Using `ansible-vault-keyring`

An interactive guide to securely storing your Ansible Vault password in your system's native keyring. Follow the steps below to set it up and never type your vault password again.

The Workflow

Install

Get the tool.

Configure

Store password & link to Ansible.

Use

Run playbooks seamlessly.

1. Installation

First, ensure you have `ansible-vault-keyring` installed via pip. This command will install the necessary package and its dependencies on your system.

pip install ansible-vault-keyring

2. Configuration

This is a two-step process. First, you'll store your password in the system keyring with a unique Vault ID. Then, you'll configure Ansible to use it.

Step 2.1: Store Your Vault Password

You must associate your vault password with a **Vault ID**. If you only manage one vault, using `default` is a simple and effective choice. Enter your desired Vault ID below to generate the command, then run it in your terminal. It will prompt for the password to store.

Your Vault ID:

ansible-vault-keyring --vault-id default --set

Step 2.2: Configure `ansible.cfg`

Now, tell Ansible how to find this password. First, find the executable path by running `which ansible-vault-keyring`. Then, paste that path below to generate the configuration snippet for your `ansible.cfg` file.

Executable Path (from `which ansible-vault-keyring`):

Add the following line to the `[defaults]` section of your `ansible.cfg` file.

[defaults]
vault_identity_list = default@/path/to/your/script

3. Usage

That's it! You can now run any `ansible-playbook` command that uses vaulted files. Ansible will automatically use the script to get the password from your keyring without prompting you.

# No more --ask-vault-pass or password prompts
ansible-playbook my_playbook.yml

4. Managing Multiple Vaults (Advanced)

Click to expand for instructions on managing different passwords for environments like `dev` and `prod`.