# SOME DESCRIPTIVE TITLE.
# Copyright (C) Ansible project contributors
# This file is distributed under the same license as the Ansible package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2023.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: Ansible devel\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2022-10-05 09:34+0200\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=utf-8\n"
"Content-Transfer-Encoding: 8bit\n"
"Generated-By: Babel 2.9.0\n"

#: ../../rst/vault_guide/index.rst:5
msgid "Protecting sensitive data with Ansible vault"
msgstr ""

#: ../../rst/vault_guide/index.rst:9
msgid "**Making Open Source More Inclusive**"
msgstr ""

#: ../../rst/vault_guide/index.rst:11
msgid "Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. We ask that you open an issue or pull request if you come upon a term that we have missed. For more details, see `our CTO Chris Wright's message <https://www.redhat.com/en/blog/making-open-source-more-inclusive-eradicating-problematic-language>`_."
msgstr ""

#: ../../rst/vault_guide/index.rst:13
msgid "Welcome to the Ansible vault documentation. Ansible vault provides a way to encrypt and manage sensitive data such as passwords. This guide introduces you to Ansible vault and covers the following topics:"
msgstr ""

#: ../../rst/vault_guide/index.rst:17
msgid "Managing vault passwords."
msgstr ""

#: ../../rst/vault_guide/index.rst:18
msgid "Encrypting content and files with Ansible vault."
msgstr ""

#: ../../rst/vault_guide/index.rst:19
msgid "Using encrypted variables and files."
msgstr ""

#: ../../rst/vault_guide/vault.rst:5
msgid "Ansible Vault"
msgstr ""

#: ../../rst/vault_guide/vault.rst:7
msgid "Ansible Vault encrypts variables and files so you can protect sensitive content such as passwords or keys rather than leaving it visible as plaintext in playbooks or roles. To use Ansible Vault you need one or more passwords to encrypt and decrypt content. If you store your vault passwords in a third-party tool such as a secret manager, you need a script to access them. Use the passwords with the :ref:`ansible-vault` command-line tool to create and view encrypted variables, create encrypted files, encrypt existing files, or edit, re-key, or decrypt files. You can then place encrypted content under source control and share it more safely."
msgstr ""

#: ../../rst/vault_guide/vault.rst:14
msgid "Encryption with Ansible Vault ONLY protects 'data at rest'. Once the content is decrypted ('data in use'), play and plugin authors are responsible for avoiding any secret disclosure, see :ref:`no_log <keep_secret_data>` for details on hiding output and :ref:`vault_securing_editor` for security considerations on editors you use with Ansible Vault."
msgstr ""

