How to securely store secrets in Ansible?

In Ansible, Ansible Vault is commonly used for securely storing secrets. It is an integrated encryption mechanism that allows sensitive data (passwords, keys, tokens) to be stored in encrypted files.

Main points:

• Secret files are encrypted using a password or key.
• When running playbooks, a password for decryption can be provided.
• You can encrypt individual variables or entire files.

Example of creating an encrypted file:

ansible-vault create secrets.yml

Example of using encrypted variables in a playbook:

- hosts: all
  vars_files:
    - secrets.yml
  tasks:
    - debug: msg="Password: {{ db_password }}"

Thus, secrets are not stored in plain text in the repository and are protected from unauthorized access.