Answers: <p>Using</p>
  
  <pre><code>ansible-playbook site.yml --vault-password-file ./mypass.sh
  </code></pre>
  
  <p>resulted in:</p>
  
  <pre><code>ERROR! Problem running vault password script / p a t h / t o
  / e c h o _ v a u l t _ p a s s . s h ([Errno 8] Exec format error). If this is 
  not a script, remove the executable bit from the file.
  </code></pre>
  
  <p>Based on <a href="http://www.kdelemme.com/2016/07/06/use-ansible-to-deploy-with-circleci/" rel="nofollow noreferrer">this post</a> the following was defined in bitbucket-pipelines:</p>
  
  <pre><code>image: docker:latest
  
  pipelines:
    default:
      - step:
          script:
            - echo $ANSIBLE_VAULT_PASSWORD &gt; .vault_password.txt
            - ansible-playbook -i ansible/inventory ansible/site.yml --vault-password-file .vault_password.txt
  </code></pre>
  
Answers: CC BY-SA 3.0
Answers: 2017-04-10T09:17:44.573Z
Answers: 2017-04-10T09:17:44.573Z
Answers: 030
Answers: <p>You could have a test set up that does not run production, and load different files for those. </p>
  
  <p>Create a host_vars/localhost/vault that only works for the local test installation. </p>
  
  <p>That way you could use a open vault password that works only for that local host vault. </p>
  
Answers: CC BY-SA 3.0
Answers: 2017-04-02T12:05:09.400Z
Answers: 2017-04-02T12:05:09.400Z
Answers: Findarato
Answers: <p><code>--vault-password-file</code> can instead point to an executable script that writes to stdout. This little-known feature should solve your problem.</p>
  
  <p>First, write a simple, executable script that prints a system environment variable, and check that into your source control. Then, use Bitbucket's encrypted variable feature to set that environment variable to your ansible-vault secret. Finally, execute like so:</p>
  
  <p><code>ansible-playbook site.yml --vault-password-file ./mypass.sh</code>.</p>
  
  <p>References:</p>
  
  <ol>
  <li><p><a href="http://docs.ansible.com/ansible/playbooks_vault.html#running-a-playbook-with-vault" rel="noreferrer">http://docs.ansible.com/ansible/playbooks_vault.html#running-a-playbook-with-vault</a></p></li>
  <li><p><a href="https://groups.google.com/forum/#!topic/ansible-devel/1vFc3y6Ogto" rel="noreferrer">https://groups.google.com/forum/#!topic/ansible-devel/1vFc3y6Ogto</a></p></li>
  </ol>
  
Answers: CC BY-SA 3.0
Answers: 2017-03-31T07:26:20.757Z
Answers: And then the mypass.sh will contain `echo $VAR` for example and this var will be set in the BitBucket UI?
Answers: 030
Answers: CC BY-SA 3.0
Answers: 2017-03-31T17:18:53.660Z
Answers: Yup! Alternatively, here's a Python example: http://stackoverflow.com/questions/4906977/access-environment-variables-from-python
Answers: Woodland
Answers: CC BY-SA 3.0
Answers: 2017-04-10T09:05:07.240Z
Answers: `([Errno 8] Exec format error). If this is not a script, remove the executable bit from the file.`
Answers: 030
Answers: CC BY-SA 3.0
Answers: 2017-03-31T03:22:28.533Z
Answers: 2017-03-31T03:22:28.533Z
Answers: Woodland
Body: <p><strong>Introduction</strong></p>
  
  <p>On a private CI's and Source Control Repositories like Gitlab-ce it is possible to copy an ~/.vault_pass.txt to the server and let it use by the CI to decrypt files using Ansible.</p>
  
  <p><strong>Problem</strong></p>
  
  <p>On public CI's and Source Control Repositories like Bitbucket it is not possible to copy a ~/.vault_pass.txt to the CI server it self.</p>
  
  <p><strong>Discussion</strong></p>
  
  <p>In Bitbucket it is possible to define encrypted variables, but when <a href="https://github.com/ansible/ansible/blob/devel/lib/ansible/constants.py" rel="noreferrer">this</a> file is checked the only VAULT related variables are:</p>
  
  <ul>
  <li><code>ANSIBLE_ASK_VAULT_PASS</code></li>
  <li><code>ANSIBLE_VAULT_PASSWORD_FILE</code></li>
  </ul>
  
  <p>These variables are not an option to solve the issue as when the <code>ANSIBLE_ASK_VAULT_PASS</code> is set <code>ansible-vault</code> still prompts:</p>
  
  <pre><code>user@host $
  Vault password:
  </code></pre>
  
  <p>When the same password is entered it can open the encrypted file, but the aim is to open the file without needing a file or entering a password in a prompt.</p>
  
