Question

A network automation engineer is storing an Ansible playbook and its variable files in a shared Git repository used to configure Cisco Nexus 9000 switches. The variable files contain BGP neighbor authentication keys and device login credentials in plaintext. Security policy requires that these secrets not be readable in the repository while still allowing the playbook to run non-interactively in a CI/CD pipeline. Which approach meets the requirement?

Accepted Answer

Encrypt the sensitive variable files with Ansible Vault and supply the vault password to the pipeline via a vault password file or environment variable at runtime.

Answer

Move the credentials into the playbook's inline tasks and mark those tasks with 'no_log: true' so they are hidden from the repository.

Answer

Base64-encode the variable files before committing them so the secrets are not directly human-readable in Git.

Answer

Store the credentials in the ansible.cfg file, which is automatically excluded from version control by default.