#: ../../rst/vault_guide/vault.rst:17
msgid "You can use encrypted variables and files in ad hoc commands and playbooks by supplying the passwords you used to encrypt them. You can modify your ``ansible.cfg`` file to specify the location of a password file or to always prompt for the password."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:4
msgid "Encrypting content with Ansible Vault"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:6
msgid "Once you have a strategy for managing and storing vault passwords, you can start encrypting content. You can encrypt two types of content with Ansible Vault: variables and files. Encrypted content always includes the ``!vault`` tag, which tells Ansible and YAML that the content needs to be decrypted, and a ``|`` character, which allows multi-line strings. Encrypted content created with ``--vault-id`` also contains the vault ID label. For more details about the encryption process and the format of content encrypted with Ansible Vault, see :ref:`vault_format`. This table shows the main differences between encrypted variables and encrypted files:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:12
msgid "Encrypted variables"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:12
msgid "Encrypted files"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:14
msgid "How much is encrypted?"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:14
msgid "Variables within a plaintext file"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:14
msgid "The entire file"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:16
msgid "When is it decrypted?"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:16
msgid "On demand, only when needed"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:16
msgid "Whenever loaded or referenced [#f1]_"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:18
msgid "What can be encrypted?"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:18
msgid "Only variables"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:18
msgid "Any structured data file"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:22
msgid "Ansible cannot know if it needs content from an encrypted file unless it decrypts the file, so it decrypts all encrypted files referenced in your playbooks and roles."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:28
msgid "Encrypting individual variables with Ansible Vault"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:30
msgid "You can encrypt single values inside a YAML file using the :ref:`ansible-vault encrypt_string <ansible_vault_encrypt_string>` command. For one way to keep your vaulted variables safely visible, see :ref:`tip_for_variables_and_vaults`."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:33
msgid "Advantages and disadvantages of encrypting variables"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:35
msgid "With variable-level encryption, your files are still easily legible. You can mix plaintext and encrypted variables, even inline in a play or role. However, password rotation is not as simple as with file-level encryption. You cannot :ref:`rekey <rekeying_files>` encrypted variables. Also, variable-level encryption only works on variables. If you want to encrypt tasks or other content, you must encrypt the entire file."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:40
msgid "Creating encrypted variables"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:42
msgid "The :ref:`ansible-vault encrypt_string <ansible_vault_encrypt_string>` command encrypts and formats any string you type (or copy or generate) into a format that can be included in a playbook, role, or variables file. To create a basic encrypted variable, pass three options to the :ref:`ansible-vault encrypt_string <ansible_vault_encrypt_string>` command:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:44
msgid "a source for the vault password (prompt, file, or script, with or without a vault ID)"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:45
msgid "the string to encrypt"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:46
msgid "the string name (the name of the variable)"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:48
msgid "The pattern looks like this:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:54
msgid "For example, to encrypt the string 'foobar' using the only password stored in 'a_password_file' and name the variable 'the_secret':"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:60
#: ../../rst/vault_guide/vault_encrypting_content.rst:78
msgid "The command above creates this content:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:72
msgid "To encrypt the string 'foooodev', add the vault ID label 'dev' with the 'dev' vault password stored in 'a_password_file', and call the encrypted variable 'the_dev_secret':"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:90
msgid "To encrypt the string 'letmein' read from stdin, add the vault ID 'dev' using the 'dev' vault password stored in `a_password_file`, and name the variable 'db_password':"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:98
msgid "Typing secret content directly at the command line (without a prompt) leaves the secret string in your shell history. Do not do this outside of testing."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:100
msgid "The command above creates this output:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:113
msgid "To be prompted for a string to encrypt, encrypt it with the 'dev' vault password from 'a_password_file', name the variable 'new_user_password' and give it the vault ID label 'dev':"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:119
msgid "The command above triggers this prompt:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:125
msgid "Type the string to encrypt (for example, 'hunter2'), hit ctrl-d, and wait."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:129
msgid "Do not press ``Enter`` after supplying the string to encrypt. That will add a newline to the encrypted value."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:131
msgid "The sequence above creates this output:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:143
msgid "You can add the output from any of the examples above to any playbook, variables file, or role for future use. Encrypted variables are larger than plain-text variables, but they protect your sensitive content while leaving the rest of the playbook, variables file, or role in plain text so you can easily read it."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:146
msgid "Viewing encrypted variables"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:148
msgid "You can view the original value of an encrypted variable using the debug module. You must pass the password that was used to encrypt the variable. For example, if you stored the variable created by the last example above in a file called 'vars.yml', you could view the unencrypted value of that variable like this:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:160
msgid "Encrypting files with Ansible Vault"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:162
msgid "Ansible Vault can encrypt any structured data file used by Ansible, including:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:164
msgid "group variables files from inventory"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:165
msgid "host variables files from inventory"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:166
