<p>Using</p>

<pre><code>ansible-playbook site.yml --vault-password-file ./mypass.sh
</code></pre>

<p>resulted in:</p>

<pre><code>ERROR! Problem running vault password script / p a t h / t o
/ e c h o _ v a u l t _ p a s s . s h ([Errno 8] Exec format error). If this is 
not a script, remove the executable bit from the file.
</code></pre>

<p>Based on <a href="http://www.kdelemme.com/2016/07/06/use-ansible-to-deploy-with-circleci/" rel="nofollow noreferrer">this post</a> the following was defined in bitbucket-pipelines:</p>

<pre><code>image: docker:latest

pipelines:
  default:
    - step:
        script:
          - echo $ANSIBLE_VAULT_PASSWORD &gt; .vault_password.txt
          - ansible-playbook -i ansible/inventory ansible/site.yml --vault-password-file .vault_password.txt
</code></pre>

CC BY-SA 3.0
2017-04-10T09:17:44.573Z
2017-04-10T09:17:44.573Z
030
<p>You could have a test set up that does not run production, and load different files for those. </p>

<p>Create a host_vars/localhost/vault that only works for the local test installation. </p>

<p>That way you could use a open vault password that works only for that local host vault. </p>

CC BY-SA 3.0
2017-04-02T12:05:09.400Z
2017-04-02T12:05:09.400Z
Findarato
<p><code>--vault-password-file</code> can instead point to an executable script that writes to stdout. This little-known feature should solve your problem.</p>

<p>First, write a simple, executable script that prints a system environment variable, and check that into your source control. Then, use Bitbucket's encrypted variable feature to set that environment variable to your ansible-vault secret. Finally, execute like so:</p>

<p><code>ansible-playbook site.yml --vault-password-file ./mypass.sh</code>.</p>

<p>References:</p>

<ol>
<li><p><a href="http://docs.ansible.com/ansible/playbooks_vault.html#running-a-playbook-with-vault" rel="noreferrer">http://docs.ansible.com/ansible/playbooks_vault.html#running-a-playbook-with-vault</a></p></li>
<li><p><a href="https://groups.google.com/forum/#!topic/ansible-devel/1vFc3y6Ogto" rel="noreferrer">https://groups.google.com/forum/#!topic/ansible-devel/1vFc3y6Ogto</a></p></li>
</ol>

CC BY-SA 3.0
2017-03-31T07:26:20.757Z
And then the mypass.sh will contain `echo $VAR` for example and this var will be set in the BitBucket UI?
030
CC BY-SA 3.0
2017-03-31T17:18:53.660Z
Yup! Alternatively, here's a Python example: http://stackoverflow.com/questions/4906977/access-environment-variables-from-python
Woodland
CC BY-SA 3.0
2017-04-10T09:05:07.240Z
`([Errno 8] Exec format error). If this is not a script, remove the executable bit from the file.`
030
CC BY-SA 3.0
2017-03-31T03:22:28.533Z
2017-03-31T03:22:28.533Z
Woodland
<p><strong>Introduction</strong></p>

<p>On a private CI's and Source Control Repositories like Gitlab-ce it is possible to copy an ~/.vault_pass.txt to the server and let it use by the CI to decrypt files using Ansible.</p>

<p><strong>Problem</strong></p>

<p>On public CI's and Source Control Repositories like Bitbucket it is not possible to copy a ~/.vault_pass.txt to the CI server it self.</p>

<p><strong>Discussion</strong></p>

<p>In Bitbucket it is possible to define encrypted variables, but when <a href="https://github.com/ansible/ansible/blob/devel/lib/ansible/constants.py" rel="noreferrer">this</a> file is checked the only VAULT related variables are:</p>

<ul>
<li><code>ANSIBLE_ASK_VAULT_PASS</code></li>
<li><code>ANSIBLE_VAULT_PASSWORD_FILE</code></li>
</ul>

<p>These variables are not an option to solve the issue as when the <code>ANSIBLE_ASK_VAULT_PASS</code> is set <code>ansible-vault</code> still prompts:</p>

<pre><code>user@host $
Vault password:
</code></pre>

<p>When the same password is entered it can open the encrypted file, but the aim is to open the file without needing a file or entering a password in a prompt.</p>

