Chapter 79: DevOps Projects Part 9: Ansible Nginx Roles Vault Patch Inventory Agents

79.3 Project 63: Ansible Vault for passwords

By Ravindra Bagale Last updated: 28 October 2026

Friends, plain secrets in git are incidents. Today we draft vault vars, encrypt them, protect the password file, reference vars safely in a playbook, and practice rekey tips.

What you will build in this project

Encrypt group_vars vault file.
Mode 600 password file and gitignore.
Safe playbook references.
Rekey and vault-id notes.

1. Start from a real company story

At Swiggy in Bengaluru, a plain group_vars file with DB passwords was pushed to a shared repo.

Security rotated everything. Rough cost: about ₹50 lakh in engineer time and forced resets.

Arjun mandated Vault for all secrets.

Today we practice that Vault path.

Picture 1: vault.yml → encrypt → playbook uses vars → never print secrets

Ravindra Bagale's Tip

Students paste vault passwords into Slack for teammates. Use a secret manager or a shared sealed channel with rotation. Keep that habit.

2. Start and prepare

Step 1: Why Vault

Why: Plain passwords in git are incidents. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo why. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'Ansible Vault encrypts variable files at rest'

You will see:

Ansible Vault encrypts variable files at rest

What it means: What.

Example 2: a2

Type this:

mkdir -p /tmp/ans63/group_vars/lamp && echo 'Never commit vault passwords'

You will see:

Never commit vault passwords

What it means: Rule.

Example 3: a3

Type this:

echo 'Today: create vault file, encrypt, reference, decrypt tip'

You will see:

Today: create vault file, encrypt, reference, decrypt tip

What it means: Scope.

Step 2: Plain then encrypt

Why: Start from clear file. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: printf secrets. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

printf '%s\n' 'db_user: shopapp' 'db_password: change-me-now' 'api_token: replace-me' > /tmp/ans63/group_vars/lamp/vault.yml && cat /tmp/ans63/group_vars/lamp/vault.yml

You will see:

db_user: shopapp

What it means: Plain draft.

Example 5: b2

Type this:

echo 'ansible-vault encrypt group_vars/lamp/vault.yml'

You will see:

ansible-vault encrypt group_vars/lamp/vault.yml

What it means: Encrypt tip.

Example 6: b3

Type this:

printf '%s\n' '$ANSIBLE_VAULT;1.1;AES256' '66616365207661756c7420636970686572746578742e2e2e' > /tmp/ans63/group_vars/lamp/vault.yml.encsample && head -1 /tmp/ans63/group_vars/lamp/vault.yml.encsample

You will see:

$ANSIBLE_VAULT;1.1;AES256

What it means: Looks like encrypted.

Step 3: Password file

Why: CI-friendly unlock. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: vault pass file. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

printf '%s\n' 'lab-only-vault-pass' > /tmp/ans63/.vault_pass && chmod 600 /tmp/ans63/.vault_pass && ls -l /tmp/ans63/.vault_pass

You will see:

-rw-------

What it means: Mode 600.

Example 8: c2

Type this:

printf '%s\n' '[defaults]' 'vault_password_file = ./.vault_pass' > /tmp/ans63/ansible.cfg && cat /tmp/ans63/ansible.cfg

You will see:

vault_password_file = ./.vault_pass

What it means: cfg.

Example 9: c3

Type this:

echo 'Add .vault_pass to .gitignore immediately'

You will see:

Add .vault_pass to .gitignore immediately

What it means: gitignore.

3. Build the main pieces

Step 4: gitignore

Why: Protect secrets. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: gitignore. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

printf '%s\n' '.vault_pass' '*.vault_pass' 'group_vars/*/vault.yml' > /tmp/ans63/.gitignore && cat /tmp/ans63/.gitignore

You will see:

.vault_pass

What it means: Ignore list.

Example 11: d2

Type this:

echo 'Commit only the encrypted vault.yml after encrypt'

You will see:

Commit only the encrypted vault.yml after encrypt

What it means: Commit rule.

Example 12: d3

Type this:

echo 'Rotate the vault password when someone leaves the team'

You will see:

Rotate the vault password when someone leaves the team

What it means: Rotate.

Step 5: view and edit

Why: Safe edits. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: vault view. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

echo 'ansible-vault view group_vars/lamp/vault.yml'

You will see:

ansible-vault view group_vars/lamp/vault.yml

What it means: View.

Example 14: e2

Type this:

echo 'ansible-vault edit group_vars/lamp/vault.yml'

You will see:

ansible-vault edit group_vars/lamp/vault.yml

What it means: Edit.

Example 15: e3

Type this:

echo 'Do not leave decrypted copies on disk'

You will see:

Do not leave decrypted copies on disk

What it means: Habit.

Step 6: Reference vars

Why: Use in playbook. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: vars reference. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

printf '%s\n' '---' '- name: Use vault vars' '  hosts: lamp' '  become: true' '  tasks:' '    - name: Show db user only' '      debug:' '        msg: "db user is {{ db_user }}"' '    - name: Never debug passwords in CI logs' '      debug:' '        msg: "password length {{ db_password | length }}"' > /tmp/ans63/use-vault.yml && cat /tmp/ans63/use-vault.yml

You will see:

password length {{ db_password | length }}

What it means: Safe debug.

