Question

You maintain an Ansible playbook that deploys a web application. The playbook references a variables file, group_vars/prod/secrets.yml, containing a database password in plaintext. Your security team requires that this file be encrypted at rest in the Git repository but still usable during automated playbook runs. Which approach meets these requirements?

Accepted Answer

Run 'ansible-vault encrypt group_vars/prod/secrets.yml' and execute the playbook with '--ask-vault-pass' or a '--vault-password-file'

Answer

Base64-encode the secrets.yml file with 'base64 secrets.yml > secrets.yml.b64' and reference the encoded file in the playbook

Answer

Add 'group_vars/prod/secrets.yml' to .gitignore so the plaintext file is never committed to the repository

Answer

Set 'no_log: true' on every task that uses the password so the value is hidden from output