{"id":130,"date":"2025-06-23T12:52:08","date_gmt":"2025-06-23T10:52:08","guid":{"rendered":"https:\/\/blog.cp2i.com\/?p=130"},"modified":"2025-10-05T01:54:14","modified_gmt":"2025-10-04T23:54:14","slug":"edition-de-secrets-ansible-vault-avec-des-cles-lisibles","status":"publish","type":"post","link":"https:\/\/blog.cp2i.com\/index.php\/2025\/06\/23\/edition-de-secrets-ansible-vault-avec-des-cles-lisibles\/","title":{"rendered":"Edition de secrets Ansible Vault avec des cl\u00e9s lisibles"},"content":{"rendered":"\n<p>Dans cet article, je vous pr\u00e9senterai un outil TRES pratique pour \u00e9diter des secrets obfusqu\u00e9s par ansible-vault.<\/p>\n\n\n\n<p>Nous avons deux possibilit\u00e9s avec Ansible pour g\u00e9rer des secrets:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Obfusquer l&rsquo;int\u00e9gralit\u00e9 du fichier (cl\u00e9s et valeurs)<\/li>\n\n\n\n<li>Obfusquer uniquement la valeur, et laisser la cl\u00e9 lisible<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Obfusquer le fichier entier<\/h3>\n\n\n\n<p>Dans ce cas, c&rsquo;est tr\u00e8s simple. On prend un fichier, on saisit le contenu, et une fois le param\u00e9trage fait pour le mot de passe de chiffrement on utilise la commande:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-1\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-tag\">korogoth<\/span><span class=\"hljs-keyword\">@korosrv<\/span> ~: echo <span class=\"hljs-string\">\"foo: bar\"<\/span> &gt; mon_fichier_secret.yml\nkorogoth@korosrv ~: ansible-vault encrypt mon_fichier_secret.yml<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-1\"><span class=\"shcb-language__label\">Langage du code\u00a0:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>C&rsquo;est facile, mais d\u00e8s lors, on ne peut plus voir les cl\u00e9s YAML, car le contenu ressemble \u00e0 ceci:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-2\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-tag\">korogoth<\/span><span class=\"hljs-keyword\">@korosrv<\/span> ~: cat mon_fichier_secret.yml\n$ANSIBLE_VAULT;1<span class=\"hljs-selector-class\">.1<\/span>;<span class=\"hljs-selector-tag\">AES256<\/span>\n61663861633532356133666366666462623834616166303730376233646666353338353236313737\n3164613037633861646162636330316462306537336334650<span class=\"hljs-selector-tag\">a376364653463306534333335656534<\/span>\n36643334643436613666326230366464653864643861336262326434643534323063393462323831\n6431373231383262380<span class=\"hljs-selector-tag\">a653261366164333134626530633562613932623966636563306663633839<\/span>\n3730<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-2\"><span class=\"shcb-language__label\">Langage du code\u00a0:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>Du coup, on ne peut pas transmettre un fichier tel quel pour une personne qui devrait conna\u00eetre les cl\u00e9s du fichier mais pas les valeurs afin de cr\u00e9er leur propre fichier.<\/p>\n\n\n\n<p>Pour cela on va choisir d&rsquo;obfusquer uniquement les valeurs<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Obfusquer les valeurs uniquement<\/h3>\n\n\n\n<p>Dans ce cas, on utilisera une autre commande:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-3\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-tag\">korogoth<\/span><span class=\"hljs-keyword\">@korosrv<\/span> ~: ansible-vault encrypt_string --name foo bar &gt; mon_fichier_secret.yml<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-3\"><span class=\"shcb-language__label\">Langage du code\u00a0:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>Vous aurez donc ceci dans le fichier:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-4\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-tag\">korogoth<\/span><span class=\"hljs-keyword\">@korosrv<\/span> ~: cat mon_fichier_secret.yml\n<span class=\"hljs-attribute\">foo:<\/span> !vault |\n          $ANSIBLE_VAULT;1<span class=\"hljs-selector-class\">.1<\/span>;<span class=\"hljs-selector-tag\">AES256<\/span>\n          37316333303436306463633439393336353834346131343037323064356163383839356564393133\n          3839623665663732313564653265346136323135323931620<span class=\"hljs-selector-tag\">a656439303663353963666661653033<\/span>\n          