11

Introduction

On a private CI's and Source Control Repositories like Gitlab-ce it is possible to copy an ~/.vault_pass.txt to the server and let it use by the CI to decrypt files using Ansible.

Problem

On public CI's and Source Control Repositories like Bitbucket it is not possible to copy a ~/.vault_pass.txt to the CI server it self.

Discussion

In Bitbucket it is possible to define encrypted variables, but when this file is checked the only VAULT related variables are:

  • ANSIBLE_ASK_VAULT_PASS
  • ANSIBLE_VAULT_PASSWORD_FILE

These variables are not an option to solve the issue as when the ANSIBLE_ASK_VAULT_PASS is set ansible-vault still prompts:

user@host $
Vault password:

When the same password is entered it can open the encrypted file, but the aim is to open the file without needing a file or entering a password in a prompt.

Another attempt to solve the issue was running export ANSIBLE_ASK_VAULT_PASS=<ansible-vault-password>, but the interactive mode persists.

Another option is export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt, but then this file needs to be pushed to the repository, but source Control repositories should not contain passwords.

  • 2
    Hi @030, could you clarify what you mean by CI? To me this means Continuous Integration, however both GitLab and BitBucket are also Source Control Repositories - the question would be clearer if CI was expanded out. – Richard Slater Mar 29 '17 at 10:28
7

--vault-password-file can instead point to an executable script that writes to stdout. This little-known feature should solve your problem.

First, write a simple, executable script that prints a system environment variable, and check that into your source control. Then, use Bitbucket's encrypted variable feature to set that environment variable to your ansible-vault secret. Finally, execute like so:

ansible-playbook site.yml --vault-password-file ./mypass.sh.

References:

  1. http://docs.ansible.com/ansible/playbooks_vault.html#running-a-playbook-with-vault

  2. https://groups.google.com/forum/#!topic/ansible-devel/1vFc3y6Ogto

  • And then the mypass.sh will contain echo $VAR for example and this var will be set in the BitBucket UI? – 030 Mar 31 '17 at 7:26
  • Yup! Alternatively, here's a Python example: stackoverflow.com/questions/4906977/… – Woodland Hunter Mar 31 '17 at 17:18
  • ([Errno 8] Exec format error). If this is not a script, remove the executable bit from the file. – 030 Apr 10 '17 at 9:05
1

Using

ansible-playbook site.yml --vault-password-file ./mypass.sh

resulted in:

ERROR! Problem running vault password script / p a t h / t o
/ e c h o _ v a u l t _ p a s s . s h ([Errno 8] Exec format error). If this is 
not a script, remove the executable bit from the file.

Based on this post the following was defined in bitbucket-pipelines:

image: docker:latest

pipelines:
  default:
    - step:
        script:
          - echo $ANSIBLE_VAULT_PASSWORD > .vault_password.txt
          - ansible-playbook -i ansible/inventory ansible/site.yml --vault-password-file .vault_password.txt
-1

You could have a test set up that does not run production, and load different files for those.

Create a host_vars/localhost/vault that only works for the local test installation.

That way you could use a open vault password that works only for that local host vault.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.