{"id":20155289,"url":"https://github.com/redhat-cop/ansible_rekey_variables","last_synced_at":"2026-07-04T06:32:19.657Z","repository":{"id":215250851,"uuid":"731227624","full_name":"redhat-cop/ansible_rekey_variables","owner":"redhat-cop","description":"It is a collection for managing vaulted Ansible inventories. It helps to rekey all encrypted variables in the inventory repository. Can also be used to encrypt variables from clear text.","archived":false,"fork":false,"pushed_at":"2024-07-29T15:46:57.000Z","size":105,"stargazers_count":4,"open_issues_count":5,"forks_count":1,"subscribers_count":16,"default_branch":"main","last_synced_at":"2026-01-30T17:59:25.824Z","etag":null,"topics":["aap","ansible","credentials","encrypt","rekey","variable","vault"],"latest_commit_sha":null,"homepage":"https://github.com/AliAkkaya7/ansible_rekey_variables/blob/main/README.md","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/redhat-cop.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":".github/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS.md","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-12-13T16:01:34.000Z","updated_at":"2025-10-29T12:53:22.000Z","dependencies_parsed_at":"2024-01-03T11:47:43.072Z","dependency_job_id":"889dede9-a1b7-444f-835a-ab6a9bbbb550","html_url":"https://github.com/redhat-cop/ansible_rekey_variables","commit_stats":null,"previous_names":["aliakkaya7/ansible_rekey_variables","redhat-cop/ansible_rekey_variables"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/redhat-cop/ansible_rekey_variables","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-cop%2Fansible_rekey_variables","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-cop%2Fansible_rekey_variables/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-cop%2Fansible_rekey_variables/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-cop%2Fansible_rekey_variables/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/redhat-cop","download_url":"https://codeload.github.com/redhat-cop/ansible_rekey_variables/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-cop%2Fansible_rekey_variables/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35112705,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-04T02:00:05.987Z","response_time":113,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aap","ansible","credentials","encrypt","rekey","variable","vault"],"created_at":"2024-11-13T23:31:22.348Z","updated_at":"2026-07-04T06:32:19.641Z","avatar_url":"https://github.com/redhat-cop.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Ansible Rekey Encrypted Variables\n\nThere are options that you can encrypt the file or variables itself in Ansible vault. When the file is encrypted all variables will be part of it. Encryption variables allow you to have this encryption for each variable that has sensitive content. It is not easy to rekey all encryption variables while encrypt_string does not have this option. This collection will help you during the rotation of the vault password and re-encrypt the variables.\n\n## Use case of ansible_rekey_variables\n\nIt is a collection for managing vaulted Ansible inventories. It helps to rekey all encrypted variables in the inventory repository. Can also be used to encrypt variables from clear text. Thus, without having to encrypt each variable separately, it does this for you in the file where the variable is located.\n\nWe demonstrate in this document how to run this collection locally. Don't forget, this role also can be part of a pipeline or run from Ansible Automation Platform. This pipeline / AAP template also can create the Pull Request that includes all the changes.\n\n### Information for Encrypted Variables\n\nWhile `ansible-vault` has a rekey option to change the vault password, `ansible-vault encrypt_string` doesn't have an option. The goal of this collection is to automate changing vault passwords for all encrypted variables under the inventory group_vars and host_vars.\n\nMore details can be found in this [link](https://docs.ansible.com/ansible/latest/user_guide/vault.html#creating-encrypted-variables) on encrypted variables.\n\n### Example for encrypted variable\n\n----\nSimply run the command below for the variable you want to encrypt, then enter the new vault password. You can use this output in your inventory to store variables as encrypted.\n\n````bash\n----\n#$ ansible-vault encrypt_string '\u003cPut the Password here\u003e' --name 'aap_admin_password'\nNew Vault password:\nConfirm New Vault password:\naap_admin_password: !vault |\n          $ANSIBLE_VAULT;1.1;AES256\n          30626132326231383238356635353339313136353137333864626365636537303930303464633035\n          3536646163396235623035396262663662643762333061340a313435633034373439653638396264\n          36613135326136643866363039363966333164333862633335303661373033333733623361666630\n          6335386436363731640a306635666261356131393031383266333361623633303064303063323835\n          3433\nEncryption successful\n----\n````\n\n## Prerequisites\n\n* Ansible version 2.14+ should be available locally. Ansible-core package installation is enough.\n* Inventory repositories that hold the encrypted variables should be cloned to the local directory before performing the vault password change.\n* Git also should be available on your local command line.\n\n\n## Requirements\n\nThe following package is required to use this collection.\n\n| Name             | Minimum Version |\n|------------------|:---------------:|\n| ansible-core     | 2.14+            |\n\n\n## Installation\n\nYou should install this collection on your local environment.