Secure my ansible inventory to store it in a git repository

This is a simple way to start a project with a minimum security for sensitive data using sops and gpg. I thinking about how to store ip addresses use in my ansible inventory, in my repository. My first idea is to crypt this values. In a simple way I want to use basic tool like sops and gpg.

Pre-requisite

• a git repo
• gpg
• sops
• set export GPG_TTY=$(tty) in $HOME/.zshrc

# extract fingerprint associated with your email
gpg --with-colons --fingerprint "email@domain.com" | awk -F: '/^fpr:/ {print $10; exit}'

Configuration

Create a file .sops.yaml at the root of the repo. For example an ansible repo:

creation_rules:
  - path_regex: (host_vars|group_vars)/.*\.sops\.(yaml|yml|json)$
    pgp: 'FINGERPRINT_GPG'
  
  - path_regex: inventory/.*\.(yaml|yml|json)$
    pgp: 'FINGERPRINT_GPG'

  - path_regex: \.ya?ml$
    pgp: 'FINGERPRINT_GPG'

  - path_regex: \.json$
    pgp: 'FINGERPRINT_GPG'

Crypt inventory file:

Get Eric Mourgaya’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Using .sops.yaml as reference or using only a ENV variable

# inventory.yaml
all:
    children:
        masters:
            hosts:
                srv1:
                    ansible_host: 10.1.1.20
                    ansible_user: eric
                    ansible_password: verysecret1
        workers:
            hosts:
                srv2:
                    ansible_host: 10.1.1.30
                    ansible_user: eric
                    ansible_password: verysecret2
                srv3:
                    ansible_host: 10.1.1.40
                    ansible_user: eric
                    ansible_password: verysecret3
        k8s_cluster:
            children:
                masters: {}
                workers: {}
            vars:
                ansible_python_interpreter: /usr/bin/python3
                kubernetes_version: 1.28.0-00
                pod_network_cidr: 10.0.0.0/16

#  not  necessary but you can put it in your .zshrc, use the file .sops.yaml or just SOPS_PGP_FP
# export SOPS_PGP_FP=$(gpg --with-colons --list-keys 2>/dev/null | awk -F: '$1=="pub" {getline; if ($1=="fpr") print $10; exit}')
# to encrypt  the. file
sops --encrypt --in-place inventory.yaml
# to decrypt the file
sops --decrypt --in-place inventory.yaml
# edit the encrypted file
sops inventory.yaml

Now all values in this inventory will be encrypt, something like:

....    
    k8s_cluster:
            children:
                masters: {}
                workers: {}
            vars:
                ansible_python_interpreter: ENC[AES256_GCM,data:aqBFQ5Nf4ZMH/DoNhHKjOQ==,iv:H55XpNew4Hi2WeB64nBNjvtWxzFRj2prCUuJOdwwjw0=,tag:fI2sSTAnxCxUY2prsVY9Tw==,type:str]
                kubernetes_version: ENC[AES256_GCM,data:/J7Gmz6LqOds,iv:nEy7STm82/w6u2yml4H/oMavcTq9zH58kjyKcng4zs0=,tag:6h+FHunRpeFlVUu/HB2zig==,type:str]
                pod_network_cidr: ENC[AES256_GCM,data:7ckA4ElLeF2UGW8=,iv:E4Kqu13iv7+fj0Lc941BCo2p+XIjvIwA6DZrSZjPuQg=,tag:pDMPrmJ2SiLZzmsb+y29vg==,type:str]
sops:
    lastmodified: "2025-11-09T16:41:12Z"
    mac: ENC[AES256_GCM,data:/zbg2IU96EGFhoAXpSF1BFN+4OUg1F+9heQDo1Uz+1VbqAGKLY7q2jGBPW9CQAEY/rZ3T864/oLLZl3lGVuB27cyguFrRtXAXIR1sTAHaIV/8oVweZjdXJ+KcZpG/Fzp0dfxWeT616cg73SPkAR9k+jbZA3A4hiPgON5nAU/RH8=,iv:il7k2Si9/mpf6oa9xBHgKfwIP3YQiutfVllXrxwr2T0=,tag:3Vi4lefOs0119cQoRzkv6Q==,type:str]
    pgp:
        - created_at: "2025-11-09T16:41:12Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hF4DlwWsS7m5CrkSAQdA/p6Xxn0umzGR4vxWE5qKjLOlYA045RNyBOJ7RGOaiT4w
            qMUYbHzA99d4dXBUUVYiQr+nyuIUPJxIaHDzRo5tUFJ48xa/bXI/ZpBaexzCkoR
            1GgBCQIQqgYd80dKY+DXCXDogs98y4pAjasusg2k+8YnCD6KUz3dcTI8LMedjY0
            1d81MlmYeIjOLAn7hngcQAaSnhOemQ3BKTLVq8JjQRvA5gMWmbKDDBy5SP/+jcb+
            Xe3l8mW58XE0Mw==
            =tzeS
            -----END PGP MESSAGE-----
          fp: 947D7A7BAC04C02D171C8F294E0210E2434689B4
    unencrypted_suffix: _unencrypted
    version: 3.11.0

So, no need to. encrypt information like :

• ansible_python_interpreter
• kubernetes_version

We can modify .sops.yaml to do this:

creation_rules:
  - path_regex: (host_vars|group_vars)/.*\.sops\.(yaml|yml|json)$
    pgp: 'FINGERPRINT_GPG'
    unencrypted_regex: '^(ansible_python_interpreter|pod_network_cidr|kubernetes_version)$'
  
  - path_regex: inventory/.*\.(yaml|yml|json)$
    pgp: 'FINGERPRINT_GPG'
    unencrypted_regex: '^(ansible_python_interpreter|pod_network_cidr|kubernetes_version)$'

  - path_regex: \.ya?ml$
    pgp: 'FINGERPRINT_GPG'
    unencrypted_regex: '^(ansible_python_interpreter|pod_network_cidr)$'

  - path_regex: \.json$
    pgp: 'FINGERPRINT_GPG'
    unencrypted_regex: '^(ansible_python_interpreter|pod_network_cidr|kubernetes_version)$'

and now we have an encrypted inventory we can put in git repo.

enjoy :-)