Deployment with Ansible from Gitlab CI, dealing with passwords

Question

I'm trying to achieve an "password-free" deployment workflow using Gitlab CI and Ansible. Some steps do require a password (I'm already using SSH Keys whenever I can) so I've stored those password inside an Ansible Vault. Next, I would just need to provide the Vault password when running the playbook.

But how could I integrate this nicely with Gitlab CI?

May I register a gitlab-ci job (or jobs are suitable for builds only?), which just runs the playbook providing the vault password somehow?! Can this be achieved without a password laying around in plain text?!

Also, I would be really happy if someone can point me some material that shows how we can deploy builds using Ansible. As you can notice, I've definitively found nothing about that.

Answer 1

You can set an environment variable in the GitLab CI which would hold the Ansible Vault password. In my example i called it $ANSIBLE_VAULT_PASSWORD

Here is the example for .gitlab-ci.yml:

deploy:
  only:
    - master
  script:
    - echo $ANSIBLE_VAULT_PASSWORD > .vault_password.txt
    - ansible-playbook -i ansible/staging.yml --vault-password-file .vault_password.txt

Hope this trick helps you out.