45 Ansible Vault - Umfassende Anleitung

# Datei verschlüsseln
ansible-vault encrypt group_vars/production/vault.yml
New Vault password: 
Confirm New Vault password: 
Encryption successful

# Mehrere Dateien gleichzeitig
ansible-vault encrypt host_vars/*/secrets.yml group_vars/*/vault.yml

# Permanent entschlüsseln
ansible-vault decrypt group_vars/production/vault.yml
Vault password: 
Decryption successful

# Mit spezifischer Vault-ID
ansible-vault decrypt --vault-id production@prompt group_vars/production/vault.yml

# Verschlüsselten Inhalt anzeigen
ansible-vault view group_vars/production/vault.yml
Vault password: 

# Mit Passwort-Datei
ansible-vault view --vault-password-file ~/.vault_pass group_vars/production/vault.yml

# Editor für verschlüsselte Datei
ansible-vault edit group_vars/production/vault.yml
Vault password: 

# Mit externem Editor
EDITOR=vim ansible-vault edit --vault-id production@prompt group_vars/production/vault.yml

# Vault-Passwort ändern
ansible-vault rekey group_vars/production/vault.yml
Vault password: 
New Vault password: 
Confirm New Vault password: 
Rekey successful

# Bulk-Rekey für mehrere Dateien
ansible-vault rekey --vault-id old@prompt --new-vault-id new@prompt group_vars/*/vault.yml

# Variable verschlüsseln
ansible-vault encrypt_string 'mysecretpassword' --name 'vault_database_password'
vault_database_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          66386439653237336464643061663135366461343536393934326135323634363761363134346362
          3832623030626364333934663061626431303665333234300a323030643231373562636439643536
          ...

# Direkt in Playbook verwenden
ansible-vault encrypt_string --vault-id production@prompt 'secret_value' --name 'vault_api_key'

# group_vars/production/vault.yml (vor Verschlüsselung)
---
vault_database_password: "prod_db_secret_2023!"
vault_api_key: "sk-1234567890abcdef"
vault_ssl_private_key: |
  -----BEGIN PRIVATE KEY-----
  MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7VJTUt9Us8cKB
  wjlCYfzuNqzA8LKzRx4dOJ5USn3EjLcQk5BFxjmCJ6WvJyLJ5DpJqT8kLGnJFZ
  ...
  -----END PRIVATE KEY-----
vault_backup_encryption_key: "backup_key_2023_secure"

ansible-vault encrypt group_vars/production/vault.yml
New Vault password: SecureVaultPassword2023!
Confirm New Vault password: SecureVaultPassword2023!
Encryption successful

---
- name: Production deployment with encrypted variables
  hosts: production_servers
  vars_files:
    - group_vars/production/vars.yml
    - group_vars/production/vault.yml
  tasks:
    - name: Configure database connection
      postgresql_user:
        name: webapp
        password: "{{ vault_database_password }}"
        encrypted: yes
        state: present

    - name: Deploy SSL certificate
      copy:
        content: "{{ vault_ssl_private_key }}"
        dest: /etc/ssl/private/server.key
        mode: '0600'
        owner: root
        group: root
      notify: restart nginx

# roles/database/vars/main.yml
---
db_host: "{{ vault_db_host }}"
db_user: "{{ vault_db_user }}"
db_password: "{{ vault_db_password }}"

# roles/database/tasks/main.yml
---
- name: Include encrypted variables
  include_vars: "{{ inventory_dir }}/group_vars/{{ group_names[0] }}/vault.yml"

- name: Configure database access
  template:
    src: database.conf.j2
    dest: /etc/app/database.conf
    mode: '0640'

# Playbook mit Vault-Passwort-Abfrage
ansible-playbook -i inventories/production site.yml --ask-vault-pass

# Mit spezifischem Limit
ansible-playbook -i inventories/production site.yml --limit database_servers --ask-vault-pass

# Passwort-Datei erstellen (sichere Berechtigung!)
echo "SecureVaultPassword2023!" > ~/.vault_pass
chmod 600 ~/.vault_pass

# Playbook mit Passwort-Datei
ansible-playbook -i inventories/production site.yml --vault-password-file ~/.vault_pass

# Über Umgebungsvariable
export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass
ansible-playbook -i inventories/production site.yml