35353661623437383136626463626130653833646138633532303331323061623431353462383665\n          6136643731336631630<span class=\"hljs-selector-tag\">a663064616539356630376362353830653336616435396530663137373761<\/span>\n          3633<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-4\"><span class=\"shcb-language__label\">Langage du code\u00a0:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>Mais en revanche, il sera impossible d&rsquo;ouvrir ce fichier \u00e0 nouveau pour l&rsquo;\u00e9diter avec ansible-vault<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-5\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-tag\">korogoth<\/span><span class=\"hljs-keyword\">@korosrv<\/span> ~: ansible-vault edit mon_fichier_secret.yml\n&#91;WARNING]:\nThere was a vault format <span class=\"hljs-attribute\">error:<\/span> Vault format unhexlify <span class=\"hljs-attribute\">error:<\/span> Non-hexadecimal digit found\nERROR! Vault format unhexlify <span class=\"hljs-attribute\">error:<\/span> Non-hexadecimal digit found for \/home\/korogoth\/mon_fichier_secret.yml<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-5\"><span class=\"shcb-language__label\">Langage du code\u00a0:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>Vous aurez besoin pour cela d&rsquo;utiliser un outil fabuleux, nomm\u00e9 <a href=\"https:\/\/github.com\/oveee92\/vaulti\">vaulti<\/a>. Cet outil permet d&rsquo;ouvrir en mode \u00e9dition des fichiers qui ont des parties vault\u00e9es et des parties lisibles.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-6\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-tag\">korogoth<\/span><span class=\"hljs-keyword\">@korosrv<\/span> ~: vaulti mon_fichier_secret.yml\n---\n<span class=\"hljs-attribute\">foo:<\/span> !ENCRYPT bar\n...<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-6\"><span class=\"shcb-language__label\">Langage du code\u00a0:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>Vous pourrez rajouter des lignes \u00e0 ce fichier, et pr\u00e9fixer les parties \u00e0 obfusquer par <strong>!ENCRYPT<\/strong> pour indiquer \u00e0 <em>vaulti<\/em> qu&rsquo;il faut utiliser \u00e0 cet endroit pr\u00e9cis la commande <em>ansible-vault encrypt_string<\/em>.<\/p>\n\n\n\n<p>Pratique hein ?<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Dans cet article, je vous pr\u00e9senterai un outil TRES pratique pour \u00e9diter des secrets obfusqu\u00e9s par ansible-vault. Nous avons deux possibilit\u00e9s avec Ansible pour g\u00e9rer des secrets: Obfusquer le fichier entier Dans ce cas, c&rsquo;est tr\u00e8s simple. On prend un fichier, on saisit le contenu, et une fois le param\u00e9trage fait pour le mot de [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_regular_price":[],"currency_symbol":[],"footnotes":""},"categories":[18],"tags":[],"class_list":["post-130","post","type-post","status-publish","format-standard","hentry","category-ansible"],"post_slider_layout_featured_media_urls":{"thumbnail":"","post_slider_layout_landscape_large":"","post_slider_layout_portrait_large":"","post_slider_layout_square_large":"","post_slider_layout_landscape":"","post_slider_layout_portrait":"","post_slider_layout_square":"","full":""},"_links":{"self":[{"href":"https:\/\/blog.cp2i.com\/index.php\/wp-json\/wp\/v2\/posts\/130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.cp2i.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.cp2i.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.cp2i.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.cp2i.com\/index.php\/wp-json\/wp\/v2\/comments?post=130"}],"version-history":[{"count":4,"href":"https:\/\/blog.cp2i.com\/index.php\/wp-json\/wp\/v2\/posts\/130\/revisions"}],"predecessor-version":[{"id":138,"href":"https:\/\/blog.cp2i.com\/index.php\/wp-json\/wp\/v2\/posts\/130\/revisions\/138"}],"wp:attachment":[{"href":"https:\/\/blog.cp2i.com\/index.php\/wp-json\/wp\/v2\/media?parent=130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.cp2i.com\/index.php\/wp-json\/wp\/v2\/categories?post=130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.cp2i.com\/index.php\/wp-json\/wp\/v2\/tags?post=130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}