1. Description
2. Parameters
3. Configuration
4. Usage
5. Bolt CLI Usage

This module includes Bolt plugins for creating key pairs and encrypting and decrypting sensitive values.

The pkcs7::secret_createkeys task creates a key pair used to encrypt and decrypt values. It accepts the following values:

The pkcs7::secret_decrypt task decrypts an encrypted value and returns the plaintext. It accepts the following values:

The pkcs7::secret_encrypt task encrypts a sensitive value and returns an encrypted value. It accepts the following values:

The pkcs7 plugin can be configured in a bolt.yaml file. The following values can be configured and apply to each plugin that uses the value:

• keysize
• private_key
• public_key

The pkcs7::secret_decrypt task is aliased to resolve_reference, letting it be used anywhere that a resolve_reference task can be used such as a bolt.yaml, inventory.yaml, or a plan. To use the plugin, write a plugin reference anywhere you need to decrypt an encrypted value:

targets:
  - uri: example.com
    config:
      ssh:
        password:
          _plugin: pkcs7
          encrypted_value: |
            ENC[PKCS7,MY_ENCRYPTED_DATA]

The pkcs7 plugins can be used directly from the Bolt CLI using the bolt secret commands. This module is bundled with Bolt and is the default plugin used by the bolt secret commands.

To create keys for a Bolt project, run the following command:

$ bolt secret createkeys [options]

To decrypt an encrypted value, run the following command:

$ bolt secret decrypt <encrypted_value> [options]

To encrypt plaintext, run the following command:

$ bolt secret encrypt <plaintext_value> [options]