msgid "variables files passed to ansible-playbook with ``-e @file.yml`` or ``-e @file.json``"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:167
msgid "variables files loaded by ``include_vars`` or ``vars_files``"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:168
msgid "variables files in roles"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:169
msgid "defaults files in roles"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:170
msgid "tasks files"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:171
msgid "handlers files"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:172
msgid "binary files or other arbitrary files"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:174
msgid "The full file is encrypted in the vault."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:178
msgid "Ansible Vault uses an editor to create or modify encrypted files. See :ref:`vault_securing_editor` for some guidance on securing the editor."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:182
msgid "Advantages and disadvantages of encrypting files"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:184
msgid "File-level encryption is easy to use. Password rotation for encrypted files is straightforward with the :ref:`rekey <rekeying_files>` command. Encrypting files can hide not only sensitive values, but the names of the variables you use. However, with file-level encryption the contents of files are no longer easy to access and read. This may be a problem with encrypted tasks files. When encrypting a variables file, see :ref:`tip_for_variables_and_vaults` for one way to keep references to these variables in a non-encrypted file. Ansible always decrypts the entire encrypted file when it is when loaded or referenced, because Ansible cannot know if it needs the content unless it decrypts it."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:189
msgid "Creating encrypted files"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:191
msgid "To create a new encrypted data file called 'foo.yml' with the 'test' vault password from 'multi_password_file':"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:197
msgid "The tool launches an editor (whatever editor you have defined with $EDITOR, default editor is vi). Add the content. When you close the editor session, the file is saved as encrypted data. The file header reflects the vault ID used to create it:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:203
msgid "To create a new encrypted data file with the vault ID 'my_new_password' assigned to it and be prompted for the password:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:209
msgid "Again, add content to the file in the editor and save. Be sure to store the new password you created at the prompt, so you can find it when you want to decrypt that file."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:214
msgid "Encrypting existing files"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:216
msgid "To encrypt an existing file, use the :ref:`ansible-vault encrypt <ansible_vault_encrypt>` command. This command can operate on multiple files at once. For example:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:222
msgid "To encrypt existing files with the 'project' ID and be prompted for the password:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:232
msgid "Viewing encrypted files"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:234
msgid "To view the contents of an encrypted file without editing it, you can use the :ref:`ansible-vault view <ansible_vault_view>` command:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:244
msgid "Editing encrypted files"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:246
msgid "To edit an encrypted file in place, use the :ref:`ansible-vault edit <ansible_vault_edit>` command. This command decrypts the file to a temporary file, allows you to edit the content, then saves and re-encrypts the content and removes the temporary file when you close the editor. For example:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:252
msgid "To edit a file encrypted with the ``vault2`` password file and assigned the vault ID ``pass2``:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:262
msgid "Changing the password and/or vault ID on encrypted files"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:264
msgid "To change the password on an encrypted file or files, use the :ref:`rekey <ansible_vault_rekey>` command:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:270
msgid "This command can rekey multiple data files at once and will ask for the original password and also the new password. To set a different ID for the rekeyed files, pass the new ID to ``--new-vault-id``. For example, to rekey a list of files encrypted with the 'preprod1' vault ID from the 'ppold' file to the 'preprod2' vault ID and be prompted for the new password:"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:280
msgid "Decrypting encrypted files"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:282
msgid "If you have an encrypted file that you no longer want to keep encrypted, you can permanently decrypt it by running the :ref:`ansible-vault decrypt <ansible_vault_decrypt>` command. This command will save the file unencrypted to the disk, so be sure you do not want to :ref:`edit <ansible_vault_edit>` it instead."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:292
msgid "Steps to secure your editor"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:294
msgid "Ansible Vault relies on your configured editor, which can be a source of disclosures. Most editors have ways to prevent loss of data, but these normally rely on extra plain text files that can have a clear text copy of your secrets. Consult your editor documentation to configure the editor to avoid disclosing secure data. The following sections provide some guidance on common editors but should not be taken as a complete guide to securing your editor."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:298
msgid "vim"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:300
msgid "You can set the following ``vim`` options in command mode to avoid cases of disclosure. There may be more settings you need to modify to ensure security, especially when using plugins, so consult the ``vim`` documentation."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:303
msgid "Disable swapfiles that act like an autosave in case of crash or interruption."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:309
#: ../../rst/vault_guide/vault_encrypting_content.rst:343
msgid "Disable creation of backup files."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:316
msgid "Disable the viminfo file from copying data from your current session."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:322
msgid "Disable copying to the system clipboard."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:329
msgid "You can optionally add these settings in ``.vimrc`` for all files, or just specific paths or extensions. See the ``vim`` manual for details."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:333
msgid "Emacs"
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:335
msgid "You can set the following Emacs options to avoid cases of disclosure. There may be more settings you need to modify to ensure security, especially when using plugins, so consult the Emacs documentation."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:337
msgid "Do not copy data to the system clipboard."
msgstr ""

