What problem does Ansible Vault solve, and what can it encrypt?
Playbooks often need secrets (passwords, API keys, private keys). In plain-text variable files, anyone with access to the files or the Git repository can read them. Ansible Vault, built into Ansible, encrypts any data file Ansible reads, so the secrets can be committed and shared safely.
Things Vault can encrypt:
- inventory variable files (
group_vars/…,host_vars/…) - variable files loaded with
vars_files - variable files passed on the command line (
-e @secrets.yml) - variables defined in roles
You manage these files with the command-line tool ansible-vault, which can create, edit, encrypt, decrypt and view them. At run time Ansible decrypts the files in memory, once you give it the vault password; the decrypted content is never written to disk.
The point is that you don't need a separate secrets store just to keep a database password out of Git: the encrypted file lives right next to the playbook and is versioned with it.
Go deeper:
Protecting sensitive data with Ansible Vault (official docs) — the full Vault guide.
Ansible 101, Episode 6: Ansible Vault and Roles (Jeff Geerling) — encrypting a vars file and running with it.