Implementing DevOps with Ansible 2

Automatically decrypting using password files

The most desirable way to decrypt Ansible vaulted data is to do so without user intervention. This option opens the door for a more flexible automation approach (initiating it through Jenkins, CircleCI, Bamboo, or whatever). To implement this solution, the trick is to store the Ansible vault password within a password file. For example, if we were to have a vars file, we would encrypt it using the encrypt option and then store the key we used to encrypt it in the flat text file. Then, when running the ansible-playbook command, we could pass the vault-password-file directly. The syntax of this is shown next:

$> ansible-playbook -i inventory/qa.hosts playbooks/example.yml --vault-password-file ...