Blog · topic
Vault, ansible-vault and secrets in pipelines: storing, granting, rotating and not leaking credentials.
4 postsRSS feed
ansible-vault encrypts the file, not the output. How debug, verbose results and diffs leak a secret into CI logs, what no_log hides, and the cleanup order.
After a reboot every app that needs a secret fails with 503 Vault is sealed. Why Vault restarts sealed, how to unseal with key shares, and auto-unseal.
The policy says kv/reports/* and the token still gets a 403. KV v2 reads at kv/data/ and lists at kv/metadata/: how to read the URL, test the token and fix it.
The app renewed its Vault token and still died at 3 a.m.: renewal never passes the max TTL, and its leases die with it. How to read it, and the Vault Agent fix.