WEBVTT 1 00:00.000 --> 00:04.630 Okay friends, let's briefly switch gears and talk about a very important topic, 2 00:04.630 --> 00:05.280 and this is all 3 00:05.280 --> 00:10.150 about managing secrets. What exactly is a secret? Well, the name kind of tells 4 00:10.150 --> 00:11.360 you, is any information 5 00:11.360 --> 00:14.650 that you do not want to just be freely shared. So this could be some type of 6 00:14.650 --> 00:15.760 password information, 7 00:15.760 --> 00:20.800 perhaps it is just some type of sensitive configurations. Whatever it may be, 8 00:20.800 --> 00:21.600 you want to keep this 9 00:21.600 --> 00:26.150 information shielded away from prying eyes. So in this particular video here, 10 00:26.150 --> 00:26.720 what we're going to 11 00:26.720 --> 00:30.880 be discussing is Ansible Solution for Secret Management, and this is known as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:26.720 --> 00:30.880 be discussing is Ansible Solution for Secret Management, and this is known as 12 00:30.880 --> 00:31.920 Ansible Vault. 13 00:31.920 --> 00:35.750 The name of the tool is pretty instructive. It's going to provide you a little 14 00:35.750 --> 00:36.720 vault in which you 15 00:36.720 --> 00:41.340 can protect that data. So really what we're talking about here is encrypting 16 00:41.340 --> 00:42.560 our data. So let's have 17 00:42.560 --> 00:46.690 a look at Ansible Vault and see how it actually operates. Okay, so let's go 18 00:46.690 --> 00:47.600 into the group 19 00:47.600 --> 00:52.290 var directory, and we'll go into all dot yaml. So right now here, we happen to 20 00:52.290 --> 00:53.520 have a DNS server. 21 00:53.520 --> 00:57.330 Let's maybe say it's not exactly the most sensitive information, but let's 22 00:57.330 --> 00:58.640 imagine we did have 23 00:58.640 --> 01:02.840 some type of secret info right here. So we can maybe say something like say sn WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 23 00:58.640 --> 01:02.840 some type of secret info right here. So we can maybe say something like say sn 24 01:02.840 --> 01:03.920 mp contacts, 25 01:03.920 --> 01:09.200 and let's say the name was John McGovern, and the email was john@example.com. 26 01:09.200 --> 01:09.840 The phone number was 27 01:09.840 --> 01:15.800 1234, 1234, 1234, a very, very memorable phone number. Now the example here is 28 01:15.800 --> 01:16.480 a little bit 29 01:16.480 --> 01:20.030 frivolous, but honestly, the data itself doesn't actually matter. Just 30 01:20.030 --> 01:21.520 conceptualize this as 31 01:21.520 --> 01:24.750 something that we're treating with a little bit of sensitivity. If say for 32 01:24.750 --> 01:26.000 example, we published 33 01:26.000 --> 01:30.130 this information to some type of version control system such as gets, well WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 33 01:26.000 --> 01:30.130 this information to some type of version control system such as gets, well 34 01:30.130 --> 01:31.360 potentially, depending 35 01:31.360 --> 01:35.520 on the actual configurations, this information could become public. So instead 36 01:35.520 --> 01:36.480 we would like this 37 01:36.480 --> 01:41.060 particular file to be at an encrypted state, when it is stored on the disk, and 38 01:41.060 --> 01:41.840 when we actually 39 01:41.840 --> 01:46.800 need to access the data itself, it's actually going to be decrypted in memory, 40 01:46.800 --> 01:47.360 and then it can be 41 01:47.360 --> 01:51.550 passed into the playbook upon execution. So let's actually see how Ansible 42 01:51.550 --> 01:52.640 Vault can help us out 43 01:52.640 --> 01:59.020 here. Now one thing to note, in this case here, this particular file already 44 01:59.020 --> 02:00.720 exists. As in, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 44 01:59.020 --> 02:00.720 exists. As in, 45 02:00.720 --> 02:05.730 the information here is already written to disk, it is not a brand new file. So 46 02:05.730 --> 02:06.640 the command we 47 02:06.640 --> 02:11.060 actually want to specify here in this case here is Ansible Vault with the 48 02:11.060 --> 02:13.040 option incorrect. So check 49 02:13.040 --> 02:16.140 this out then. What I will see here, if I just cat the file, we can see the 50 02:16.140 --> 02:17.440 content, if I now say 51 02:17.440 --> 02:22.260 Ansible Vault, and then encrypts, and then specify the file that I want to 52 02:22.260 --> 02:23.440 actually encrypt, which 53 02:23.440 --> 02:27.530 in this case here is all dot yml. Notice it's going to prompt me to enter a 54 02:27.530 --> 02:28.800 vault password. 