Secure your Ansible-Vault Password using Hashicorp Vault and python script

 Ansible-vault is great tool which is used to encrypt crucial files (which contains important details like credentials , password etc). There are many ways to pass password to ansible-vault. Details can be seen in this link : https://docs.ansible.com/ansible/latest/user_guide/vault.html

In general we keep password in any file (for eg : ~/.vault) and we pass this file as input to ansible-playbook command.

ansible-playbook myyamlfile.yml --vault-password-file /path/to/my/vault-password-file

Eg : ansible-playbook sample.yml --vault-password-file /home/tapan/.vault

This is fine for single developer, but if we want to work with team and if other team members needs to use this, then we need to think of alternative way. We cannot commit this password file into version control (github repo), as it plain text and password will be visible.

To tackle this problem, we can take help of one more vault namely Hashicorp Vault.

Hashicorp vault is open-source secured secret management tool. 

1. Install hashicorp vault in your host machine. Here I am considering Ubuntu-18.04 machine.

$ curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -

$ sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"

$ sudo apt-get update && sudo apt-get install vault

2. Verify Installation 

$ vault

If you see below output, it confirms vault is installed successfully

Usage: vault <command> [args]

Common commands:
    read        Read data and retrieves secrets
    write       Write data, configuration, and secrets
    delete      Delete secrets and configuration
    list        List data or secrets
    login       Authenticate locally
    agent       Start a Vault agent
    server      Start a Vault server
    status      Print seal and HA status
    unwrap      Unwrap a wrapped secret

Other commands:
    audit          Interact with audit devices
    auth           Interact with auth methods
    debug          Runs the debug command
    kv             Interact with Vault's Key-Value storage
    lease          Interact with leases
    monitor        Stream log messages from a Vault server
    namespace      Interact with namespaces
    operator       Perform operator-specific tasks
    path-help      Retrieve API help for paths
    plugin         Interact with Vault plugins and catalog
    policy         Interact with policies
    print          Prints runtime configurations
    secrets        Interact with secrets engines
    ssh            Initiate an SSH session
    token          Interact with tokens

3. Start vault server in dev mode
$ vault server -dev
4. When you start vault server, you will get 'Unseal key' and 'Root token' values. Keep it somewhere (don't loose it)
5. Open new terminal session and execute below command
$ export VAULT_ADDR='http://127.0.0.1:8200'
$ export VAULT_TOKEN="s.XmpNPoi9sRhYtdKHaQhkHP6x" (paste your root-token value)
6. Verify vault server is running
$ vault status
If you see output similar to below, its confirmed vault server is running.
Key             Value
---             -----
Seal Type       shamir
Initialized     true
Sealed          false
Total Shares    1
Threshold       1
Version         1.8.2
Storage Type    inmem
Cluster Name    vault-cluster-4588bfe8
Cluster ID      685107f8-0aa1-cdff-fafe-36c40fe7b280
HA Enabled      false
7. Next, create secret in vault. (Remember this secret and your ansible-vault password should be same)
$ vault kv put secret/ansiblepwd ansivault=**** (ansible-vault password, Eg : qwert1234)
8. You can confirm if secret is successfully created by vault get kv command
$ vault kv get secret/ansiblepwd
====== Metadata ======
Key              Value
---              -----
created_time     2021-09-22T19:20:00.874133318Z
deletion_time    n/a
destroyed        false
version          1

====== Data ======
Key          Value
---          -----
ansivault    qwert1234

9. You can get only password value by using field paramater
    $ vault kv get -field=ansivault secret/ansible
10. Next create executable python script and place this command in that script.
    $ touch readPassword.py
Content of script :
#!/usr/bin/env python
import os
passwd='vault kv get -field=ansivault secret/ansible'
os.system(passwd)

$ chmod +x readPassword.py
11. Next run ansible-playbook command with this python script as input to vault-passwd-file
$ ansible-playbook -i inventory sample.yml --vault-password-file ~/<path to python script>/readPasswd.py
Voila!!!... done
PLAY [all] ***********************************************************************************************************************************************************************************************************************************

TASK [Gathering Facts] ***********************************************************************************************************************************************************************************************************************
[ some output]

PLAY RECAP ***********************************************************************************************************************************************************************************************************************************
ec2-18-212-180-131.compute-1.amazonaws.com : ok=1    changed=0    reachable=1    failed=0    skipped=0    rescued=0    ignored=0   
ec2-54-175-133-129.compute-1.amazonaws.com : ok=1    changed=0    reachable=1    failed=0    skipped=0    rescued=0    ignored=0