From 90518d8bb5b82827829e364696c326e31c6b3c74 Mon Sep 17 00:00:00 2001
From: Brian Coca <bcoca@users.noreply.github.com>
Date: Wed, 1 Sep 2021 16:49:21 -0400
Subject: [PATCH] added vault/unvault docs (#75140)

---
 .../rst/user_guide/playbooks_filters.rst      | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/docs/docsite/rst/user_guide/playbooks_filters.rst b/docs/docsite/rst/user_guide/playbooks_filters.rst
index daa7b6b1d81..ff9cc807d92 100644
--- a/docs/docsite/rst/user_guide/playbooks_filters.rst
+++ b/docs/docsite/rst/user_guide/playbooks_filters.rst
@@ -1349,6 +1349,31 @@ Hash type 'blowfish' (BCrypt) provides the facility to specify the version of th
 
 .. versionadded:: 2.12
 
+You can also use the Ansible :ref:`vault <vault>` filter to encrypt data::
+
+  # simply encrypt my key in a vault
+  vars:
+    myvaultedkey: "{{ keyrawdata|vault(passphrase) }}"
+
+  - name: save templated vaulted data
+    template: src=dump_template_data.j2 dest=/some/key/vault.txt
+    vars:
+      mysalt: '{{ 2**256|random(seed=inventory_hostname) }}'
+      template_data: '{{ secretdata|vault(vaultsecret, salt=mysalt) }}'
+
+
+And then decrypt it using the unvault filter::
+
+  # simply decrypt my key from a vault
+  vars:
+    mykey: "{{ myvaultedkey|unvault(passphrase) }}"
+
+  - name: save templated unvaulted data
+    template: src=dump_template_data.j2 dest=/some/key/clear.txt
+    vars:
+      template_data: '{{ secretdata|unvault(vaultsecret) }}'
+
+
 .. _other_useful_filters:
 
 Manipulating text