55 02:28.800 --> 02:32.960 This is going to be a password that is going to protect this particular file. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 55 02:28.800 --> 02:32.960 This is going to be a password that is going to protect this particular file. 56 02:32.960 --> 02:33.600 So let's just say 57 02:33.600 --> 02:38.090 in this case here, the password is john. So john, oh, hn, and I'm going to have 58 02:38.090 --> 02:38.800 to confirm it, 59 02:38.800 --> 02:43.240 jio hn, and enter. Now the encryption is successful. If I now cat the file, 60 02:43.240 --> 02:44.320 check this out right here, 61 02:44.320 --> 02:48.480 we just get this garbled gibberish, because the actual file itself has been 62 02:48.480 --> 02:49.520 encrypted using 63 02:49.520 --> 02:53.190 advanced encryption standard 256. So you're thinking, well, okay, that looks 64 02:53.190 --> 02:53.680 pretty good. 65 02:53.680 --> 02:56.720 If anyone happened to read this particular file, they would just see this gib 66 02:56.720 --> 02:57.520 berish. They couldn't 67 02:57.520 --> 03:01.870 actually see the sensitive information such as the contact details here. But WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 67 02:57.520 --> 03:01.870 actually see the sensitive information such as the contact details here. But 68 03:01.870 --> 03:03.120 how do we actually 69 03:03.120 --> 03:07.820 access this with respect to our playbooks? Say for example, I wanted to print 70 03:07.820 --> 03:08.880 out this information 71 03:08.880 --> 03:12.850 within the playbook itself, or maybe just call the DNS server, that type of 72 03:12.850 --> 03:13.920 thing. What we are 73 03:13.920 --> 03:18.210 going to do is to decrypt this in memory and pass it into the playbook on the 74 03:18.210 --> 03:19.200 fly. So let's 75 03:19.200 --> 03:21.930 actually see how this is going to work. So what I will do is I will create a 76 03:21.930 --> 03:23.520 little file just called 77 03:23.520 --> 03:27.950 encrypt example dot yml going to insert mode, have our free hyphens, give it a 78 03:27.950 --> 03:29.760 name, just say testing 79 03:29.760 --> 03:34.710 some vault stuff, or specify the host is going to be all. And the tasks here, I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 79 03:29.760 --> 03:34.710 some vault stuff, or specify the host is going to be all. And the tasks here, I 80 03:34.710 --> 03:35.280 'll just give it a 81 03:35.280 --> 03:40.330 name saying pulling var from encrypted file. Now all I'm going to do here is to 82 03:40.330 --> 03:41.200 print out the 83 03:41.200 --> 03:44.420 contents of the variable just so I can prove that I can access them. So I will 84 03:44.420 --> 03:44.960 use a debug 85 03:44.960 --> 03:50.980 module with the message parameter. And I'll just say the snmp contact email is 86 03:50.980 --> 03:51.680 have my double color 87 03:51.680 --> 03:56.710 braces, and the variable will be snmp underscore contact dot email. So let's 88 03:56.710 --> 03:58.320 just save this playbook. 89 03:58.320 --> 04:02.130 So if I say Ansible playbook, and just call the playbook here, and do not WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 89 03:58.320 --> 04:02.130 So if I say Ansible playbook, and just call the playbook here, and do not 90 04:02.130 --> 04:03.520 provide any additional 91 04:03.520 --> 04:07.760 information what's going to happen, let's hit enter. So it says here attempting 92 04:07.760 --> 04:08.640 to decrypt, 93 04:08.640 --> 04:12.720 but no vault secrets found, basically Ansible is detecting that we have a vault 94 04:12.720 --> 04:13.440 protected file 95 04:13.440 --> 04:16.750 that we're trying to call. And we haven't provided the password. So what I'm 96 04:16.750 --> 04:17.760 going to do this time 97 04:17.760 --> 04:23.780 is use the same command, but this time add on dash dash, ask dash vault dash 98 04:23.780 --> 04:25.600 pass when I hit enter, 99 04:25.600 --> 04:30.160 before the playbook executes, I'm going to type