Question 3

Correct answer: A

A.

In this scenario, Ansible Vault is used to encrypt sensitive variables, such as database passwords, within a playbook to ensure that they are protected. First, the sensitive data is encrypted using ansible-vault encrypt secrets.yml. In the playbook, the encrypted file is referenced as vars_files to access the sensitive data. The variable (e.g., db_password) is used in the playbook as if it were a regular variable, but it will be decrypted during execution using the appropriate vault password. When running the playbook, the --ask-vault-pass option is used to prompt for the vault password, ensuring that the sensitive data is decrypted when needed and kept secure throughout the playbook's execution.

Line-by-Line Explanation

1. ansible-vault encrypt secrets.yml

   • This command is used to encrypt the secrets.yml file, which contains sensitive data (like passwords). After encryption, the file will no longer be readable without the appropriate password.

2. In the playbook:

   • This section shows the Ansible playbook content.

3. - hosts: all

   • This line specifies that the tasks will be executed on all hosts listed in the Ansible inventory.

4. vars_files:

   • This line references the encrypted secrets.yml file, which contains the sensitive variables to be used in the playbook.

5. - secrets.yml

   • This is the file that contains the encrypted sensitive variables (such as passwords). It is used here to provide the necessary values for the playbook to execute securely.

6. tasks:

   • This starts the list of tasks to be executed on the managed hosts.

7. - name: Use encrypted database password

   • This is a descriptive name for the task, indicating that it will use an encrypted database password.

8. ansible.builtin.debug:

   • This module is used to print the value of the decrypted variable (the database password) for debugging purposes. It is helpful to confirm that the variable has been successfully decrypted.

9. msg: "Database password is {{ db_password }}"

   • This line outputs the value of the db_password variable, which is decrypted during playbook execution.

10. During playbook execution:

• This section shows the command used to execute the playbook.

11. ansible-playbook playbook.yml --ask-vault-pass

• This command is used to run the playbook. The --ask-vault-pass option prompts for the vault password during execution, which is necessary to decrypt the sensitive data in secrets.yml.

This approach ensures that sensitive data, like passwords, is securely stored in an encrypted file (using Ansible Vault) and is only decrypted when the playbook is executed. The playbook is configured to automatically decrypt this data and use it in the tasks, but it requires the vault password to do so. This method maintains the security of sensitive information while automating the deployment and management tasks.