# Apply an vault encrypted secret.yaml on a k3s cluster

**URL:** <https://forum.ansible.com/t/apply-an-vault-encrypted-secret-yaml-on-a-k3s-cluster/5963>\
**Category:** Get Help\
**Tags:** kubernetes, ansible-vault, playbook\
**Created:** [May 23, 2024, 4:01pm UTC](https://forum.ansible.com/t/apply-an-vault-encrypted-secret-yaml-on-a-k3s-cluster/5963 "2024-05-23T16:01:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lance\_Lyons](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lance_lyons/32/2894_2.png) [@Lance\_Lyons](https://forum.ansible.com/u/Lance_Lyons)\
**Post date:** [May 23, 2024, 4:01pm UTC](https://forum.ansible.com/t/apply-an-vault-encrypted-secret-yaml-on-a-k3s-cluster/5963/1 "2024-05-23T16:01:44Z")

</div>

I have a kubernetes secret that has been encrypted by ansible-vault such that secret.yml is encrypted so if checked in, it wont be in plain text.

I would like to do a command on the k3s node to apply the decrypted secret.yml but the ansible-vault tool only exists on the machine with the playbook scripts

```auto
kubectl apply -f (decrypted secret.yml)

```

for other instances of doing kubectl apply -f someyamlfile.yaml, I would first copy that file over to the node and do the kubectl apply -f on the node

how would i decrypt on the server with ansible-vault / runbooks but do the kubectl apply -f decryptedsecret.yaml

thanks in advance

---

<div class="post-metadata">

**Author:** ![Lance\_Lyons](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lance_lyons/32/2894_2.png) [@Lance\_Lyons](https://forum.ansible.com/u/Lance_Lyons)\
**Post date:** [May 28, 2024, 10:00pm UTC](https://forum.ansible.com/t/apply-an-vault-encrypted-secret-yaml-on-a-k3s-cluster/5963/2 "2024-05-28T22:00:38Z")

</div>

Is there a way to unencrypt the secret.yml on the server side and then apply the unencrypted secret during the playbook run where the unencrypted secret is never directly stored on disk space?

---

<div class="post-metadata">

**Author:** ![ptn](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ptn/32/481_2.png) [@ptn](https://forum.ansible.com/u/ptn)\
**Post date:** [May 29, 2024, 6:27am UTC](https://forum.ansible.com/t/apply-an-vault-encrypted-secret-yaml-on-a-k3s-cluster/5963/3 "2024-05-29T06:27:06Z")

</div>

Hi,

Sure, you can [delegate tasks](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_delegation.html#delegating-tasks) to localhost.

You could also use [unvault lookup plugin](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/unvault_lookup.html) (for instance) to get your encrypted file content that you could pass to kubectl, [k8s module](https://docs.ansible.com/ansible/latest/collections/kubernetes/core/k8s_module.html) or else.