title: Ansible: can I use a ssh key encrypted in the vault?
body: <p>We have an ansible server setup with our ansible code stored in a git repos.  All the servers configured by ansible currently use the SSH key from our control server for access.  However I'd like to include the key in the ansible git repos instead (encrypted in the vault).  I'd like to do this as:</p>
  
  <p>1) If our ansible server ever got compromised/had a unrecoverable hard drive failure/some other failure, we wouldn't have to generate a new ssh key and copy it to each ansible server before we could run ansible tasks again</p>
  
  <p>2) It feels like it should be in the repos, as it's part of the setup/config to access the servers</p>
  
  <p>3) We have other data stored in the vault and having to enter one password for the vault, and another for a SSH passphrase is a pain</p>
  
  <p>We looked at coding a custom task to do this by creating a temporary file on disk, but it kind of feels like it should be something built in.  Also I like the way the built in decryption only holds files in ram.  The other issue was we couldn't find a method that would guaranteed to be run in the case of a failure, and so clean up the temporary file we created (kind of like an ensure block in programming)</p>
  
  <p>Is there a safe way to use a vaulted ssh key?  Or failing that just a way to ask for the ssh passphrase upfront?</p>