#: ../../rst/vault_guide/vault_encrypting_content.rst:349
msgid "Disable autosave files."
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:4
msgid "Managing vault passwords"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:6
msgid "Managing your encrypted content is easier if you develop a strategy for managing your vault passwords. A vault password can be any string you choose. There is no special command to create a vault password. However, you need to keep track of your vault passwords. Each time you encrypt a variable or file with Ansible Vault, you must provide a password. When you use an encrypted variable or file in a command or playbook, you must provide the same password that was used to encrypt it. To develop a strategy for managing vault passwords, start with two questions:"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:8
msgid "Do you want to encrypt all your content with the same password, or use different passwords for different needs?"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:9
msgid "Where do you want to store your password or passwords?"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:12
msgid "Choosing between a single password and multiple passwords"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:14
msgid "If you have a small team or few sensitive values, you can use a single password for everything you encrypt with Ansible Vault. Store your vault password securely in a file or a secret manager as described below."
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:16
msgid "If you have a larger team or many sensitive values, you can use multiple passwords. For example, you can use different passwords for different users or different levels of access. Depending on your needs, you might want a different password for each encrypted file, for each directory, or for each environment. For example, you might have a playbook that includes two vars files, one for the dev environment and one for the production environment, encrypted with two different passwords. When you run the playbook, select the correct vault password for the environment you are targeting, using a vault ID."
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:21
msgid "Managing multiple passwords with vault IDs"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:23
msgid "If you use multiple vault passwords, you can differentiate one password from another with vault IDs. You use the vault ID in three ways:"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:25
msgid "Pass it with :option:`--vault-id <ansible-playbook --vault-id>` to the :ref:`ansible-vault` command when you create encrypted content"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:26
msgid "Include it wherever you store the password for that vault ID (see :ref:`storing_vault_passwords`)"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:27
msgid "Pass it with :option:`--vault-id <ansible-playbook --vault-id>` to the :ref:`ansible-playbook` command when you run a playbook that uses content you encrypted with that vault ID"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:29
msgid "When you pass a vault ID as an option to the :ref:`ansible-vault` command, you add a label (a hint or nickname) to the encrypted content. This label documents which password you used to encrypt it. The encrypted variable or file includes the vault ID label in plain text in the header. The vault ID is the last element before the encrypted content. For example:"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:41
msgid "In addition to the label, you must provide a source for the related password. The source can be a prompt, a file, or a script, depending on how you are storing your vault passwords. The pattern looks like this:"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:47
msgid "If your playbook uses multiple encrypted variables or files that you encrypted with different passwords, you must pass the vault IDs when you run that playbook. You can use :option:`--vault-id <ansible-playbook --vault-id>` by itself, with :option:`--vault-password-file <ansible-playbook --vault-password-file>`, or with :option:`--ask-vault-pass <ansible-playbook --ask-vault-pass>`. The pattern is the same as when you create encrypted content: include the label and the source for the matching password."
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:49
msgid "See below for examples of encrypting content with vault IDs and using content encrypted with vault IDs. The :option:`--vault-id <ansible-playbook --vault-id>` option works with any Ansible command that interacts with vaults, including :ref:`ansible-vault`, :ref:`ansible-playbook`, and so on."
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:52
msgid "Limitations of vault IDs"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:54