in the vault password for that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 99 04:25.600 --> 04:30.160 before the playbook executes, I'm going to type in the vault password for that 100 04:30.160 --> 04:30.880 particular file, 101 04:30.880 --> 04:36.020 which was jiohn. If I hit enter, and look at this right here, this time we have 102 04:36.020 --> 04:36.880 successfully 103 04:36.880 --> 04:41.110 accessed the variables from a thin and encrypted file. And the cool thing is if 104 04:41.110 --> 04:41.920 I go into my group 105 04:41.920 --> 04:46.890 vars, and I actually cut the all dot yaml file, the file itself on disk has not 106 04:46.890 --> 04:47.680 changed. It's 107 04:47.680 --> 04:52.000 still stored any fully encrypted states. So let's maybe say I'm just managing 108 04:52.000 --> 04:53.040 my system. I want 109 04:53.040 --> 04:57.170 to have a quick glance at what my variables happen to be. And I don't want to 110 04:57.170 --> 04:58.960 actually decrypt the 111 04:58.960 --> 05:03.240 actual data on disk. What I can do is I can peek in to the file in its un WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 111 04:58.960 --> 05:03.240 actual data on disk. What I can do is I can peek in to the file in its un 112 05:03.240 --> 05:04.480 encrypted format, 113 05:04.480 --> 05:09.020 by decrypting it in RAM, I E and memory, and viewing it that way. So the way we 114 05:09.020 --> 05:09.840 can actually do this 115 05:09.840 --> 05:14.220 is by saying Ansible vault, and we can just specify the keyword view and until 116 05:14.220 --> 05:15.200 Ansible to fail that 117 05:15.200 --> 05:18.680 we want to view if I hit enter, I'm going to have to provide the correct 118 05:18.680 --> 05:20.240 password. If I try to type 119 05:20.240 --> 05:24.460 in the wrong password, such as maybe say, David, clearly the file is not going 120 05:24.460 --> 05:25.680 to decrypt. But 121 05:25.680 --> 05:30.590 if I try again and type in john, we actually just get to peek inside the file. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 121 05:25.680 --> 05:30.590 if I try again and type in john, we actually just get to peek inside the file. 122 05:30.590 --> 05:31.760 But it's actual state 123 05:31.760 --> 05:36.490 as it's written on disk did not actually change. Now suppose I wanted to make 124 05:36.490 --> 05:38.240 an edit to my variable 125 05:38.240 --> 05:42.750 files, let's maybe say the snmb contact happened to change. Once again, what I 126 05:42.750 --> 05:43.520 want to do is to 127 05:43.520 --> 05:47.200 leave the file in an encrypted state on disk, make the modifications in RAM, 128 05:47.200 --> 05:48.160 and then immediately 129 05:48.160 --> 05:52.040 commit those changes back to disk, you know, as opposed to fully decrypting the 130 05:52.040 --> 05:52.880 file on disk, 131 05:52.880 --> 05:56.990 just opening up an irregular text editor, making the changes, and then re 132 05:56.990 --> 05:58.480 encrypting it. That 133 05:58.480 --> 06:02.280 really isn't best practice because it leaves a little bit of a window where the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 133 05:58.480 --> 06:02.280 really isn't best practice because it leaves a little bit of a window where the 134 06:02.280 --> 06:03.120 file is left on 135 06:03.120 --> 06:07.680 disk in a decrypted state. So the way I can do this is I can say Ansible vault, 136 06:07.680 --> 06:08.480 and I can specify 137 06:08.480 --> 06:12.350 the keyboard edits, and then specify the file that I want to edit. If I hit 138 06:12.350 --> 06:13.440 enter, once again, 139 06:13.440 --> 06:18.240 passing the password of Jioh n, answer, now we're taking into a temporary file 140 06:18.240 --> 06:18.880 that shows us the 141 06:18.880 --> 06:22.280 actual contents here. And if I want to make modifications, it could change us 142 06:22.280 --> 06:24.080 to let's say James Conrad, 143 06:24.080 --> 06:27.080 and change the name to James, and let's maybe change the phone number a little 144 06:27.080 --> 06:27.920 bit, whatever. 