  <p>Another attempt to solve the issue was running <code>export ANSIBLE_ASK_VAULT_PASS=&lt;ansible-vault-password&gt;</code>, but the interactive mode persists.</p>
  
  <p>Another option is <code>export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt</code>, but then this file needs to be pushed to the repository, but source Control repositories should not contain passwords.</p>
  
Comments: CC BY-SA 3.0
Comments: 2017-03-29T10:28:13.097Z
Comments: Hi @030, could you clarify what you mean by CI?  To me this means **Continuous Integration**, however both GitLab and BitBucket are also Source Control Repositories - the question would be clearer if CI was expanded out.
Comments: Richard Slater
Tags: <ansible-vault><bitbucket>
Title: What are best practices for using Ansible Vault on public CI's and Source Control Repositories like BitBucket?
UserDisplayName: 030
ThreadText: # What are best practices for using Ansible Vault on public CI's and Source Control Repositories like BitBucket?
  
  (Asked by: username_0 on 2017-03-29)
  
  **Introduction**
  
  On a private CI's and Source Control Repositories like Gitlab-ce it is possible to copy an ~/.vault\_pass.txt to the server and let it use by the CI to decrypt files using Ansible.
  
  **Problem**
  
  On public CI's and Source Control Repositories like Bitbucket it is not possible to copy a ~/.vault\_pass.txt to the CI server it self.
  
  **Discussion**
  
  In Bitbucket it is possible to define encrypted variables, but when [this](https://github.com/ansible/ansible/blob/devel/lib/ansible/constants.py) file is checked the only VAULT related variables are:
  
  * `ANSIBLE_ASK_VAULT_PASS`
  * `ANSIBLE_VAULT_PASSWORD_FILE`
  
  These variables are not an option to solve the issue as when the `ANSIBLE_ASK_VAULT_PASS` is set `ansible-vault` still prompts:
  
  ```
  user@host $
  Vault password:
  
  ```
  
  When the same password is entered it can open the encrypted file, but the aim is to open the file without needing a file or entering a password in a prompt.
  
  Another attempt to solve the issue was running `export ANSIBLE_ASK_VAULT_PASS=<ansible-vault-password>`, but the interactive mode persists.
  
  Another option is `export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt`, but then this file needs to be pushed to the repository, but source Control repositories should not contain passwords.
  
  **Tags:** ansible-vault, bitbucket
  
  > **Comments:**
  > **username_1**: Hi @username_0, could you clarify what you mean by CI?  To me this means **Continuous Integration**, however both GitLab and BitBucket are also Source Control Repositories - the question would be clearer if CI was expanded out.  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_3 on 2017-03-31. Score: 13 | Accepted answer
  
  `--vault-password-file` can instead point to an executable script that writes to stdout. This little-known feature should solve your problem.
  
  First, write a simple, executable script that prints a system environment variable, and check that into your source control. Then, use Bitbucket's encrypted variable feature to set that environment variable to your ansible-vault secret. Finally, execute like so:
  
  `ansible-playbook site.yml --vault-password-file ./mypass.sh`.
  
  References:
  
  1. <http://docs.ansible.com/ansible/playbooks_vault.html#running-a-playbook-with-vault>
  2. <https://groups.google.com/forum/#!topic/ansible-devel/1vFc3y6Ogto>
  
  > **Comments:**
  > **username_0**: And then the mypass.sh will contain `echo $VAR` for example and this var will be set in the BitBucket UI?  
  > **username_3**: Yup! Alternatively, here's a Python example: http://stackoverflow.com/questions/4906977/access-environment-variables-from-python  
  > **username_0**: `([Errno 8] Exec format error). If this is not a script, remove the executable bit from the file.`  
  
  ---
  
  ### Answer by username_0 on 2017-04-10. Score: 3
  
  Using
  
  ```
  ansible-playbook site.yml --vault-password-file ./mypass.sh
  
  ```
  
  resulted in:
  
  ```
  ERROR! Problem running vault password script / p a t h / t o
  / e c h o _ v a u l t _ p a s s . s h ([Errno 8] Exec format error). If this is 
  not a script, remove the executable bit from the file.
  
  ```
  
  Based on [this post](http://www.kdelemme.com/2016/07/06/use-ansible-to-deploy-with-circleci/) the following was defined in bitbucket-pipelines:
  
  ```
  image: docker:latest
  
  pipelines:
    default:
      - step:
          script:
            - echo $ANSIBLE_VAULT_PASSWORD > .vault_password.txt
            - ansible-playbook -i ansible/inventory ansible/site.yml --vault-password-file .vault_password.txt
  
  ```
  
  
  ---
  
  ### Answer by username_2 on 2017-04-02. Score: -1
  
  You could have a test set up that does not run production, and load different files for those.
  
  Create a host\_vars/localhost/vault that only works for the local test installation.
  
  That way you could use a open vault password that works only for that local host vault.
  
  
  ---
  
  