Best practices for using Ansible Vault: SSH keys and pushing Vault to Git?

Is it possible (and recommended) to also store SSH keys in Ansible Vault?

Yes. You can encrypt string values or entire files using vault.
On a more pedantic note, you don’t store things in Ansible Vault. Vault is just a command line tool used to encrypt or decrypt values. It is similar to encoding or decoding something with base64 (obviously, vault is more secure)

Is it safe to push a Vault-encrypted file to Git?

It uses AES256 for encryption. It is very secure; I think storing secrets in git was probably a big use case when they created it

2 Likes