Ansible global encrypted variable

Question

Suppose I have just one vault file, containing a bunch of variables I want to keep secret. Is there a way to load the file in Ansible just once, and then globally accessible to all roles and all tasks?

Basically I don't like to replicate var_files everywhere, like this:

- hosts: webserver
  var_files: encrypted.yml
  roles: ....

- hosts: dbserver
  var_files: encrypted.yml
  roles: ....  

Answer 1

You can use group_vars, which are variable files that load automatically according to the groups a host is a member of. All hosts are members of the all group, so you can put your common variables in group_vars/all.

The group_vars dir can be relative to (with decreasing priority): the playbook, the inventory file or in /etc/ansible.

If you want to separate encrypted and unencrypted common variables, you can use it as a directory as well:

• group_vars/all/settings.yml for the normal variables
• group_vars/all/encrypted.yml for the vaulted ones.

If you don't like my choice of filenames, choose your own, it doesn't matter, as long it's under the all group.