Answers: <p>Sometimes docs have the habit that they are talking about everything, except what is needed. It might be also an ansible bug, I do not know - in some hours, I could finally find some example similar extra vars, and these seemed working well.</p>
  <p>After source debugging I found that this extra_vars file format has to follow a syntax organized after the hosts or host groups. To define extra vars visible everywhere, we need this syntax:</p>
  <pre><code>---
  all:
    vars:
      somewhere_a_password: fds3t435re
      other_key: 4352kjh3kj435
      thing_i_wont_say: 3245lkh243k5jh
  </code></pre>
  <p>In general, how things look in the brain of the ansible, this playbook might help a lot:</p>
  <pre><code>- name: Print debugging info
    hosts:
      - &lt;any host you have, does not matter&gt;
    gather_facts: no
    tasks:
      - name: print debug info
        ansible.builtin.debug:
          #var: ansible_facts
          #var: inventory_hostname
          var: vars
          verbosity: 4
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2024-04-14T18:26:26.920Z
Answers: If a better answer happens, that will get the pipe.
Answers: peterh
Answers: CC BY-SA 4.0
Answers: 2024-04-14T18:26:06.890Z
Answers: 2024-04-14T19:16:31.593Z
Answers: 2024-04-14T19:16:31.593Z
Answers: peterh
Body: <p>I am thinking on a trival secret ansible vault:</p>
  <p>I have a <code>secret.yml</code> in my inventory, which is the single encrypted file in my ansible workspace, containing all the secret data. Its structure is very simple:</p>
  <pre><code>somewhere_a_password: fds3t435re
  other_key: 4352kjh3kj435
  thing_i_wont_say: 3245lkh243k5jh
  </code></pre>
  <p>I want to refer the keys in this yml in my whole workspace (which is organized anyways as usual).</p>
  <p>I am calling ansible with this:</p>
  <pre><code>ansible-playbook -i ./inv/ --ask-vault-pass -e @./inv/secret.yml -vvvv playbooks/$1.yml
  </code></pre>
  <p>So, my <code>secret.yml</code> must be included! And yes, of course it is asking for my vault pass.</p>
  <p>I refer the secret keys in my tasks, for example, on this way:</p>
  <pre><code>- name: Create postgresql user
    community.postgresql.postgresql_user:
      name: a_user
      password: &quot;{{ somewhere_a_password }}&quot;
      state: present
    become: yes
    become_user: postgres
  </code></pre>
  <p>However, I get this error:</p>
  <pre><code>[WARNING]: Skipping 'somewhere_a_password' as this is not a valid group definition
  </code></pre>
  <p>Why? What is going on? Unfortunately, ansible-vault does not deserve a medal for its documentation quality.</p>
  
Tags: <ansible>
Title: How to include a simple ansible vault file and refer its content from the whole ansible workspace?
UserDisplayName: peterh
ThreadText: # How to include a simple ansible vault file and refer its content from the whole ansible workspace?
  
  (Asked by: username_0 on 2024-04-14)
  
  I am thinking on a trival secret ansible vault:
  
  I have a `secret.yml` in my inventory, which is the single encrypted file in my ansible workspace, containing all the secret data. Its structure is very simple:
  
  ```
  somewhere_a_password: fds3t435re
  other_key: 4352kjh3kj435
  thing_i_wont_say: 3245lkh243k5jh
  
  ```
  
  I want to refer the keys in this yml in my whole workspace (which is organized anyways as usual).
  
  I am calling ansible with this:
  
  ```
  ansible-playbook -i ./inv/ --ask-vault-pass -e @./inv/secret.yml -vvvv playbooks/$1.yml
  
  ```
  
  So, my `secret.yml` must be included! And yes, of course it is asking for my vault pass.
  
  I refer the secret keys in my tasks, for example, on this way:
  
  ```
  - name: Create postgresql user
    community.postgresql.postgresql_user:
      name: a_user
      password: "{{ somewhere_a_password }}"
      state: present
    become: yes
    become_user: postgres
  
  ```
  
  However, I get this error:
  
  ```
  [WARNING]: Skipping 'somewhere_a_password' as this is not a valid group definition
  
  ```
  
  Why? What is going on? Unfortunately, ansible-vault does not deserve a medal for its documentation quality.
  
  **Tags:** ansible
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2024-04-14. Score: 0
  
  Sometimes docs have the habit that they are talking about everything, except what is needed. It might be also an ansible bug, I do not know - in some hours, I could finally find some example similar extra vars, and these seemed working well.
  
  After source debugging I found that this extra\_vars file format has to follow a syntax organized after the hosts or host groups. To define extra vars visible everywhere, we need this syntax:
  
  ```
  ---
  all:
    vars:
      somewhere_a_password: fds3t435re
      other_key: 4352kjh3kj435
      thing_i_wont_say: 3245lkh243k5jh
  
  ```
  
  In general, how things look in the brain of the ansible, this playbook might help a lot:
  
  ```
  - name: Print debugging info
    hosts:
      - <any host you have, does not matter>
    gather_facts: no
    tasks:
      - name: print debug info
        ansible.builtin.debug:
          #var: ansible_facts
          #var: inventory_hostname
          var: vars
          verbosity: 4
  
  ```
  
  > **Comments:**
  > **username_0**: If a better answer happens, that will get the pipe.  
  
  ---
  
  