Answers: <p>Eventually I just got rid of the group_vars all together.
  I specified a new role that includes several other roles with 'include_role:' and added the vars directly to those roles with inline-vault variables:</p>
  
  <pre><code>- name: include ipaclient
    include_role:
      name: ipaclient
    vars:
      my_user: user
      my_password: !vault |
            $ANSIBLE_VAULT;1.1;AES256
            123456123456123456123456123456132456...
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2019-10-14T08:31:19.293Z
Answers: 2019-10-14T08:31:19.293Z
Answers: Frank Vermeulen
Body: <p>How do I ignore the <code>group_vars</code> vault file when running ansible-pull?</p>
  
  <p>My repository (among other stuff) does machine init, joining the domain and software updates. I would like the software part to be handled by ansible-pull. No passwords are required for this, and no vault is necessary.</p>
  
  <p>Unfortunately, initial machine setup after a fresh install does require some passwords which are set in <code>group_vars/all.yml</code> and is encrypted by vault. Whenever I run the <code>ansible-pull</code> command I run into vault decryption issues as there is no password provided.</p>
  
  <p>Any advice on how to overcome this?</p>
  
Comments: CC BY-SA 4.0
Comments: 2019-10-10T16:56:49.937Z
Comments: I'd say it sounds like you need to split your repo into two repos.
Comments: chicks
Comments: CC BY-SA 4.0
Comments: 2019-10-14T08:28:06.747Z
Comments: Thanks Chicks. Though I prefer to keep everything together. I know I could work with submodules in git, but it seems such a hassle...
Comments: Frank Vermeulen
Tags: <ansible><ansible-vault>
Title: ansible-pull ignore group_vars vault
UserDisplayName: Frank Vermeulen
ThreadText: # ansible-pull ignore group_vars vault
  
  (Asked by: username_0 on 2019-10-10)
  
  How do I ignore the `group_vars` vault file when running ansible-pull?
  
  My repository (among other stuff) does machine init, joining the domain and software updates. I would like the software part to be handled by ansible-pull. No passwords are required for this, and no vault is necessary.
  
  Unfortunately, initial machine setup after a fresh install does require some passwords which are set in `group_vars/all.yml` and is encrypted by vault. Whenever I run the `ansible-pull` command I run into vault decryption issues as there is no password provided.
  
  Any advice on how to overcome this?
  
  **Tags:** ansible, ansible-vault
  
  > **Comments:**
  > **username_1**: I'd say it sounds like you need to split your repo into two repos.  
  > **username_0**: Thanks username_1. Though I prefer to keep everything together. I know I could work with submodules in git, but it seems such a hassle...  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2019-10-14. Score: 1
  
  Eventually I just got rid of the group\_vars all together.
  I specified a new role that includes several other roles with 'include\_role:' and added the vars directly to those roles with inline-vault variables:
  
  ```
  - name: include ipaclient
    include_role:
      name: ipaclient
    vars:
      my_user: user
      my_password: !vault |
            $ANSIBLE_VAULT;1.1;AES256
            123456123456123456123456123456132456...
  
  ```
  
  
  ---
  
  