Q: You need to rotate database credentials across 80 microservices. How do you integrate Ansible Vault with automated CI/CD pipelines without exposing keys in console logs?
Manage sensitive credentials in Git using AES-256 encrypted Ansible Vault files. In CI/CD pipelines, inject vault passwords via protected ephemeral environment variables, use no_log: true to prevent stdout leaks, and execute non-interactively.
Want to master this scenario in a live sandbox? KodeKloud's CKA & CKAD Hands-On Certification Track covers this exact problem with hands-on terminal drills.
🛠️ Production Runbook & Step-by-Step Resolution
Structure Encrypted Vault Variables
Store secrets in an encrypted YAML file committed directly into the Git repository alongside the playbook, keeping sensitive tokens separate from standard variables:
ansible-vault create group_vars/all/vault.yml- Define structured variables:
vault_db_password: 'SuperSecretString2026' - Encrypt existing plain text variables using
ansible-vault encrypt_string --name 'db_password' 'SecretVal'to embed secrets directly in plaintext YAML files.
Inject Vault Passwords Non-Interactively in CI/CD
Never store plaintext vault passwords in Git or disk volumes. Inject credentials via runner secrets into an ephemeral RAM file:
- In GitHub Actions / GitLab CI, store the vault decryption password in a masked secret (
ANSIBLE_VAULT_PASSWORD). - Write password to a temporary ramdisk file:
echo "$ANSIBLE_VAULT_PASSWORD" > /dev/shm/.vault_pass - Execute non-interactively:
ansible-playbook -i hosts deploy.yml --vault-password-file /dev/shm/.vault_pass - Clean up immediately in pipeline post-steps:
rm -f /dev/shm/.vault_pass
Mask Console Logs with no_log: true
Ansible by default prints task parameters in stdout upon completion, which exposes decrypted secrets in CI/CD build logs:
- Annotate all secret-consuming tasks with
no_log: true. - Even if the task fails, Ansible replaces parameter values with
"censored": "the output has been hidden due to the fact that 'no_log: true' was specified". - Set
display_skipped_hosts = Falseto minimize log clutter.
- Encrypt sensitive variables with AES-256 using 'ansible-vault' or 'encrypt_string' and version control them in Git.
- Store the vault decryption key in CI/CD masked secret vaults (GitHub Secrets / HashiCorp Vault).
- Inject the key at runtime into in-memory temporary storage (/dev/shm/.vault_pass) or pass ANSIBLE_VAULT_PASSWORD_FILE.
- Enforce 'no_log: true' on all template, URI, and database tasks to suppress secret output from CI console logs.
- Rotate credentials seamlessly using 'ansible-vault rekey group_vars/all/vault.yml'.
- Use separate vault-ids (e.g. --vault-id dev@prompt, --vault-id prod@file) for fine-grained multi-environment access.
Senior hiring managers and bar raisers evaluate how you prioritize during outages. Avoid these common anti-patterns:
- Omitting no_log: true on secret-consuming tasks CI/CD build logs permanently store task inputs in plaintext, exposing rotated database credentials to anyone with repository read access.
- Storing vault password files permanently on disk or inside Docker images Defeats the purpose of encryption if build containers or runner disks can be snapshotted or inspected.
- Using a single global vault password for dev, staging, and production Violates least-privilege security principles. Use Ansible vault-id to maintain separate keys across environments.