git - Ansible SSH private key in source control? -

i have been developing ansible playbook couple of weeks, therefore, experience such technology relatively short. part of strategy includes using custom ansible_ssh_user provisioning hosts throughout inventory, however, such user need own ssh key pair, involve sort of plan holding/storing correspondent private key. on production environment, playbook cloned/pulled , run inside playbook node role provision rest of infrastructure.

at first, thinking put private key inside playbook git repository, having second thoughts nonetheless, because of obvious security reasons , common sense around it, hence reason need consult matter.

with set on table, here follow-up questions:

• in ansible-based development environment, sane/reasonable hold private ssh key in source control?
• would practice advised only development environments whereas local git branch inside playbook node used hold actual production ssh private key?
• would better address case scenario via ansible vault instead?, have not ever used before, regardless of cannot yet tell whether proper case using it.
• in experience, approach around in production environment?, considered best practice in particular scenario?

it's bad idea store kind of plaintext secret in revision control, ssh private keys included. instead, use ansible-vault store private key.

ansible-vault can operate on file type. encrypt file

ansible-vault encrypt /path/to/local/private_key 

then install key:

- name: install private ssh key   vars:     source_key: /path/to/local/private_key     dest_key: /path/to/remote/private_key   tasks:   - name: ensure .ssh directory exists.     file:        dest: "{{ dest_key | dirname }}"       mode: 0700        owner: user        state: directory   - name: install ssh key     copy:        src: "{{ source_key }}"        dest: "{{ dest_key }}"       mode: 0600       owner: user 

earlier versions of ansible-vault operate on variables defined in var files, had this:

ssh_key: |   -----begin rsa private key-----   ...   -----end rsa private key----- key_file: /home/user/.ssh/id_rsa 

encrypt ansible-vault:

ansible-vault encrypt /path/to/var_file 

and install key:

- name: ensure .ssh directory exists.   file:      dest: "{{ key_file | dirname }}"     mode: 0700      owner: user      state: directory  - name: install ssh key   copy:      content: "{{ ssh_key }}"      dest: "{{ key_file }}"     mode: 0600     owner: user 

thanks below improved answer comments.