Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:notes_ansible-vault [2025/03/24 15:06] – créée - modification externe 127.0.0.1
+++ tech:notes_ansible-vault [2026/06/07 19:12] (Version actuelle) – modification externe 127.0.0.1
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>Brouillon Ansible Vault MDP Jinja}}
+# Notes ansible-vault
+Voir aussi :
+* SOPS
+## Ansible-vault pour crypto chiffrement
+Définir la clef
+[Adding the vault password file option to the Ansible configuration](https://www.safaribooksonline.com/library/view/ansible-playbook-essentials/9781784398293/ch08s05.html)
+~~~bash
+cat /dev/urandom  | tr -dc A-Za-z0-9 | head -c32 > ~/.ansible/.vault_pass
+chmod 600 ~/.ansible/.vault_pass
+~~~
+`~/.ansible.cfg`
+~~~ini
+[defaults]
+vault_password_file = $HOME/.ansible/.vault_pass
+~~~
+Changer le secret
+~~~bash
+mv ~/.ansible/.vault_pass ~/.ansible/.vault_pass.old
+cat /dev/urandom  | tr -dc A-Za-z0-9 | head -c32 > ~/.ansible/.vault_pass
+chmod 600 ~/.ansible/.vault_pass*
+ansible-vault rekey --vault-password-file=~/.ansible/.vault_pass.old --new-vault-password-file=~/.ansible/.vault_pass $(find . -type f -name "*.mdp.yml")
+# shred -u ~/.ansible/.vault_pass
+~~~
+## Exemples
+~~~bash
+ansible-vault encrypt_string 'P@ssw0rd' --name 'mysql_pass_root'
+~~~
+~~~yaml
+mysql_pass_root: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          31313332623736393962306239386565356536663533343665653565336265373265373166326565
+          6166646561303163376336363834636633373538346632310a356166393237333865623863336133
+          64343962336462356336303239663633316364393137633263366334376533303766393262653561
+          6638303531626238630a613161663932376333633539656334336465383238623330393832666136
+~~~
+## Pb
+### secret must be unicode or bytes, not ansible.parsing.yaml.objects.AnsibleVaultEncryptedUnicode
+Dans notre exemple **mysecret** est une chaine chiffrée par ansible-vault
+~~~
+fatal: [remote]: FAILED! => {"msg": "Unexpected templating type error occurred on ({{ mysecret | password_hash('sha512') }}): secret must be unicode or bytes, not ansible.parsing.yaml.objects.AnsibleVaultEncryptedUnicode"}
+~~~
+#### Solution
+Source : https://gist.github.com/douglasmiranda/f21a4481d372ae54fcf4a6ff32249949
+~~~yaml
+- name: "Create main user"
+  user:
+    name: "myuser"
+    password: "{{ '%s' | format(mysecret) | password_hash('sha512') }}"
+    # ...
+~~~