# ansible.cfg
[defaults]
vault_password_file = ~/.vault_pass
host_key_checking = False
stdout_callback = yaml

[inventory]
enable_plugins = auto

# .gitlab-ci.yml
variables:
  ANSIBLE_VAULT_PASSWORD_FILE: /tmp/vault_pass

stages:
  - validate
  - deploy

before_script:
  - echo "$VAULT_PASSWORD" > /tmp/vault_pass
  - chmod 600 /tmp/vault_pass

validate:syntax:
  stage: validate
  script:
    - ansible-playbook --syntax-check site.yml
    - ansible-vault view group_vars/production/vault.yml > /dev/null
  only:
    - merge_requests

deploy:production:
  stage: deploy
  script:
    - ansible-playbook -i inventories/production site.yml
  environment:
    name: production
  only:
    - main
  after_script:
    - rm -f /tmp/vault_pass

# .github/workflows/deploy.yml
name: Deploy with Vault

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.9'
          
      - name: Install Ansible
        run: pip install ansible
        
      - name: Create vault password file
        run: |
          echo "${{ secrets.ANSIBLE_VAULT_PASSWORD }}" > .vault_pass
          chmod 600 .vault_pass
        
      - name: Validate vault files
        run: |
          ansible-vault view --vault-password-file .vault_pass group_vars/production/vault.yml > /dev/null
          
      - name: Deploy to production
        run: |
          ansible-playbook \
            -i inventories/production \
            --vault-password-file .vault_pass \
            site.yml
        env:
          ANSIBLE_HOST_KEY_CHECKING: false
          
      - name: Clean up
        if: always()
        run: rm -f .vault_pass

# Verschiedene Vault-IDs für Umgebungen
ansible-vault encrypt --vault-id staging@prompt group_vars/staging/vault.yml
ansible-vault encrypt --vault-id production@prompt group_vars/production/vault.yml

# Verwendung mit spezifischen IDs
ansible-playbook -i inventories/staging site.yml --vault-id staging@prompt
ansible-playbook -i inventories/production site.yml --vault-id production@prompt

# Passwort-Skript für dynamische Bereitstellung
cat > vault_pass_script.sh << 'EOF'
#!/bin/bash
case "$1" in
    staging)
        echo "$STAGING_VAULT_PASSWORD"
        ;;
    production)
        echo "$PRODUCTION_VAULT_PASSWORD"
        ;;
    *)
        echo "Unknown vault ID: $1" >&2
        exit 1
        ;;
esac
EOF
chmod +x vault_pass_script.sh

# Verwendung in Pipeline
export STAGING_VAULT_PASSWORD="staging_vault_secret"
export PRODUCTION_VAULT_PASSWORD="production_vault_secret"
ansible-playbook -i inventories/production site.yml --vault-id production@vault_pass_script.sh

// Jenkinsfile
pipeline {
    agent any
    
    environment {
        STAGING_VAULT_ID = credentials('staging-vault-password')
        PRODUCTION_VAULT_ID = credentials('production-vault-password')
    }
    
    stages {
        stage('Deploy Staging') {
            steps {
                script {
                    writeFile file: '.vault_staging', text: env.STAGING_VAULT_ID
                    sh 'chmod 600 .vault_staging'
                }
                sh '''
                    ansible-playbook \
                        -i inventories/staging \
                        --vault-id staging@.vault_staging \
                        site.yml
                '''
            }
            post {
                always {
                    sh 'rm -f .vault_staging'
                }
            }
        }
        
        stage('Deploy Production') {
            when {
                tag pattern: "v\\d+\\.\\d+\\.\\d+", comparator: "REGEXP"
            }
            steps {
                script {
                    writeFile file: '.vault_production', text: env.PRODUCTION_VAULT_ID
                    sh 'chmod 600 .vault_production'
                }
                sh '''
                    ansible-playbook \
                        -i inventories/production \
                        --vault-id production@.vault_production \
                        site.yml
                '''
            }
            post {
                always {
                    sh 'rm -f .vault_production'
                }
            }
        }
    }
}

# group_vars/production/vars.yml (unverschlüsselt)
---
database_host: db.production.company.com
database_port: 5432
database_name: webapp_prod
api_endpoint: https://api.production.company.com
ssl_cert_path: /etc/ssl/certs/server.crt

# group_vars/production/vault.yml (verschlüsselt)
---
vault_database_password: "{{ vault_db_pass }}"
vault_database_user: "{{ vault_db_user }}"
vault_api_token: "{{ vault_api_secret }}"
vault_ssl_private_key: "{{ vault_ssl_key }}"
vault_backup_encryption_passphrase: "{{ vault_backup_key }}"

---
- name: Database configuration
  hosts: database_servers
  vars:
    db_connection:
      host: "{{ database_host }}"
      port: "{{ database_port }}"
      name: "{{ database_name }}"
      user: "{{ vault_database_user }}"
      password: "{{ vault_database_password }}"
  tasks:
    - name: Configure database access
      postgresql_user:
        name: "{{ db_connection.user }}"
        password: "{{ db_connection.password }}"
        db: "{{ db_connection.name }}"
        state: present

