To be a bit pedantic, all .yml files can be encrypted with ansible-vault, so also playbooks and roles.<p>There are two things currently that bother me about ansible-vault. The first is that the &#x27;edit&#x27; command write a completely new file even if I didn&#x27;t change anything. And the second is that the diffs in git become useless. I&#x27;d love to have a special diff driver for ansible-vault encrypted files that decrypts before diffing when the secret is available.