<p>Another attempt to solve the issue was running <code>export ANSIBLE_ASK_VAULT_PASS=&lt;ansible-vault-password&gt;</code>, but the interactive mode persists.</p>

<p>Another option is <code>export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt</code>, but then this file needs to be pushed to the repository, but source Control repositories should not contain passwords.</p>

CC BY-SA 3.0
2017-03-29T10:28:13.097Z
Hi @030, could you clarify what you mean by CI?  To me this means **Continuous Integration**, however both GitLab and BitBucket are also Source Control Repositories - the question would be clearer if CI was expanded out.
Richard Slater
<ansible-vault><bitbucket>
What are best practices for using Ansible Vault on public CI's and Source Control Repositories like BitBucket?
030
# What are best practices for using Ansible Vault on public CI's and Source Control Repositories like BitBucket?

(Asked by: username_0 on 2017-03-29)

Introduction
On a private CI's and Source Control Repositories like Gitlab-ce it is possible to copy an ~/.vault_pass.txt to the server and let it use by the CI to decrypt files using Ansible.
Problem
On public CI's and Source Control Repositories like Bitbucket it is not possible to copy a ~/.vault_pass.txt to the CI server it self.
Discussion
In Bitbucket it is possible to define encrypted variables, but when this file is checked the only VAULT related variables are:

ANSIBLE_ASK_VAULT_PASS
ANSIBLE_VAULT_PASSWORD_FILE

These variables are not an option to solve the issue as when the ANSIBLE_ASK_VAULT_PASS is set ansible-vault still prompts:
user@host $
Vault password:

When the same password is entered it can open the encrypted file, but the aim is to open the file without needing a file or entering a password in a prompt.
Another attempt to solve the issue was running export ANSIBLE_ASK_VAULT_PASS=, but the interactive mode persists.
Another option is export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt, but then this file needs to be pushed to the repository, but source Control repositories should not contain passwords.

**Tags:** ansible-vault, bitbucket

> **Comments:**
> **username_1**: Hi @username_0, could you clarify what you mean by CI?  To me this means **Continuous Integration**, however both GitLab and BitBucket are also Source Control Repositories - the question would be clearer if CI was expanded out.  

---

## 3 answers

### Answer by username_3 on 2017-03-31. Score: 13 | Accepted answer

`--vault-password-file` can instead point to an executable script that writes to stdout. This little-known feature should solve your problem.

First, write a simple, executable script that prints a system environment variable, and check that into your source control. Then, use Bitbucket's encrypted variable feature to set that environment variable to your ansible-vault secret. Finally, execute like so:

`ansible-playbook site.yml --vault-password-file ./mypass.sh`.

References:

1. <http://docs.ansible.com/ansible/playbooks_vault.html#running-a-playbook-with-vault>
2. <https://groups.google.com/forum/#!topic/ansible-devel/1vFc3y6Ogto>

> **Comments:**
> **username_0**: And then the mypass.sh will contain `echo $VAR` for example and this var will be set in the BitBucket UI?  
> **username_3**: Yup! Alternatively, here's a Python example: http://stackoverflow.com/questions/4906977/access-environment-variables-from-python  
> **username_0**: `([Errno 8] Exec format error). If this is not a script, remove the executable bit from the file.`  

---

### Answer by username_0 on 2017-04-10. Score: 3

Using
ansible-playbook site.yml --vault-password-file ./mypass.sh

resulted in:
ERROR! Problem running vault password script / p a t h / t o
/ e c h o _ v a u l t _ p a s s . s h ([Errno 8] Exec format error). If this is 
not a script, remove the executable bit from the file.

Based on this post the following was defined in bitbucket-pipelines:
image: docker:latest

pipelines:
  default:
    - step:
        script:
          - echo $ANSIBLE_VAULT_PASSWORD > .vault_password.txt
          - ansible-playbook -i ansible/inventory ansible/site.yml --vault-password-file .vault_password.txt


---

### Answer by username_2 on 2017-04-02. Score: -1

You could have a test set up that does not run production, and load different files for those.

Create a host\_vars/localhost/vault that only works for the local test installation.

That way you could use a open vault password that works only for that local host vault.


---

