# Best way to provide vault password in CI **URL:** \ **Category:** Ansible Developer\ **Tags:** azure\ **Created:** [September 15, 2020, 9:45pm UTC](https://forum.ansible.com/t/best-way-to-provide-vault-password-in-ci/33819 "2020-09-15T21:45:41Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Luke\_Schlather](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Luke\_Schlather](https://forum.ansible.com/u/Luke_Schlather)\ **Post date:** [September 15, 2020, 9:45pm UTC](https://forum.ansible.com/t/best-way-to-provide-vault-password-in-ci/33819/1 "2020-09-15T21:45:41Z")
I’m trying to figure out what the best way to provide a vault password for a CI process is. My organization uses Azure Devops, where it is standard to create a secret environment variable, and make that available to the agent which runs my Ansible playbooks. This is also common to other CI systems I have used such as Gitlab, Bamboo, Jenkins, and Github Actions. I found [this issue](https://github.com/ansible/ansible/issues/45214) in which someone claimed that it was insecure to store secrets in environment variables and used that as justification for closing the ticket - however in the typical access pattern this makes my CI pipeline less secure, since I still provide the secret as an environment variable - but now Ansible also forces me to write the secret to disk, introducing another set of vulnerabilities to my application (especially since the agent may be running on shared hardware.) Environment variables seem like the industry-standard mechanism in CI for sharing secrets with an agent process to run things like Ansible playbooks. It’s perplexing that Ansible has chosen not to support this. There is a workaround, but it’s very frustrating that the workaround actually decreases the security of the system relative to the straightforward solution of Ansible simply expecting a standard environment variable for the password. I’m rather perplexed and frustrated by the decision to close [https://github.com/ansible/ansible/issues/45214](https://github.com/ansible/ansible/issues/45214) ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [September 15, 2020, 10:04pm UTC](https://forum.ansible.com/t/best-way-to-provide-vault-password-in-ci/33819/2 "2020-09-15T22:04:23Z")
Follow the advice in [https://github.com/ansible/ansible/issues/45214#issuecomment-502300660](https://github.com/ansible/ansible/issues/45214#issuecomment-502300660) ---
**Author:** ![Luke\_Schlather](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Luke\_Schlather](https://forum.ansible.com/u/Luke_Schlather)\ **Post date:** [September 15, 2020, 10:32pm UTC](https://forum.ansible.com/t/best-way-to-provide-vault-password-in-ci/33819/3 "2020-09-15T22:32:15Z")
It’s a secure workaround - it is annoying though. And it adds complexity to a very common use case. ---
**Author:** ![f.floimair.commend](https://avatars.discourse-cdn.com/v4/letter/f/3da27b/32.png) [@f.floimair.commend](https://forum.ansible.com/u/f.floimair.commend)\ **Post date:** [September 16, 2020, 2:04pm UTC](https://forum.ansible.com/t/best-way-to-provide-vault-password-in-ci/33819/4 "2020-09-16T14:04:23Z")
Fully agree with you! It’s a pity that this isn’t supported via environment variable. Also in the linked issue it is very well argued why the “workaround” is way more unsafe and violates more rules than the environment variable would. **FLORIAN FLOIMAIR** Software Development - IMS Commend International GmbH Saalachstrasse 51 5020 Salzburg, Austria **[commend.com](http://commend.com)** LG Salzburg / FN 178618z ---
**Author:** ![Luke\_Schlather](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Luke\_Schlather](https://forum.ansible.com/u/Luke_Schlather)\ **Post date:** [September 17, 2020, 9:45pm UTC](https://forum.ansible.com/t/best-way-to-provide-vault-password-in-ci/33819/5 "2020-09-17T21:45:55Z")
Wait, I think the advice in [https://github.com/ansible/ansible/issues/45214#issuecomment-502300660](https://github.com/ansible/ansible/issues/45214#issuecomment-502300660) is flat-out wrong. Ansible doesn’t evaluate the bash, it just uses the script as the password. That is really dangerous to have that given out as “the way to do it.” People will think it’s right and end up basically using no password. There is an obvious workaround that involves writing the password to a temp file, but again, this makes the entire system less secure. ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [September 17, 2020, 9:47pm UTC](https://forum.ansible.com/t/best-way-to-provide-vault-password-in-ci/33819/6 "2020-09-17T21:47:07Z")
You have to make the script executable, otherwise it’s just a random file that is read. If you make it executable, ansible will execute it, and take the password from stdout of the script. ---
**Author:** ![Luke\_Schlather](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Luke\_Schlather](https://forum.ansible.com/u/Luke_Schlather)\ **Post date:** [September 17, 2020, 9:50pm UTC](https://forum.ansible.com/t/best-way-to-provide-vault-password-in-ci/33819/7 "2020-09-17T21:50:20Z")
This is a really bad interface that IMO shouldn’t even be there. It is incredibly easy to misuse and seems really complicated feature which seems to exist for the purpose of not adding a simple and easy-to-use feature. ---
**Author:** ![Luke\_Schlather](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Luke\_Schlather](https://forum.ansible.com/u/Luke_Schlather)\ **Post date:** [September 17, 2020, 9:52pm UTC](https://forum.ansible.com/t/best-way-to-provide-vault-password-in-ci/33819/8 "2020-09-17T21:52:00Z")
At the least, the overloading of --vault-password-file seems wrong. There should be a separate option --vault-password-script. (Though again, this seems like a very complicated way to avoid adding a simpler feature that would be better and easier to use.) ---
**Author:** ![Richard\_Megginson](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/richard_megginson/32/4540_2.png) [@Richard\_Megginson](https://forum.ansible.com/u/Richard_Megginson)\ **Post date:** [September 17, 2020, 10:26pm UTC](https://forum.ansible.com/t/best-way-to-provide-vault-password-in-ci/33819/9 "2020-09-17T22:26:16Z")
> At the least, the overloading of --vault-password-file seems wrong. There should be a separate option --vault-password-script. (Though again, this seems like a very complicated way to avoid adding a simpler feature that would be better and easier to use.) Well, it is more or less consistent with the way --inventory works. ---
**Author:** ![Luke\_Schlather](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Luke\_Schlather](https://forum.ansible.com/u/Luke_Schlather)\ **Post date:** [September 17, 2020, 10:31pm UTC](https://forum.ansible.com/t/best-way-to-provide-vault-password-in-ci/33819/10 "2020-09-17T22:31:08Z")
Inventory has a better failure mode though. If you forget to set the executable bit on your inventory plugin, your playbook is almost certain to fail. Even if it succeeds, you will probably notice nothing happened. If you forget to set the executable bit on a vault password plugin, the plugin source code will be used as the password and you will be none the wiser that your vault is basically obfuscated and not meaningfully encrypted at all.