msgid "Ansible does not enforce using the same password every time you use a particular vault ID label. You can encrypt different variables or files with the same vault ID label but different passwords. This usually happens when you type the password at a prompt and make a mistake. It is possible to use different passwords with the same vault ID label on purpose. For example, you could use each label as a reference to a class of passwords, rather than a single password. In this scenario, you must always know which specific password or file to use in context. However, you are more likely to encrypt two files with the same vault ID label and different passwords by mistake. If you encrypt two files with the same label but different passwords by accident, you can :ref:`rekey <rekeying_files>` one file to fix the issue."
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:57
msgid "Enforcing vault ID matching"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:59
msgid "By default the vault ID label is only a hint to remind you which password you used to encrypt a variable or file. Ansible does not check that the vault ID in the header of the encrypted content matches the vault ID you provide when you use the content. Ansible decrypts all files and variables called by your command or playbook that are encrypted with the password you provide. To check the encrypted content and decrypt it only when the vault ID it contains matches the one you provide with ``--vault-id``, set the config option :ref:`DEFAULT_VAULT_ID_MATCH`. When you set :ref:`DEFAULT_VAULT_ID_MATCH`, each password is only used to decrypt data that was encrypted with the same label. This is efficient, predictable, and can reduce errors when different values are encrypted with different passwords."
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:62
msgid "Even with the :ref:`DEFAULT_VAULT_ID_MATCH` setting enabled, Ansible does not enforce using the same password every time you use a particular vault ID label."
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:67
msgid "Storing and accessing vault passwords"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:69
msgid "You can memorize your vault password, or manually copy vault passwords from any source and paste them at a command-line prompt, but most users store them securely and access them as needed from within Ansible. You have two options for storing vault passwords that work from within Ansible: in files, or in a third-party tool such as the system keyring or a secret manager. If you store your passwords in a third-party tool, you need a vault password client script to retrieve them from within Ansible."
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:72
msgid "Storing passwords in files"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:74
msgid "To store a vault password in a file, enter the password as a string on a single line in the file. Make sure the permissions on the file are appropriate. Do not add password files to source control."
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:79
msgid "Storing passwords in third-party tools with vault password client scripts"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:81
msgid "You can store your vault passwords on the system keyring, in a database, or in a secret manager and retrieve them from within Ansible using a vault password client script. Enter the password as a string on a single line. If your password has a vault ID, store it in a way that works with your password storage tool."
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:83
msgid "To create a vault password client script:"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:85
msgid "Create a file with a name ending in either ``-client`` or ``-client.EXTENSION``"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:86
msgid "Make the file executable"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:90
msgid "Within the script itself:"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:88
msgid "Print the passwords to standard output"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:89
msgid "Accept a ``--vault-id`` option"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:90
msgid "If the script prompts for data (for example, a database password), display the prompts to the TTY."
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:92
msgid "When you run a playbook that uses vault passwords stored in a third-party tool, specify the script as the source within the ``--vault-id`` flag. For example:"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:98
msgid "Ansible executes the client script with a ``--vault-id`` option so the script knows which vault ID label you specified. For example a script loading passwords from a secret manager can use the vault ID label to pick either the 'dev' or 'prod' password. The example command above results in the following execution of the client script:"
msgstr ""