# roles/database/tasks/main.yml
---
- name: Include role-specific vault
  include_vars: "{{ item }}"
  with_first_found:
    - "{{ inventory_dir }}/group_vars/{{ inventory_hostname }}/vault.yml"
    - "{{ inventory_dir }}/group_vars/database_servers/vault.yml"
    - "{{ inventory_dir }}/group_vars/all/vault.yml"
  no_log: true

- name: Configure database with encrypted credentials
  postgresql_db:
    name: "{{ vault_db_name }}"
    owner: "{{ vault_db_owner }}"
    state: present
  become_user: postgres

# Staging-Environment
ansible-vault create --vault-id staging@prompt group_vars/staging/vault.yml
ansible-vault encrypt_string --vault-id staging@prompt 'staging_secret' --name 'vault_api_key'

# Production-Environment  
ansible-vault create --vault-id production@prompt group_vars/production/vault.yml
ansible-vault encrypt_string --vault-id production@prompt 'production_secret' --name 'vault_api_key'

# Development-Environment
ansible-vault create --vault-id development@prompt group_vars/development/vault.yml

# vault_ids.yml
vault_mappings:
  development:
    password_file: "{{ playbook_dir }}/.vault_dev"
    description: "Development environment secrets"
  staging:
    password_file: "{{ playbook_dir }}/.vault_staging"
    description: "Staging environment secrets"
  production:
    password_file: "{{ playbook_dir }}/.vault_prod"
    description: "Production environment secrets"

# 1Password CLI Integration
ansible-vault encrypt --vault-id production@<(op read "op://vault/ansible-production/password") group_vars/production/vault.yml

# Bitwarden CLI Integration
ansible-vault view --vault-id staging@<(bw get password ansible-staging-vault) group_vars/staging/vault.yml

# HashiCorp Vault Integration
ansible-vault decrypt --vault-id production@<(vault kv get -field=password secret/ansible/production) group_vars/production/vault.yml

#!/bin/bash
# vault_rotation.sh - Automated vault password rotation

ENVIRONMENTS=("staging" "production")
BACKUP_DIR="vault_backups/$(date +%Y%m%d)"

mkdir -p "$BACKUP_DIR"

for env in "${ENVIRONMENTS[@]}"; do
    echo "Rotating vault password for $env environment..."
    
    # Backup current vault files
    cp "group_vars/$env/vault.yml" "$BACKUP_DIR/vault_${env}_backup.yml"
    
    # Generate new password
    NEW_PASSWORD=$(openssl rand -base64 32)
    
    # Rekey vault with new password
    echo "Current password for $env:"
    ansible-vault rekey \
        --vault-id "$env@prompt" \
        --new-vault-id "$env@<(echo '$NEW_PASSWORD')" \
        "group_vars/$env/vault.yml"
    
    # Update password in secure storage
    # op item edit "ansible-${env}-vault" password="$NEW_PASSWORD"
    
    echo "Vault password rotated for $env environment"
done

echo "Vault rotation completed. Backups stored in $BACKUP_DIR"

# Analyse einer Vault-Datei
head -n 1 group_vars/production/vault.yml
# $ANSIBLE_VAULT;1.1;AES256

# Entropie-Überprüfung
ent group_vars/production/vault.yml
# Entropy = 7.999844 bits per byte.

# Sichere Passwort-Datei-Berechtigungen
chmod 600 ~/.vault_pass
chown $(id -u):$(id -g) ~/.vault_pass

# Passwort-Historie vermeiden
export HISTCONTROL=ignorespace
 ansible-vault view --vault-password-file ~/.vault_pass secrets.yml

# Memory-Dumps ausschließen
echo 'vm.core_dump_filter=0x33' >> /etc/sysctl.conf

# Sichere temporäre Dateien
export TMPDIR=/dev/shm
ansible-vault edit secrets.yml

# .gitignore für Passwort-Dateien
echo "*.vault_pass*" >> .gitignore
echo ".vault_*" >> .gitignore

# ansible.cfg
[inventory]
enable_plugins = host_list, script, auto, yaml, ini, toml, advanced_host_list

[lookup_plugins]
lookup_plugins = /usr/share/ansible/plugins/lookup

# Playbook mit HashiCorp Vault Lookup
---
- name: Retrieve dynamic secrets from HashiCorp Vault
  hosts: database_servers
  vars:
    vault_addr: https://vault.company.com:8200
    vault_token: "{{ lookup('env', 'VAULT_TOKEN') }}"
  tasks:
    - name: Get database credentials from Vault
      set_fact:
        db_credentials: "{{ lookup('hashi_vault', 'secret=secret/database/prod auth_method=token token=' + vault_token + ' url=' + vault_addr) }}"
      no_log: true

