Ansible Automation Ansible Vault and Secrets Management 3

Question 1

What is the recommended project structure for organizing Ansible Vault-encrypted variable files in a role-based project?

Accepted Answer

Store encrypted secrets in group_vars//vault.yml and plaintext variables in group_vars//vars.yml

Answer

Store all variables including secrets in a single encrypted file per group

Answer

Store secrets in roles/rolename/vault/ directory

Answer

Store secrets in a separate repository from the playbooks

Question 2

How do you encrypt a single string value using ansible-vault for embedding in a variable file?

Accepted Answer

ansible-vault encrypt_string 'mypassword' --name 'db_password'

Answer

ansible-vault encrypt --string 'mypassword' --var db_password

Answer

ansible-vault create-string 'mypassword' db_password

Answer

ansible-vault inline-encrypt 'mypassword' as db_password

Question 3

In a CI/CD pipeline, what is the most secure method to provide Ansible Vault passwords?

Accepted Answer

Inject the vault password as an environment variable (ANSIBLE_VAULT_PASSWORD) or a CI/CD secret that is written to a temp file at runtime

Answer

Store the vault password in the repository's README for team access

Answer

Hard-code the vault password in the Jenkinsfile or .gitlab-ci.yml

Answer

Use the same vault password as the SSH key passphrase for simplicity

Question 4

What ansible.cfg setting specifies the default vault password file location?

Accepted Answer

vault_password_file = /path/to/.vault-pass

Answer

vault_file = /path/to/.vault-pass

Answer

default_vault = /path/to/.vault-pass

Answer

encrypt_password_file = /path/to/.vault-pass

Question 5

How does Ansible Vault handle files that contain both encrypted and unencrypted content?

Accepted Answer

Individual variables can be vault-encrypted inline using '!vault' YAML tags while the rest of the file remains plaintext

Answer

Ansible Vault cannot mix encrypted and plaintext content in a single file—the entire file must be encrypted

Answer

Ansible automatically detects and encrypts sensitive-looking values

Answer

Mixed files require a special 'partial-vault' header

Question 6

What is the purpose of the 'ansible-vault encrypt_string' command's '--stdin-name' option?

Accepted Answer

It reads the secret value from stdin rather than as a command-line argument, preventing the secret from appearing in shell history

Answer

It sets the name of the variable from standard input

Answer

It enables batch processing of multiple variable names from stdin

Answer

It encrypts a multi-line string passed via stdin