RHCE 9.0 Practice Exam: Updating Ansible Vault Encryption Key

CloudNetOps

CloudNetOps

— 3 min read
Expertise in Cloud, Networking & DevOps
Photo by Marc PEZIN / Unsplash

📌 Introduction

In this RHCE 9.0 Ansible exam practice guide, we will update the encryption key of an existing Ansible Vault. Rekeying an Ansible Vault allows us to rotate encryption keys securely while maintaining data confidentiality.

This guide includes:

  • How to download and encrypt an Ansible Vault file
  • How to update an existing Ansible Vault password
  • How to verify the rekeyed vault
  • How to troubleshoot common vault password issues

💡 What You Will Learn

✅ How to download an encrypted Ansible Vault file
✅ How to rekey an existing Ansible Vault using ansible-vault rekey
✅ How to verify that the new password works correctly
✅ How to troubleshoot Ansible Vault encryption issues

📜 1. Task Requirements

📍 1.1. Problem Statement

  1. Download an Ansible Vault file (salaries.yml) from http://classroom/materials/salaries.yml and save it in /home/greg/ansible/.
  2. The current vault password is insecure8sure.
  3. The new vault password should be updated to bbs2you9527.
  4. The Vault must remain encrypted after the password change.
  5. Verify that the new password works by attempting to decrypt the file.

📜 2. Download the Encrypted Vault File

$ wget http://classroom/materials/salaries.yml -O /home/greg/ansible/salaries.yml

📌 Explanation:

  • Downloads the existing Ansible Vault file from the classroom materials.
  • Saves it as salaries.yml in the Ansible working directory.

📜 3. Updating the Vault Password (Rekeying)

📍 3.1. Rekey the Vault Using ansible-vault rekey

$ ansible-vault rekey --ask-vault-pass /home/greg/ansible/salaries.yml

📌 Expected Prompt & Input:

Vault password: insecure8sure
New Vault password: bbs2you9527
Confirm New Vault password: bbs2you9527
Rekey successful

📌 Explanation:

  • --ask-vault-pass → Prompts for the current vault password.
  • User enters the existing password (insecure8sure).
  • User enters the new password (bbs2you9527) twice to confirm.
  • The Vault remains encrypted, but now uses the new password.

📜 4. Verifying the New Vault Password

📍 4.1. Attempt to View the File with the New Password

$ ansible-vault view --ask-vault-pass /home/greg/ansible/salaries.yml

📌 Expected Prompt & Input:

Vault password: bbs2you9527

📌 Expected Output:

haha

✅ The vault was successfully decrypted using the new password.

📜 5. Automating Vault Password Usage

To avoid manually entering the vault password, store it in a password file.

📍 5.1. Save the New Vault Password in a File

$ echo bbs2you9527 > /home/greg/ansible/new_secret.txt
$ chmod 600 /home/greg/ansible/new_secret.txt

📌 Explanation:

  • The vault password is saved to new_secret.txt.
  • chmod 600 restricts access to the file so only the owner can read and write.

📍 5.2. Configure ansible.cfg to Use the Password File

$ vim /home/greg/ansible/ansible.cfg

📌 Add the following content:

[defaults]
vault_password_file = /home/greg/ansible/new_secret.txt

📌 Now, Ansible Vault commands will automatically use the stored password.

📜 6. Running Ansible Vault Commands with the New Password

📍 6.1. Verify Vault Decryption Without Password Prompt

$ ansible-vault view /home/greg/ansible/salaries.yml

📌 Expected Output (without entering a password manually):

haha

✅ Vault decryption now works automatically using the password file.

📜 7. Common Issues & Troubleshooting

🔴 Issue 1: ERROR! Decryption failed

✅ Solution:

If the file is corrupted, try re-encrypting it:

$ ansible-vault encrypt /home/greg/ansible/salaries.yml

Manually specify the password file:

$ ansible-vault view /home/greg/ansible/salaries.yml --vault-password-file=/home/greg/ansible/new_secret.txt

Verify that you are using the correct password:

$ cat /home/greg/ansible/new_secret.txt

🔴 Issue 2: Ansible Vault Password File Not Working

✅ Solution:

Ensure the password file has the correct permissions:

$ chmod 600 /home/greg/ansible/new_secret.txt

Ensure that ansible.cfg includes the correct vault password file:

[defaults]
vault_password_file = /home/greg/ansible/new_secret.txt

🔴 Issue 3: Rekey Operation Fails

✅ Solution:

  • Ensure you are entering the correct current password.

Ensure the vault file exists:

$ ls -l /home/greg/ansible/salaries.yml

📜 8. Summary

  • Downloaded an existing Ansible Vault file (salaries.yml).
  • Used ansible-vault rekey to update the Vault password from insecure8sure to bbs2you9527.
  • Verified that the new password worked by decrypting the file.
  • Automated the Vault password handling using a password file (new_secret.txt).
  • Troubleshot common encryption and decryption errors.

🚀 Congratulations! You have successfully updated the encryption key for an Ansible Vault in RHCE 9.0! 🚀
📢 If you found this guide helpful, share it with your RHCE 9.0 study group! 📢

🔥 Good luck on your RHCE 9.0 exam! 🔥

Read more