145 06:27.920 --> 06:32.790 So if I just press colon wq to write and quit, if I answer, what has actually WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 145 06:27.920 --> 06:32.790 So if I just press colon wq to write and quit, if I answer, what has actually 146 06:32.790 --> 06:34.240 happened here is the 147 06:34.240 --> 06:38.670 output of the password hash has actually changed. And we can eyeball this just 148 06:38.670 --> 06:39.360 by looking at the 149 06:39.360 --> 06:43.310 last two digits of three six if we just scroll on up a little bit, it used to 150 06:43.310 --> 06:44.240 be three two. 151 06:44.240 --> 06:47.440 That's because the content itself has actually changed. Therefore, we have 152 06:47.440 --> 06:48.320 produced a completely 153 06:48.320 --> 06:52.500 different hash value. So once again, if I go back to my playbook, and I run it 154 06:52.500 --> 06:53.120 once again, 155 06:53.120 --> 06:56.580 type in the password Jioh n, hit enter, look at this right here, the debug 156 06:56.580 --> 06:57.600 module is now printing 157 06:57.600 --> 07:02.830 out that the snmp contact email is James@example.com, showing us that the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 157 06:57.600 --> 07:02.830 out that the snmp contact email is James@example.com, showing us that the 158 07:02.830 --> 07:04.320 variables have indeed been 159 07:04.320 --> 07:08.770 modified. Now, like I say, when I happen to encrypt my all dot yaml file that 160 07:08.770 --> 07:10.480 was already existing, 161 07:10.480 --> 07:14.890 let's maybe say I wanted to create a brand new file entirely. The advantage 162 07:14.890 --> 07:15.600 here of when you do 163 07:15.600 --> 07:19.730 this, it means that the file was always written to the disk in an encrypted 164 07:19.730 --> 07:20.640 state and never 165 07:20.640 --> 07:25.600 in its decrypted form, and only ever will be accessed in its decrypted state in 166 07:25.600 --> 07:27.200 RAM. So no actual 167 07:27.200 --> 07:30.830 permanent record of the unencrypted file on the computer itself. So let's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 167 07:27.200 --> 07:30.830 permanent record of the unencrypted file on the computer itself. So let's 168 07:30.830 --> 07:32.160 create a new file here, 169 07:32.160 --> 07:36.320 and we'll just say answerable vault. And as opposed to saying encrypt, like we 170 07:36.320 --> 07:37.440 would do with an already 171 07:37.440 --> 07:41.940 existing file, in this case here, we just want to use the keyword create to 172 07:41.940 --> 07:43.520 create a brand new file. 173 07:43.520 --> 07:46.110 And now what I'm going to do is I'm going to specify the file that I'm going to 174 07:46.110 --> 07:46.720 create. So 175 07:46.720 --> 07:51.290 let's just say nugget dot yml. If I hit enter, what it's doing is asking me to 176 07:51.290 --> 07:52.240 type in a vault 177 07:52.240 --> 07:56.390 password, and this can be completely different. So let's say the password here 178 07:56.390 --> 07:57.360 is pizza. I'm going 179 07:57.360 --> 08:01.090 to confirm it as pizza. Now it drops us into a temporary VIM session. So if I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 179 07:57.360 --> 08:01.090 to confirm it as pizza. Now it drops us into a temporary VIM session. So if I 180 08:01.090 --> 08:02.160 just go into insert 181 08:02.160 --> 08:06.470 mode, so I'll just say the password is medium red donut. I don't actually know 182 08:06.470 --> 08:07.280 what I got this 183 08:07.280 --> 08:11.570 from button of the list. Let's just do right and quit. Once I do this, if we 184 08:11.570 --> 08:13.040 happen to cat the file, 185 08:13.040 --> 08:16.980 it's already in its encrypted form. Now, crucially, if I try to say, for 186 08:16.980 --> 08:17.520 example, 187 08:17.520 --> 08:21.410 view the actual file, I can say answerable vault view. And then I can say nug 188 08:21.410 --> 08:22.160 get. Notice if I 189 08:22.160 --> 08:26.440 try to type in the password, jioh n, and I enter the decryption field, just 190 08:26.440 --> 08:27.440 because we use one 191 08:27.440 --> 08:32.040 password for one file, doesn't mean it applies globally. In the case here, when WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 191 08:27.440 --> 08:32.040 password for one file, doesn't mean it applies globally. In the case here, when 192 08:32.040 --> 08:32.960 I try to decrypt 193 08:32.960 --> 08:36.940 this file as I do again, I actually have to type in the password pizza. So when 194 08:36.940 --> 