Security is one of the biggest risks in IT world.
That is why Ansible has a built in feature called Ansible Wald.
And in this video, this is what we are going to talk about, how we could protect and secure our Ansible
environment.
Ansible can automate tasks for teams such as hardware, operating system, team virtualization, database
or storage teams, applications, software, and many, many other teams that we deal with and automate
their tasks.
Now, oftentimes you have to share your Ansible code with these groups upon request over the network.
And as you know, anything you share over the network has a risk to end up in the wrong hands.
In addition to that, you probably have a risk of having your system hacked.
So in that case, if you have written many playbooks without the Ansible world, those playbooks can
be viewed openly.
So it is best practice to use Ansible Vault feature, which will password protect your code.
Yes, it's one of the coolest feature of Ansible where you could run your command Ansible vault to pass
your protect your GMO file.
Let's see how we could create our YAML files using ansible walls feature to create YAML file, you have
to use a command ansible dash vault.
The full command will be ansible.
Dash Walt.
Space.
Create space the name of your YAML file.
And in this example we will be using http by Walt YAML, then you will be prompted for a password and
then you have to confirm a password and then you will be entered into the via editor.
Then you specify all the parameters to create a YAML file once the file is created.
And then if you run the YAML file with that command ansible playbooks base the YAML file name, then
it will produce an error because you have to specify dash dash.
Ask for the password right here to run a wanted yaml file you have to run ansible dash playbook the
name of the YAML file.
Dash.
Dash Ask.
Dash.
Walt Dash Pass.
All right, let's do that together and see how we could create a file using Ansible World and run that
YAML file.
All right, I have my Ansible control node right here.
I am logged in as root and I am in etsi ansible playbook directory.
Now let's go ahead and create a YAML file using aspa.
So Ansible Dash Walt and we are creating from scratch.
So we'll use create http bi vault dot yaml.
All right.
So it will prompt you for a password.
So enter a password and make sure you remember the password.
All right.
The password is entered and matched.
Then you are entered in to the VI editor.
Now please note that when you are creating a YAML file through Ansible Dash vault, then you will be
entered through VDI, not the VM editor.
So you have to make sure you are writing the YAML file build write indentation because it won't do the
indentation for you.
All right.
So you put in dash, dash, dash, then the name of your playbook.
So install a HTTP dx package.
All right.
And then you see as soon as you hit enter, it did not indent it for you because we are in VI editor,
not VM editor.
All right.
So hit space to go right directly under the name so it will be vertically aligned, so.
Host And let's say you wanted to do it in local.
Host All right, good.
So for now, just save it and we'll write the rest later on.
File has been created, you could do ls minus l tr and you will see.
Here is the file that is created, and it is encrypted in two ways.
One, it is it does not have read permission for group and others.
And second, if you do, let's say cat http by Walt.
It will show you all the encrypted lines so it won't show you the actual code.
Let's move down.
If I wanted to run this Ansible code, I could run it with Ansible.
The playbook http p.
Bye, Walt.
Dot yaml.
Ask.
This is the option you have to specify in order to run this Yamal file.
All right.
Now, it will ask you for the password you put in the password that you created while you created this
YAML file.
And it did.
See, we didn't have anything except the name and host, so it didn't do anything.
Nothing changed but yaml fell.
File did run.
The playbook did run.
Okay, moving on then.
The next thing is to view a Walter yaml file.
You could simply use the view option.
So let's go back to our.
Yeah.
Command.
Sorry, the ansible dash wall command instead of create will do view and this will show you after entering
the password.
Of course.
Because now we have to deal with the password.
And right here is showing us all three lines that we entered inside of this YAML file playbook.
All right.
Next one is to edit an existing wall to Gmail file.
You have to use the option added.
So let's go to our same YAML file and replace of you with edit and you will see after entering the password
you are prompted back to your YAML file.
Now you could come in and you could specify the tasks.
If you want to view it again, you could do Ansible Dash, Walt space view and to the password.
And it will show you the code.
The code is there.
Now, let's see if we could run it.
So in order to run it, we have to use this command.
Ask Dash, Walt.
But before we run it, let's make sure we do not have a HTTP package installed.
If you do, we'll just remove it.
Okay, we do.
So we'll do yum remove http feed.
Since we've been playing with the HTTP feed for quite some time, that's where we have to remove it
quite a few times.
All right, so it should be gone.
Now, let's confirm one more time by running RPM Dash Command.
Yes, it is gone now let's go ahead and run ansible dash playbook http bye Walt and ask dash walt dash
pass.
It should prompt you for a password.
Oops.
Something wrong?
Oh, I typed a case instead of a ask.
All right, now it should prompt me for the password.
And it should run and it should install the packages.
All right.
Let's give it a few seconds.
Okay.
So it finished installed the changed equal one you could verify by running the same command rpm and
grep for http and you'll see all the packages are there.
Excellent.
All right.
Next one is to get a list of options for Ansible, Dash or Walt.
You can run the command.
Ansible, dash, Walt.
Space dash, dash.
Help.
So let's see what other options we have available with that command.
Ansible.
Dash.
Walt.
Dash.
Help!
All right, you'll see.
These are the options we have available.
Create, create a new world encrypted file.
This is what we use to create it decrypts it.
If you want to decrypt a file which is encrypted at it, we already covered you.
We already covered.
Encrypt is another option to encrypt the existing file, which we'll check in a second right here when
we say HTTP by what the file was created with assembled, dash walled.
What about existing files?
Yes.
What if I wanted to create or encrypt an existing file for that?
You could create a file, let's say using Vim editor and then you could use a command ansible dash walled
space encrypt.
Instead of create, you use the word encrypt followed by the name of your existing YAML file.
It is just that simple, and then it will prompt you for a new password and prompt you to confirm that
password.
Then it will be encrypted.
You will have to use this same command ask dash wall going forward to run that yaml file.