Ansible Vault: Hướng dẫn bảo mật Secrets và quản lý mật khẩu trong Automation - Part 2

# README.md

## Vault Passwords

- **Development**: Stored in 1Password vault "Ansible Dev"
- **Staging**: Stored in AWS Secrets Manager `ansible/staging`
- **Production**: Stored in HashiCorp Vault `secret/ansible/prod`

Contact: devops@example.com for access

# Development
ansible-playbook site.yml --vault-id dev@prompt

# Production
ansible-playbook site.yml --vault-id prod@~/.vault_passwords/prod.txt

ERROR! Decryption failed (no vault secrets were found that could decrypt)

# Verify password
ansible-vault view vars/secrets.yml

# Nếu quên password, không thể recover!
# Phải tạo file mới

ERROR! vars/secrets.yml is not encrypted

ansible-vault encrypt vars/secrets.yml

ERROR! Attempted to get a vault password by ID (prod) but no vault password was found for that ID

# Ensure vault ID exists
ansible-playbook site.yml \
  --vault-id dev@~/.vault_passwords/dev.txt \
  --vault-id prod@~/.vault_passwords/prod.txt

# .gitlab-ci.yml
deploy:
  stage: deploy
  script:
    - echo "$VAULT_PASSWORD" > .vault_pass
    - chmod 600 .vault_pass
    - ansible-playbook deploy.yml --vault-password-file .vault_pass
  after_script:
    - rm -f .vault_pass  # Cleanup
  only:
    - main

# .github/workflows/deploy.yml
name: Deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Setup Ansible
        run: pip install ansible
      
      - name: Create vault password file
        run: echo "${{ secrets.VAULT_PASSWORD }}" > .vault_pass
      
      - name: Run playbook
        run: ansible-playbook deploy.yml --vault-password-file .vault_pass
      
      - name: Cleanup
        if: always()
        run: rm -f .vault_pass

// Jenkinsfile
pipeline {
    agent any
    
    environment {
        VAULT_PASS = credentials('ansible-vault-password')
    }
    
    stages {
        stage('Deploy') {
            steps {
                sh '''
                    echo "$VAULT_PASS" > .vault_pass
                    chmod 600 .vault_pass
                    ansible-playbook deploy.yml --vault-password-file .vault_pass
                    rm -f .vault_pass
                '''
            }
        }
    }
}