Example 17: f2

Type this:

echo 'ansible-playbook use-vault.yml --ask-vault-pass'

You will see:

ansible-playbook use-vault.yml --ask-vault-pass

What it means: Ask pass.

Example 18: f3

Type this:

echo 'Or rely on vault_password_file in ansible.cfg for lab'

You will see:

Or rely on vault_password_file in ansible.cfg for lab

What it means: File tip.

4. Automate and verify

Step 7: rekey

Why: Change vault password. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: rekey tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

echo 'ansible-vault rekey group_vars/lamp/vault.yml'

You will see:

ansible-vault rekey group_vars/lamp/vault.yml

What it means: Rekey.

Example 20: g2

Type this:

echo 'Update CI secret store in the same change window'

You will see:

Update CI secret store in the same change window

What it means: CI sync.

Example 21: g3

Type this:

echo 'Old password must not remain in chat history'

You will see:

Old password must not remain in chat history

What it means: Hygiene.

Step 8: Multiple vault ids

Why: Prod vs lab. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: vault-id tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

echo 'ansible-playbook site.yml --vault-id lab@.vault_pass_lab --vault-id prod@.vault_pass_prod'

You will see:

ansible-playbook site.yml --vault-id lab@.vault_pass_lab --vault-id prod@.vault_pass_prod

What it means: vault-id.

Example 23: h2

Type this:

echo 'Label encrypted files with vault-id for clarity'

You will see:

Label encrypted files with vault-id for clarity

What it means: Label.

Example 24: h3

Type this:

echo 'Prod vault password lives only in the secret manager'

You will see:

Prod vault password lives only in the secret manager

What it means: Prod tip.

Step 9: Story Swiggy

Why: Leaked vars. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: story. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

printf '%s\n' 'At Swiggy in Bengaluru, a plain group_vars file with DB passwords was pushed to a shared repo.' 'Security rotated everything. Rough cost: about ₹50 lakh in engineer time and forced resets.' 'Arjun mandated Vault for all secrets.' > /tmp/ans63/STORY.txt && wc -l /tmp/ans63/STORY.txt

You will see:

3 /tmp/ans63/STORY.txt

What it means: Story.

Example 26: i2

Type this:

echo 'Arjun: PASS when vault encrypts and playbooks never print secrets'

You will see:

Arjun: PASS when vault encrypts and playbooks never print secrets

What it means: Sign-off.

Example 27: i3

Type this:

echo 'grep -R password group_vars should find only vault ciphertext or no hits'

You will see:

grep -R password group_vars should find only vault ciphertext or no hits

What it means: Audit tip.

5. Harden and accept

Step 10: Local proof

Why: Files mode. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: list. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

ls -l /tmp/ans63/.vault_pass

You will see:

-rw-------

What it means: Pass mode.

Example 29: j2

Type this:

cat /tmp/ans63/.gitignore

You will see:

.vault_pass\n*.vault_pass\ngroup_vars/*/vault.yml

What it means: gitignore.

Example 30: j3

Type this:

test -f /tmp/ans63/use-vault.yml && echo 'play ok'

You will see:

play ok

What it means: Play.

Step 11: Acceptance

Why: Vault habit set. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

echo 'Encrypt before commit; mode 600 on pass file'

You will see:

Encrypt before commit; mode 600 on pass file

What it means: Rules.

Example 32: k2

Type this:

echo 'Debug lengths not values'

You will see:

Debug lengths not values

What it means: Debug rule.

Example 33: k3

Type this:

echo 'Next: zero-downtime patch project 64'

You will see:

Next: zero-downtime patch project 64

What it means: Bridge.

Step 12: Bridge

Why: Ready for patching. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: bridge. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

echo 'Vault unlocks vars for later patch windows'

You will see:

Vault unlocks vars for later patch windows

What it means: Link.

Example 35: z2

Type this:

echo 'Keep vault pass out of screenshots'

You will see:

Keep vault pass out of screenshots

What it means: Habit.

Example 36: z3

Type this:

echo 'Arjun: PASS'

You will see:

Arjun: PASS

What it means: Done.

Check yourself

Q1. Who fixed Swiggy secret leak?

Arjun

Q2. Encrypt command?

ansible-vault encrypt

Q3. Pass file mode?

600

Q4. Safe debug?

length

Q5. Commit pass file?

Q6. Rotate command?

ansible-vault rekey

Friends, you encrypted secrets with Ansible Vault. Did you understand? Let us try it once more. Rekey the lab vault and update the password file in one change.

Lab: try at home

Draft and encrypt vault.yml.
Secure pass file.
Write safe playbook.
Document rekey.

Recap

Encrypt at rest.
gitignore the pass file.
Debug lengths not values.
Rekey on exit.
Prod pass in secret manager.