Ansible Vault Tutorial: Encrypt Secrets and Variables

After writing 8 books on Ansible, here is the distilled guide to doing it right.

Prerequisites

• Ansible installed (Install Ansible on Ubuntu or RHEL 9)
• SSH access to target hosts
• Python 3 on managed nodes

Step-by-Step Guide

Step 1: Set Up Your Project

mkdir -p ansible-project/{inventory,roles,playbooks,group_vars}
cd ansible-project

Step 2: Write Your First Playbook

---
- name: Configure web servers
  hosts: webservers
  become: true

  tasks:
    - name: Install required packages
      ansible.builtin.dnf:
        name:
          - nginx
          - firewalld
        state: present

    - name: Start and enable services
      ansible.builtin.systemd:
        name: "{{ item }}"
        state: started
        enabled: true
      loop:
        - nginx
        - firewalld

    - name: Open HTTP port
      ansible.posix.firewalld:
        service: http
        permanent: true
        state: enabled
        immediate: true

Step 3: Use Roles for Reusability

ansible-galaxy role init roles/webserver

Best Practices

• Always use FQCN (fully qualified collection names)
• Use ansible-lint before every commit
• Test with Molecule
• Encrypt secrets with Ansible Vault

Related Resources

• Ansible Cheat Sheet
• Ansible Playbook Examples
• Ansible Lightspeed Tutorial
• Ansible vs Puppet
• Red Hat Ansible Automation Platform

About the Author

I am Luca Berton, AI and Cloud Advisor with 8 published books on automation, Kubernetes, and AI. Book a consultation to discuss your ansible vault strategy.