    - name: Configure database connection
      postgresql_user:
        name: "{{ db_credentials.username }}"
        password: "{{ db_credentials.password }}"
        state: present

# vault-agent.hcl
pid_file = "/var/run/vault-agent.pid"

auto_auth {
    method "aws" {
        mount_path = "auth/aws"
        config = {
            type = "iam"
            role = "ansible-runner"
        }
    }

    sink "file" {
        config = {
            path = "/opt/vault/token"
            mode = 0640
        }
    }
}

template {
    source      = "/etc/ansible/vault_pass.tpl"
    destination = "/etc/ansible/.vault_pass"
    perms       = 0600
}

---
- name: Retrieve secrets from CyberArk
  hosts: application_servers
  tasks:
    - name: Get application password
      cyberark_password:
        api_base_url: https://cyberark.company.com
        app_id: ansible_automation
        query: "Safe=ApplicationPasswords;Object={{ inventory_hostname }}_app_user"
        validate_certs: yes
      register: app_password
      no_log: true

    - name: Configure application with dynamic password
      template:
        src: app_config.j2
        dest: /etc/app/config.conf
        mode: '0600'
      vars:
        app_db_password: "{{ app_password.password }}"

---
- name: Azure Key Vault secrets retrieval
  hosts: azure_vms
  tasks:
    - name: Authenticate to Azure
      azure_rm_auth:
        subscription_id: "{{ azure_subscription_id }}"
        client_id: "{{ azure_client_id }}"
        secret: "{{ azure_client_secret }}"
        tenant: "{{ azure_tenant_id }}"

    - name: Retrieve secret from Key Vault
      azure_rm_keyvault_secret:
        vault_uri: "https://{{ key_vault_name }}.vault.azure.net/"
        secret_name: database-password
        secret_version: current
      register: db_secret
      no_log: true

    - name: Use retrieved secret
      lineinfile:
        path: /etc/app/database.conf
        regexp: '^password='
        line: "password={{ db_secret.secret.value }}"
        mode: '0600'

---
- name: AWS Secrets Manager integration
  hosts: aws_instances
  tasks:
    - name: Retrieve database credentials
      amazon.aws.aws_secret:
        name: "{{ app_name }}/database/credentials"
        region: "{{ aws_region }}"
      register: db_secret
      no_log: true

    - name: Parse JSON secret
      set_fact:
        db_creds: "{{ db_secret.secret | from_json }}"
      no_log: true

    - name: Configure application
      template:
        src: app.conf.j2
        dest: /etc/app/app.conf
        mode: '0600'
      vars:
        database_username: "{{ db_creds.username }}"
        database_password: "{{ db_creds.password }}"

# Vault-Datei validieren
ansible-vault view --vault-password-file ~/.vault_pass group_vars/production/vault.yml

# Syntax-Check mit verschlüsselten Dateien
ansible-playbook --syntax-check --vault-password-file ~/.vault_pass site.yml

# Debug-Modus für Vault-Operationen
ansible-playbook -vvv --vault-password-file ~/.vault_pass site.yml

# Datei-Encoding überprüfen
file group_vars/production/vault.yml
# group_vars/production/vault.yml: ASCII text

# Vault-Header validieren
head -n 1 group_vars/production/vault.yml
# $ANSIBLE_VAULT;1.1;AES256

# Korrupte Vault-Datei reparieren
ansible-vault decrypt --output=temp_vault.yml group_vars/production/vault.yml
ansible-vault encrypt temp_vault.yml
mv temp_vault.yml group_vars/production/vault.yml

# Vault-Dateien komprimieren (bei sehr großen Inhalten)
ansible-vault decrypt large_vault.yml
gzip large_vault.yml
ansible-vault encrypt large_vault.yml.gz

# Aufteilen großer Vault-Dateien
split -l 100 large_vault.yml vault_part_
for part in vault_part_*; do
    ansible-vault encrypt "$part"
done

# Vault-Passwort für Session cachen
eval $(ssh-agent)
echo "export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass" >> ~/.bashrc

# Temporäres Entschlüsseln für intensive Bearbeitung
ansible-vault decrypt group_vars/production/vault.yml
# ... Bearbeitung ...
ansible-vault encrypt group_vars/production/vault.yml