#: ../../rst/vault_guide/vault_managing_passwords.rst:104
msgid "For an example of a client script that loads passwords from the system keyring, see the `vault-keyring-client script <https://github.com/ansible-community/contrib-scripts/blob/main/vault/vault-keyring-client.py>`_."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:6
msgid "Using encrypted variables and files"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:8
msgid "When you run a task or playbook that uses encrypted variables or files, you must provide the passwords to decrypt the variables or files. You can do this at the command line or by setting a default password source in a config option or an environment variable."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:11
msgid "Passing a single password"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:13
msgid "If all the encrypted variables and files your task or playbook needs use a single password, you can use the :option:`--ask-vault-pass <ansible-playbook --ask-vault-pass>` or :option:`--vault-password-file <ansible-playbook --vault-password-file>` cli options."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:15
#: ../../rst/vault_guide/vault_using_encrypted_content.rst:83
msgid "To prompt for the password:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:21
msgid "To retrieve the password from the :file:`/path/to/my/vault-password-file` file:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:27
msgid "To get the password from the vault password client script :file:`my-vault-password-client.py`:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:37
msgid "Passing vault IDs"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:39
msgid "You can also use the :option:`--vault-id <ansible-playbook --vault-id>` option to pass a single password with its vault label. This approach is clearer when multiple vaults are used within a single inventory."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:41
msgid "To prompt for the password for the 'dev' vault ID:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:47
msgid "To retrieve the password for the 'dev' vault ID from the :file:`dev-password` file:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:53
msgid "To get the password for the 'dev' vault ID from the vault password client script :file:`my-vault-password-client.py`:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:60
msgid "Passing multiple vault passwords"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:62
msgid "If your task or playbook requires multiple encrypted variables or files that you encrypted with different vault IDs, you must use the :option:`--vault-id <ansible-playbook --vault-id>` option, passing multiple ``--vault-id`` options to specify the vault IDs ('dev', 'prod', 'cloud', 'db') and sources for the passwords (prompt, file, script). . For example, to use a 'dev' password read from a file and to be prompted for the 'prod' password:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:68
msgid "By default the vault ID labels (dev, prod and so on) are only hints. Ansible attempts to decrypt vault content with each password. The password with the same label as the encrypted data will be tried first, after that each vault secret will be tried in the order they were provided on the command line."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:70
msgid "Where the encrypted data has no label, or the label does not match any of the provided labels, the passwords will be tried in the order they are specified. In the example above, the 'dev' password will be tried first, then the 'prod' password for cases where Ansible doesn't know which vault ID is used to encrypt something."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:73
msgid "Using ``--vault-id`` without a vault ID"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:75
msgid "The :option:`--vault-id <ansible-playbook --vault-id>` option can also be used without specifying a vault-id. This behavior is equivalent to :option:`--ask-vault-pass <ansible-playbook --ask-vault-pass>` or :option:`--vault-password-file <ansible-playbook --vault-password-file>` so is rarely used."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:77
msgid "For example, to use a password file :file:`dev-password`:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:89
msgid "To get the password from an executable script :file:`my-vault-password-client.py`:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:96
msgid "Configuring defaults for using encrypted content"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:99
msgid "Setting a default vault ID"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:101
msgid "If you use one vault ID more frequently than any other, you can set the config option :ref:`DEFAULT_VAULT_IDENTITY_LIST` to specify a default vault ID and password source. Ansible will use the default vault ID and source any time you do not specify :option:`--vault-id <ansible-playbook --vault-id>`. You can set multiple values for this option. Setting multiple values is equivalent to passing multiple :option:`--vault-id <ansible-playbook --vault-id>` cli options."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:104
msgid "Setting a default password source"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:106
msgid "If you don't want to provide the password file on the command line or if you use one vault password file more frequently than any other, you can set the :ref:`DEFAULT_VAULT_PASSWORD_FILE` config option or the :envvar:`ANSIBLE_VAULT_PASSWORD_FILE` environment variable to specify a default file to use. For example, if you set ``ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt``, Ansible will automatically search for the password in that file. This is useful if, for example, you use Ansible from a continuous integration system such as Jenkins."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:108
