'll just say the snmp contact email is
have my double color
braces, and the variable will be snmp underscore contact dot email. So let's
just save this playbook.
So if I say Ansible playbook, and just call the playbook here, and do not WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if I say Ansible playbook, and just call the playbook here, and do not
provide any additional
information what's going to happen, let's hit enter. So it says here attempting
to decrypt,
but no vault secrets found, basically Ansible is detecting that we have a vault
protected file
that we're trying to call. And we haven't provided the password. So what I'm
going to do this time
is use the same command, but this time add on dash dash, ask dash vault dash
pass when I hit enter,
before the playbook executes, I'm going to type in the vault password for that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
before the playbook executes, I'm going to type in the vault password for that
particular file,
which was jiohn. If I hit enter, and look at this right here, this time we have
successfully
accessed the variables from a thin and encrypted file. And the cool thing is if
I go into my group
vars, and I actually cut the all dot yaml file, the file itself on disk has not
changed. It's
still stored any fully encrypted states. So let's maybe say I'm just managing
my system. I want
to have a quick glance at what my variables happen to be. And I don't want to
actually decrypt the
actual data on disk. What I can do is I can peek in to the file in its un WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
actual data on disk. What I can do is I can peek in to the file in its un
encrypted format,
by decrypting it in RAM, I E and memory, and viewing it that way. So the way we
can actually do this
is by saying Ansible vault, and we can just specify the keyword view and until
Ansible to fail that
we want to view if I hit enter, I'm going to have to provide the correct
password. If I try to type
in the wrong password, such as maybe say, David, clearly the file is not going
to decrypt. But
if I try again and type in john, we actually just get to peek inside the file. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if I try again and type in john, we actually just get to peek inside the file.
But it's actual state
as it's written on disk did not actually change. Now suppose I wanted to make
an edit to my variable
files, let's maybe say the snmb contact happened to change. Once again, what I
want to do is to
leave the file in an encrypted state on disk, make the modifications in RAM,
and then immediately
commit those changes back to disk, you know, as opposed to fully decrypting the
file on disk,
just opening up an irregular text editor, making the changes, and then re
encrypting it. That
really isn't best practice because it leaves a little bit of a window where the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
really isn't best practice because it leaves a little bit of a window where the
file is left on
disk in a decrypted state. So the way I can do this is I can say Ansible vault,
and I can specify
the keyboard edits, and then specify the file that I want to edit. If I hit
enter, once again,
passing the password of Jioh n, answer, now we're taking into a temporary file
that shows us the
actual contents here. And if I want to make modifications, it could change us
to let's say James Conrad,
and change the name to James, and let's maybe change the phone number a little
bit, whatever.
So if I just press colon wq to write and quit, if I answer, what has actually WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if I just press colon wq to write and quit, if I answer, what has actually
happened here is the
output of the password hash has actually changed. And we can eyeball this just
by looking at the
last two digits of three six if we just scroll on up a little bit, it used to
be three two.
That's because the content itself has actually changed. Therefore, we have
produced a completely
different hash value. So once again, if I go back to my playbook, and I run it
once again,
type in the password Jioh n, hit enter, look at this right here, the debug
module is now printing
out that the snmp contact email is James@example.com, showing us that the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
out that the snmp contact email is James@example.com, showing us that the
variables have indeed been
modified. Now, like I say, when I happen to encrypt my all dot yaml file that
was already existing,
let's maybe say I wanted to create a brand new file entirely. The advantage
here of when you do
this, it means that the file was always written to the disk in an encrypted
state and never
in its decrypted form, and only ever will be accessed in its decrypted state in
RAM. So no actual
permanent record of the unencrypted file on the computer itself. So let's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
permanent record of the unencrypted file on the computer itself. So let's
create a new file here,
and we'll just say answerable vault. And as opposed to saying encrypt, like we
would do with an already
existing file, in this case here, we just want to use the keyword create to
create a brand new file.
And now what I'm going to do is I'm going to specify the file that I'm going to
create. So
let's just say nugget dot yml. If I hit enter, what it's doing is asking me to
type in a vault
password, and this can be completely different. So let's say the password here
is pizza. I'm going
to confirm it as pizza. Now it drops us into a temporary VIM session. So if I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to confirm it as pizza. Now it drops us into a temporary VIM session. So if I
just go into insert
mode, so I'll just say the password is medium red donut. I don't actually know
what I got this
from button of the list. Let's just do right and quit. Once I do this, if we
happen to cat the file,
it's already in its encrypted form. Now, crucially, if I try to say, for
example,
view the actual file, I can say answerable vault view. And then I can say nug
get. Notice if I
try to type in the password, jioh n, and I enter the decryption field, just
because we use one
password for one file, doesn't mean it applies globally. In the case here, when WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
password for one file, doesn't mean it applies globally. In the case here, when
I try to decrypt
this file as I do again, I actually have to type in the password pizza. So when
I do so,
we actually see printed the standard out the content of that particular file.
Now suppose we
actually wanted to decrypt the file so that it actually is decrypted on the
disk itself,
meaning that as the corruption could be permanent. The keyword we would simply
use would be decrypt
so I can say answerable vault decrypt. And I'll go into the grip-verse
directory and target the
all dot yaml file. If I enter, what I'm going to have to do is to provide the
correct password WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
correct password
for the encryption, which in this case here is jioh n. If I enter, the dec
ryption has been successful
if I now go into the grip-verse directory and cat the all dot yaml file. Notice
the file here
is fully in plaintext. Now, like I say, if we want to, perhaps maybe change a
password,
maybe we don't like the john password. What we don't want to do is do what we
just did here,
decrypt the file and then seek to re-encrypt it just specifying a new password.
That will actually
work. But like I say, we have this temporary window right now whereby this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
work. But like I say, we have this temporary window right now whereby this
particular file here is
just lying on my disk in an unencrypted state. Instead, the way we should
actually handle this
is to use the answerable vault re key option. This is going to allow us to
switch keys without
having the fail be unencrypted on the hard disk. So let's just use answerable
vault. And right now,
I will encrypt the file. So let's just use the vault password of Bob, BOB, and
I will confirm it.
And for whatever reason, we just said, you know what Bob is too short a name,
we want to change
the password. What we'll say is answerable vault re key and then specify the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the password. What we'll say is answerable vault re key and then specify the
file I want to target
if I enter, I'm going to have to type in the vault password, which is bob. And
then specify the
new password that I want to set. So let's maybe say it's some owner, so a
little bit of a longer
password. Just confirm it. Now we can see the re key has been successful. So if
I say answerable
vault, and I tried to view the contents of all dot yaml, if I type in bob, the
old password,
notice the encryption happens to fail. Whereas if I view it, and I type in the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
password,
some more this time, now we can actually see the contents and similarly we can
permanently
to keep the fail by using the decrypt option. Once again, passing in the value,
some more
now, hitting answer and now we can see here that if we cut the fail, the fail
is no back on
desk and it's fully on encrypted state.