08:37.360 I do so, 195 08:37.360 --> 08:42.000 we actually see printed the standard out the content of that particular file. 196 08:42.000 --> 08:42.640 Now suppose we 197 08:42.640 --> 08:46.040 actually wanted to decrypt the file so that it actually is decrypted on the 198 08:46.040 --> 08:46.800 disk itself, 199 08:46.800 --> 08:50.200 meaning that as the corruption could be permanent. The keyword we would simply 200 08:50.200 --> 08:51.040 use would be decrypt 201 08:51.040 --> 08:54.850 so I can say answerable vault decrypt. And I'll go into the grip-verse 202 08:54.850 --> 08:56.000 directory and target the 203 08:56.000 --> 08:59.490 all dot yaml file. If I enter, what I'm going to have to do is to provide the 204 08:59.490 --> 09:00.480 correct password WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 204 08:59.490 --> 09:00.480 correct password 205 09:00.480 --> 09:04.660 for the encryption, which in this case here is jioh n. If I enter, the dec 206 09:04.660 --> 09:06.000 ryption has been successful 207 09:06.000 --> 09:10.610 if I now go into the grip-verse directory and cat the all dot yaml file. Notice 208 09:10.610 --> 09:11.680 the file here 209 09:11.680 --> 09:16.210 is fully in plaintext. Now, like I say, if we want to, perhaps maybe change a 210 09:16.210 --> 09:17.040 password, 211 09:17.040 --> 09:20.540 maybe we don't like the john password. What we don't want to do is do what we 212 09:20.540 --> 09:21.600 just did here, 213 09:21.600 --> 09:26.640 decrypt the file and then seek to re-encrypt it just specifying a new password. 214 09:26.640 --> 09:27.680 That will actually 215 09:27.680 --> 09:32.160 work. But like I say, we have this temporary window right now whereby this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 215 09:27.680 --> 09:32.160 work. But like I say, we have this temporary window right now whereby this 216 09:32.160 --> 09:33.680 particular file here is 217 09:33.680 --> 09:37.850 just lying on my disk in an unencrypted state. Instead, the way we should 218 09:37.850 --> 09:39.200 actually handle this 219 09:39.200 --> 09:43.850 is to use the answerable vault re key option. This is going to allow us to 220 09:43.850 --> 09:45.200 switch keys without 221 09:45.200 --> 09:48.800 having the fail be unencrypted on the hard disk. So let's just use answerable 222 09:48.800 --> 09:50.080 vault. And right now, 223 09:50.080 --> 09:54.400 I will encrypt the file. So let's just use the vault password of Bob, BOB, and 224 09:54.400 --> 09:55.520 I will confirm it. 225 09:55.520 --> 09:58.770 And for whatever reason, we just said, you know what Bob is too short a name, 226 09:58.770 --> 09:59.440 we want to change 227 09:59.440 --> 10:03.990 the password. What we'll say is answerable vault re key and then specify the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 227 09:59.440 --> 10:03.990 the password. What we'll say is answerable vault re key and then specify the 228 10:03.990 --> 10:05.120 file I want to target 229 10:05.120 --> 10:09.420 if I enter, I'm going to have to type in the vault password, which is bob. And 230 10:09.420 --> 10:10.400 then specify the 231 10:10.400 --> 10:13.460 new password that I want to set. So let's maybe say it's some owner, so a 232 10:13.460 --> 10:14.480 little bit of a longer 233 10:14.480 --> 10:19.240 password. Just confirm it. Now we can see the re key has been successful. So if 234 10:19.240 --> 10:19.920 I say answerable 235 10:19.920 --> 10:24.550 vault, and I tried to view the contents of all dot yaml, if I type in bob, the 236 10:24.550 --> 10:25.520 old password, 237 10:25.520 --> 10:30.000 notice the encryption happens to fail. Whereas if I view it, and I type in the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 238 10:30.000 --> 10:30.480 password, 239 10:30.480 --> 10:34.380 some more this time, now we can actually see the contents and similarly we can 240 10:34.380 --> 10:35.120 permanently 241 10:35.120 --> 10:39.520 to keep the fail by using the decrypt option. Once again, passing in the value, 242 10:39.520 --> 10:39.840 some more 243 10:39.840 --> 10:43.780 now, hitting answer and now we can see here that if we cut the fail, the fail 244 10:43.780 --> 10:44.640 is no back on 245 10:44.640 --> 10:47.120 desk and it's fully on encrypted state.