<p>Another solution, which would allow you to accomplish the same goals, would be to encrypt your facts files with Mozilla SOPS.</p>
<p>SOPS does a good job of just encrypting parts of the files that you want to have encrypted and you can have multiple people/bots added to the key ring so a build server can decrypt or other people with the key can have it.  You can check the secrets into git and it's relatively safe.</p>
<p>You can find more information here <a href="https://docs.ansible.com/ansible/latest/collections/community/sops/docsite/guide.html" rel="nofollow noreferrer">https://docs.ansible.com/ansible/latest/collections/community/sops/docsite/guide.html</a></p>

CC BY-SA 4.0
2023-11-06T04:56:23.823Z
2023-11-06T04:56:23.823Z
Peter Turner
<blockquote>
<p><em>Is it possible to setup Ansible vault to use asymmetric encryption?</em></p>
</blockquote>
<p>To setup or configure unfortunately not. It might be possible to enhance the functionality of <a href="https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/vault.py" rel="nofollow noreferrer"><code>vault.py</code></a> and implement such.</p>
<p>Regarding</p>
<blockquote>
<p><em>Is it possible to setup the playbook to automatically decrypt data encrypted by something else than the vault (basically a custom vault)? Is there some support for encryption other than the Ansible vault?</em></p>
</blockquote>
<p>and since you are like to</p>
<blockquote>
<p><em>... handle sensitive user data (SSH keys, Registry credentials, etc.).</em></p>
</blockquote>
<p>you might take advantage from external <a href="https://access.redhat.com/documentation/de-de/red_hat_enterprise_linux/8/html/configuring_and_managing_identity_management/vaults-in-idm_configuring-and-managing-idm" rel="nofollow noreferrer">Vaults in IdM</a> and Chapter 76-79, &quot;<em>storing and retrieving secrets</em>&quot;.</p>

CC BY-SA 4.0
2023-05-23T10:48:16.083Z
2023-05-23T10:48:16.083Z
U880D
<p>I'm trying to develop a Playbook which must handle sensitive user data (SSH keys, Registry credentials, etc.).</p>
<p>Only a user and the Ansible controller can see the data associated with that same user.</p>
<p>The data will be stored in a Git repository, accessible to all users.</p>
<p>Thus it must be encrypted.</p>
<p>I'm having an issue to securely encrypt the data using Ansible vault.</p>
<p>The problem is that I cannot give the Ansible vault secret to the user, as the secret can decrypt the ciphertext.</p>
<p>The perfect solution would be to use asymmetric encryption, which I didn't find anyway to do.</p>
<p>The only solution can I see at the moment is this:</p>
<ol>
<li>User encrypt its data using a public key</li>
<li>User sends ciphertext to Ansible controller</li>
<li>Ansible controller decrypts the ciphertext using a private key</li>
<li>Ansible controller encrypts the cleartext using ansible vault (symmetric cipher this time)</li>
<li>Ansible controller commits the ciphertext to the git repository</li>
</ol>
<p>But it'll be painful to setup this process. It would be much simpler if the user could commit the ciphertext encrypted with the public key.</p>
<ul>
<li>Is it possible to setup Ansible vault to use asymmetric encryption ?</li>
<li>Is it possible to setup the playbook to automatically decrypt data encrypted by something else than the vault (basically a custom vault) ?</li>
<li>Is there some support for encryption other than the Ansible vault ?</li>
</ul>

<ansible><encryption><ansible-vault>
Use an asymmetric cypher to secure Ansible vault
Adrien H
# Use an asymmetric cypher to secure Ansible vault

(Asked by: username_0 on 2023-05-04)

I'm trying to develop a Playbook which must handle sensitive user data (SSH keys, Registry credentials, etc.).

Only a user and the Ansible controller can see the data associated with that same user.

The data will be stored in a Git repository, accessible to all users.

Thus it must be encrypted.

I'm having an issue to securely encrypt the data using Ansible vault.

The problem is that I cannot give the Ansible vault secret to the user, as the secret can decrypt the ciphertext.

The perfect solution would be to use asymmetric encryption, which I didn't find anyway to do.

The only solution can I see at the moment is this:

1. User encrypt its data using a public key
2. User sends ciphertext to Ansible controller
3. Ansible controller decrypts the ciphertext using a private key
4. Ansible controller encrypts the cleartext using ansible vault (symmetric cipher this time)
5. Ansible controller commits the ciphertext to the git repository

But it'll be painful to setup this process. It would be much simpler if the user could commit the ciphertext encrypted with the public key.

* Is it possible to setup Ansible vault to use asymmetric encryption ?
* Is it possible to setup the playbook to automatically decrypt data encrypted by something else than the vault (basically a custom vault) ?
* Is there some support for encryption other than the Ansible vault ?

**Tags:** ansible, encryption, ansible-vault


---

## 2 answers

### Answer by username_1 on 2023-11-06. Score: 1

Another solution, which would allow you to accomplish the same goals, would be to encrypt your facts files with Mozilla SOPS.

SOPS does a good job of just encrypting parts of the files that you want to have encrypted and you can have multiple people/bots added to the key ring so a build server can decrypt or other people with the key can have it. You can check the secrets into git and it's relatively safe.

You can find more information here <https://docs.ansible.com/ansible/latest/collections/community/sops/docsite/guide.html>


---

### Answer by username_2 on 2023-05-23. Score: 1

> *Is it possible to setup Ansible vault to use asymmetric encryption?*

To setup or configure unfortunately not. It might be possible to enhance the functionality of [`vault.py`](https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/vault.py) and implement such.

Regarding

> *Is it possible to setup the playbook to automatically decrypt data encrypted by something else than the vault (basically a custom vault)? Is there some support for encryption other than the Ansible vault?*

and since you are like to

> *... handle sensitive user data (SSH keys, Registry credentials, etc.).*

you might take advantage from external [Vaults in IdM](https://access.redhat.com/documentation/de-de/red_hat_enterprise_linux/8/html/configuring_and_managing_identity_management/vaults-in-idm_configuring-and-managing-idm) and Chapter 76-79, "*storing and retrieving secrets*".


---