msgid "The file that you reference can be either a file containing the password (in plain text), or it can be a script (with executable permissions set) that returns the password."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:111
msgid "When are encrypted files made visible?"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:113
msgid "In general, content you encrypt with Ansible Vault remains encrypted after execution. However, there is one exception. If you pass an encrypted file as the ``src`` argument to the :ref:`copy <copy_module>`, :ref:`template <template_module>`, :ref:`unarchive <unarchive_module>`, :ref:`script <script_module>` or :ref:`assemble <assemble_module>` module, the file will not be encrypted on the target host (assuming you supply the correct vault password when you run the play). This behavior is intended and useful. You can encrypt a configuration file or template to avoid sharing the details of your configuration, but when you copy that configuration to servers in your environment, you want it to be decrypted so local users and processes can access it."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:118
msgid "Format of files encrypted with Ansible Vault"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:120
msgid "Ansible Vault creates UTF-8 encoded txt files. The file format includes a newline terminated header. For example:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:126
msgid "or"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:132
msgid "The header contains up to four elements, separated by semi-colons (``;``)."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:134
msgid "The format ID (``$ANSIBLE_VAULT``). Currently ``$ANSIBLE_VAULT`` is the only valid format ID. The format ID identifies content that is encrypted with Ansible Vault (via vault.is_encrypted_file())."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:136
msgid "The vault format version (``1.X``). All supported versions of Ansible will currently default to '1.1' or '1.2' if a labeled vault ID is supplied. The '1.0' format is supported for reading only (and will be converted automatically to the '1.1' format on write). The format version is currently used as an exact string compare only (version numbers are not currently 'compared')."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:138
msgid "The cipher algorithm used to encrypt the data (``AES256``). Currently ``AES256`` is the only supported cipher algorithm. Vault format 1.0 used 'AES', but current code always uses 'AES256'."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:140
msgid "The vault ID label used to encrypt the data (optional, ``vault-id-label``) For example, if you encrypt a file with ``--vault-id dev@prompt``, the vault-id-label is ``dev``."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:142
msgid "Note: In the future, the header could change. Fields after the format ID and format version depend on the format version, and future vault format versions may add more cipher algorithm options and/or additional fields."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:144
msgid "The rest of the content of the file is the 'vaulttext'. The vaulttext is a text armored version of the encrypted ciphertext. Each line is 80 characters wide, except for the last line which may be shorter."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:148
msgid "Ansible Vault payload format 1.1 - 1.2"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:150
msgid "The vaulttext is a concatenation of the ciphertext and a SHA256 digest with the result 'hexlifyied'."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:152
msgid "'hexlify' refers to the ``hexlify()`` method of the Python Standard Library's `binascii <https://docs.python.org/3/library/binascii.html>`_ module."
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:154
msgid "hexlify()'ed result of:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:156
msgid "hexlify()'ed string of the salt, followed by a newline (``0x0a``)"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:157
msgid "hexlify()'ed string of the crypted HMAC, followed by a newline. The HMAC is:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:159
msgid "a `RFC2104 <https://www.ietf.org/rfc/rfc2104.txt>`_ style HMAC"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:161
msgid "inputs are:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:163
msgid "The AES256 encrypted ciphertext"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:164
msgid "A PBKDF2 key. This key, the cipher key, and the cipher IV are generated from:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:166
msgid "the salt, in bytes"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:167
msgid "10000 iterations"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:168
msgid "SHA256() algorithm"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:169
msgid "the first 32 bytes are the cipher key"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:170
msgid "the second 32 bytes are the HMAC key"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:171
msgid "remaining 16 bytes are the cipher IV"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:173
msgid "hexlify()'ed string of the ciphertext. The ciphertext is:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:175
msgid "AES256 encrypted data. The data is encrypted using:"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:177
msgid "AES-CTR stream cipher"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:178
msgid "cipher key"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:179
msgid "IV"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:180
msgid "a 128 bit counter block seeded from an integer IV"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:181
msgid "the plaintext"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:183
msgid "the original plaintext"
msgstr ""

#: ../../rst/vault_guide/vault_using_encrypted_content.rst:184
msgid "padding up to the AES256 blocksize. (The data used for padding is based on `RFC5652 <https://tools.ietf.org/html/rfc5652#section-6.3>`_)"
msgstr ""

