Question

Your team commits an Ansible project to a shared Git repository to automate OSPF and interface configuration across IOS-XE devices. A security audit flags that plaintext device passwords appear in the group_vars/all.yml file. You must keep the credentials in version control but ensure they are not readable in plaintext, while still allowing playbooks to run unattended in a CI/CD pipeline. Which approach best satisfies these requirements?

Accepted Answer

Encrypt the sensitive variables with Ansible Vault and supply the vault password to the pipeline via a --vault-password-file that reads from a protected CI secret.

Answer

Base64-encode the passwords in group_vars/all.yml so they are no longer human-readable in the repository.

Answer

Move the passwords into the inventory file instead of group_vars, since inventory files are excluded from Git by default.

Answer

Set no_log: true on every task that references the credentials so the values never appear in the repository.