\n\n````bash\n\nansible-galaxy collection install aliakkaya7.ansible_rekey_variables\n\n````\n\n### Role Variables\n\nRole variables are defined in [defaults/main.yml](defaults/main.yml).\n\n  * `rekey_variable_vault_file_patterns`: It will search in the inventory file for this regex. You can change it if you have different file naming convention.\n\nBasically, ``rekey_variable_new_vault_password`` and ``rekey_variable_inventory_repo_name`` should be defined to be able to change the vault password.\n\n### Role Tags\n\nThis role accepts the following tags to customize which part of the deployment is executed.\n\n* aap_vault_change\n* aap_post_tasks\n\n## Inventory Repository\n\nClone the inventory repository to your local directory.\n\n````bash\ngit clone \u003cinventory_repository\u003e\n````\n\n### Example for Encrypted Variables in inventory repository\n\nThese variables are stored in vault_ prefix named files.\n\n```\nmy_username: !vault |\n          $ANSIBLE_VAULT;1.1;AES256\n          32326637336636383161643138323532376466633661343039313733643835613930333965343638\n          3331323838646363363437666638353634383431613836610a316566663564333432336561666635\n          36663565646635366261353137316561623036393530346532373866643130353561623730373463\n          6533393861333734340a396439323535353338623333393836623832396431373162653066386164\n          6434\nmy_password: !vault |\n          $ANSIBLE_VAULT;1.1;AES256\n          62623139623035303335643634356536373464353063656264353262346464656231386661343034\n          3438343838373062633666396438613632393237633063660a653432633763373736343734613762\n          62386338356333363061626165633138346262643239376332623065663863373166363935363838\n          6534383737633732340a636234643235656263666634396138636665306663633338393439353132\n          3535\nmy_key_passphrase: !vault |\n          $ANSIBLE_VAULT;1.1;AES256\n          32623236633233646331376661633733653232356636646562663630333639366362666534333132\n          3434383633393962393131326535373635393834366238330a373731656365613962643633323863\n          39613036666635643664326437623534353437663031633733303666393730643064663365633236\n          3133626231353536390a363439623330636130316362376638623236623563323337643664626330\n          6366\n```\n\n## How to run the playbook\n\nThis test.yml can be tested in the tests directory.\n\n### Example Playbook\n\n```yaml\n---\n- name: Change vault password for all encrypted variables in Roles\n  hosts: localhost\n  connection: local\n  gather_facts: false\n  tasks:\n    - name: Replace encryption key for encrypted variables\n      ansible.builtin.include_role:\n        name: aliakkaya7.ansible_rekey_variables.rekey_variable\n      when:\n        - rekey_variable_vault_change | default('true') | bool\n      tags: aap_vault_change\n```\n\n### Run the playbook locally\n\nAn option such as ``--vault-id new_vault_password@prompt`` can be passed while running the playbook. It will prompt for a new vault password, and a new password can be entered. This prevents variables from being decrypted during the rerun if the playbook was interrupted during the previous run. If it is interrupted, some variables may be rekeyed with the new variables and some may remain with the old encryption key.\n\n**Note** : The encryption password for the encrypted test variables is `test`\n\n````bash\nansible-playbook test.yml -i example-inventory-repo --ask-vault-pass  -e rekey_variable_new_vault_password=test12 \\\n-e rekey_variable_inventory_repo_name=example-inventory-repo --vault-id new_vault_password@prompt\n````\n\n### How to check the variables with new key\n\nThese variables are stored in vault_ prefix named files.After the rekey variables are completed you can test to view the encrypted variables with the new vault password. You just need to point the file and encrypted variable as shown in the below command.\n\nDESCRIPTION\n````bash\nansible localhost -m ansible.builtin.debug -a var=\"rekey_variable_encrypted_var1\" \\\n-e \"@example-inventory-repo/group_vars/aap/vault_test_data.yml\" --ask-vault-pass\nVault password:\nlocalhost | SUCCESS =\u003e\n    \"encrypted_var1\": \"test1\"\n````\n\nIt can be tested with the debug module as described in this [example](https://docs.ansible.com/ansible/latest/user_guide/vault.html#viewing-encrypted-variables).\n\n## Releasing, Versioning and Deprecation\n\nThis collection follows [Semantic Versioning](https://semver.org/). More details on versioning can be found [in the Ansible docs](https://docs.ansible.com/ansible/latest/dev_guide/developing_collections.html#collection-versions).\n\nWe plan to regularly release new minor or bugfix versions once new features or bugfixes have been implemented.\n\nReleasing the current major version happens from the `main` branch.\n\n## Contributing to this collection\n\nWe welcome community contributions to this collection.\nMore information about contributing can be found in our [Contribution Guidelines.](https://github.com/AliAkkaya7/ansible_rekey_variables/blob/main/CONTRIBUTING.md)\n\n## License\nGNU General Public License (https://www.gnu.org/licenses/gpl-3.0.en.html#license-text)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fredhat-cop%2Fansible_rekey_variables","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fredhat-cop%2Fansible_rekey_variables","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fredhat-cop%2Fansible_rekey_variables/lists"}