You can also use vaults with ansible-playbook. You'll need to decrypt the file on-the-fly using a command such as the following:
$ ansible-playbook site.yml --vault-password-file .password
There is yet another option that allows you to decrypt files using a script, which can then look up some other source and decrypt the file. This can also be a useful option to provide more security. However, make sure that the get_password.py script has executable permissions:
$ ansible-playbook site.yml --vault-password-file ~/.get_password.py
Before closing this chapter, I'd like to speak a little bit about the password file. This file needs to be present on the machine where you execute your playbooks, in a location and with permissions so that it is readable by the user who is executing the playbook. You can create the .password file at startup.
The . character...