What approaches are used to manage credentials in Ansible roles?

There are several approaches to managing credentials in Ansible roles:

1. Ansible Vault — encrypting secrets within playbooks or variables. It allows storing passwords and keys in an encrypted form and decrypting them during execution.

2. Environment variables — passing credentials through environment variables to avoid storing them in code.

3. External secret managers — integrating with HashiCorp Vault, AWS Secrets Manager, CyberArk, and others to dynamically retrieve secrets.

4. Using variable files — storing credentials in separate files that are not committed to the repository (e.g., via .gitignore).

5. Passing through command line parameters — a less secure method, but sometimes used for temporary values.

Example of using Ansible Vault:

ansible-vault create secrets.yml
ansible-playbook site.yml --ask-vault-pass

In the playbook, you can include encrypted variables from secrets.yml and use them in tasks.