Introduction
Ansible Vault encrypts sensitive variables so they can be stored with playbooks without exposing plaintext secrets. A playbook can use the value only when you provide a valid vault password.
In this lab, you will create an encrypted variable, observe the failure when the password is missing, and run a playbook successfully with a vault password file.
Create a Vault Practice Project
In this step, you will create a project with an inventory, group variable directory, playbook directory, and reports directory.
cd /home/labex/project
mkdir -p rhce-ansible/{inventory/group_vars/managed,playbooks,managed,reports}
cd rhce-ansible
cat > ansible.cfg <<'EOF'
[defaults]
inventory = ./inventory/hosts
host_key_checking = False
retry_files_enabled = False
EOF
cat > inventory/hosts <<'EOF'
[managed]
host ansible_connection=local
EOF
The encrypted variable will live under inventory/group_vars/managed, so it loads for the managed group like any other variable file. The difference is that Ansible must decrypt it before use.
Create a Vault Password File
In this step, you will create a password file for lab automation. In real work, protect this file carefully or use a prompt-based workflow. Before running commands in this step, return to the Ansible project directory. This keeps the commands stable even when LabEx runs each step separately.
cd /home/labex/project/rhce-ansible
cat > vault_pass.txt <<'EOF'
labex-vault-pass
EOF
chmod 600 vault_pass.txt
This password file is for the lab workflow only. The chmod 600 mode means only the owner can read and write it, which is the minimum habit to practice when a file can unlock secrets.
ls -l vault_pass.txt
Look for permissions similar to -rw-------. If the file is readable by group or other users, rerun the chmod 600 command.
Create an Encrypted Variable
In this step, you will use ansible-vault encrypt_string to create an encrypted variable named app_secret. The encrypted file can be loaded like any other group variable file.
Before running commands in this step, return to the Ansible project directory. This keeps the commands stable even when LabEx runs each step separately.
cd /home/labex/project/rhce-ansible
ansible-vault encrypt_string --vault-password-file vault_pass.txt 'redhat' --name app_secret > inventory/group_vars/managed/vault.yml
The command writes an encrypted YAML variable named app_secret. The variable name remains readable, but the value redhat is stored inside a Vault block.
sed -n "1,8p" inventory/group_vars/managed/vault.yml
The file should show app_secret: !vault and an $ANSIBLE_VAULT; header. You should not see the plaintext secret in this file.
Write a Playbook that Uses the Secret
In this step, you will write a playbook that references app_secret. Without the vault password, Ansible cannot decrypt this variable.
Before running commands in this step, return to the Ansible project directory. This keeps the commands stable even when LabEx runs each step separately.
cd /home/labex/project/rhce-ansible
cat > playbooks/use-vault.yml <<'EOF'
---
- name: Use an encrypted variable
hosts: managed
gather_facts: false
tasks:
- name: Write secret-derived file
ansible.builtin.copy:
dest: /home/labex/project/rhce-ansible/managed/secret.txt
content: |
secret={{ app_secret }}
mode: '0600'
EOF
The playbook uses app_secret like a normal variable. That is the point of Vault: playbook logic can stay clean while the sensitive value remains encrypted at rest.
ansible-playbook playbooks/use-vault.yml > reports/vault-missing.txt 2>&1 || true
This run is expected to fail because no vault password was provided. The output is redirected to a report so you can inspect the failure without stopping the lab.
grep -Ei "vault|decrypt|password|secret" reports/vault-missing.txt
The filtered error should mention Vault, decryption, password, or the secret. Also notice that the verification expects no managed/secret.txt file yet.
Run the Playbook with the Vault Password
In this step, you will provide the vault password file so Ansible can decrypt the variable and write the protected output file. Before running commands in this step, return to the Ansible project directory. This keeps the commands stable even when LabEx runs each step separately.
cd /home/labex/project/rhce-ansible
ansible-playbook playbooks/use-vault.yml --vault-password-file vault_pass.txt | tee reports/vault-run.txt
Now Ansible can decrypt app_secret and pass the plaintext value to the copy task at runtime. The encrypted file on disk remains encrypted.
sudo ls -l managed/secret.txt && cat managed/secret.txt
The file should have mode 600 and contain secret=redhat. That proves the playbook used the decrypted value while still protecting the generated secret file.
Summary
You created a Vault-encrypted variable, observed that the playbook cannot use it without a password, then ran the playbook with a vault password file to decrypt and apply the secret.
