Vault Secrets in a Pipeline
Decrypt safely in CI without leaks.
Vault Secrets in a Pipeline is a free Ansible Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ansible Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Pipeline Secret Problem
Your encrypted vault files are safe in git, but the runner still needs the vault password to decrypt them at run time. 🔐
Never Commit the Password
The one thing that must stay out of the repo is the vault password itself. Storing it in CI secrets keeps it out of history.
Store It in CI Secrets
Put the password in a GitHub Secret like VAULT_PASSWORD, where it is masked in logs and only injected at run time.
env:
VAULT_PASS: ${{ secrets.VAULT_PASSWORD }}Write a Temp Password File
In a step, write the secret to a short-lived password file the runner can hand to Ansible during the play.
- run: echo "$VAULT_PASS" > .vault_passDecrypt with vault-password-file
Point the play at that file with --vault-password-file, so Ansible decrypts vault content without any prompt.
ansible-playbook site.yml \
--vault-password-file .vault_passOr Use the Env Var
Ansible also reads ANSIBLE_VAULT_PASSWORD_FILE, so you can set it once instead of passing the flag every command.
export ANSIBLE_VAULT_PASSWORD_FILE=.vault_passNo --ask-vault-pass in CI
The interactive --ask-vault-pass waits for a human, so it hangs a pipeline. Always feed the password from a file instead.
Always Clean It Up
Delete the temp file when the job ends. An always step guarantees cleanup even if the playbook fails midway.
- if: always()
run: rm -f .vault_passMask, Do Not Echo
CI auto-masks registered secrets in logs, but never echo the password yourself, since manual output can defeat that masking.
Name Multiple Vault IDs
With several vaults, give each a vault ID so prod and staging secrets are decrypted with their own passwords.
--vault-id prod@.prod_pass \
--vault-id stage@.stage_passRotate Without a Redeploy
Changing the CI secret rotates the password for the whole pipeline at once, with no code change needed.
Quick Check
How should a pipeline supply the vault password?
Recap: Secrets Stay Secret
You decrypted vault in CI safely: store the password as a secret, feed it via a password file, skip prompts, and clean up after. 🔒
Frequently asked questions
Is the “Vault Secrets in a Pipeline” lesson free?
Yes — the full text of “Vault Secrets in a Pipeline” is free to read here on the web, and the Ansible Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ansible Academy course, upgrade to CoddyKit PRO.
What will I learn in “Vault Secrets in a Pipeline”?
Decrypt safely in CI without leaks. You practise Ansible Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Ansible Academy?
No prior experience is required. Ansible Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Vault Secrets in a Pipeline” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Ansible Academy lesson?
Yes. Every Ansible Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- ansible-lint as a Quality Gate
- Run Playbooks in GitHub Actions
- Vault Secrets in a Pipeline
- Gated Deploys with Approvals & Check Mode