Ansible Automation Ansible Vault and Secrets Management 3

Question 1

What is the recommended project structure for organizing Ansible Vault-encrypted variable files in a role-based project?

Accepted Answer

Store encrypted secrets in group_vars//vault.yml and plaintext variables in group_vars//vars.yml

Answer

Separating vault-encrypted variables (vault.yml) from plaintext variables (vars.yml) within group_vars enables partial file visibility and cleaner version control diffs.

Question 2

How do you encrypt a single string value using ansible-vault for embedding in a variable file?

Accepted Answer

ansible-vault encrypt_string 'mypassword' --name 'db_password'

Answer

'ansible-vault encrypt_string' generates a vault-encrypted YAML variable definition that can be pasted directly into a variable file.

Question 3

In a CI/CD pipeline, what is the most secure method to provide Ansible Vault passwords?

Accepted Answer

Inject the vault password as an environment variable (ANSIBLE_VAULT_PASSWORD) or a CI/CD secret that is written to a temp file at runtime

Answer

CI/CD secret management systems (Jenkins credentials, GitLab CI variables, GitHub Actions secrets) securely inject the vault password without storing it in code.

Question 4

What ansible.cfg setting specifies the default vault password file location?

Accepted Answer

vault_password_file = /path/to/.vault-pass

Answer

The 'vault_password_file' setting in ansible.cfg's [defaults] section sets the default vault password file, eliminating the need to specify --vault-password-file on every command.

Question 5

How does Ansible Vault handle files that contain both encrypted and unencrypted content?

Accepted Answer

Individual variables can be vault-encrypted inline using '!vault' YAML tags while the rest of the file remains plaintext

Answer

Using 'ansible-vault encrypt_string' generates '!vault' tagged values that can coexist with plaintext variables in the same YAML file.

Ansible Automation Practice Test

Ansible Automation Practice Test

Ansible Automation Ansible Vault and Secrets Management 3