<p>Eventually I just got rid of the group_vars all together.
I specified a new role that includes several other roles with 'include_role:' and added the vars directly to those roles with inline-vault variables:</p>

<pre><code>- name: include ipaclient
  include_role:
    name: ipaclient
  vars:
    my_user: user
    my_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          123456123456123456123456123456132456...
</code></pre>

CC BY-SA 4.0
2019-10-14T08:31:19.293Z
2019-10-14T08:31:19.293Z
Frank Vermeulen
<p>How do I ignore the <code>group_vars</code> vault file when running ansible-pull?</p>

<p>My repository (among other stuff) does machine init, joining the domain and software updates. I would like the software part to be handled by ansible-pull. No passwords are required for this, and no vault is necessary.</p>

<p>Unfortunately, initial machine setup after a fresh install does require some passwords which are set in <code>group_vars/all.yml</code> and is encrypted by vault. Whenever I run the <code>ansible-pull</code> command I run into vault decryption issues as there is no password provided.</p>

<p>Any advice on how to overcome this?</p>

CC BY-SA 4.0
2019-10-10T16:56:49.937Z
I'd say it sounds like you need to split your repo into two repos.
chicks
CC BY-SA 4.0
2019-10-14T08:28:06.747Z
Thanks Chicks. Though I prefer to keep everything together. I know I could work with submodules in git, but it seems such a hassle...
Frank Vermeulen
<ansible><ansible-vault>
ansible-pull ignore group_vars vault
Frank Vermeulen
# ansible-pull ignore group_vars vault

(Asked by: username_0 on 2019-10-10)

How do I ignore the `group_vars` vault file when running ansible-pull?

My repository (among other stuff) does machine init, joining the domain and software updates. I would like the software part to be handled by ansible-pull. No passwords are required for this, and no vault is necessary.

Unfortunately, initial machine setup after a fresh install does require some passwords which are set in `group_vars/all.yml` and is encrypted by vault. Whenever I run the `ansible-pull` command I run into vault decryption issues as there is no password provided.

Any advice on how to overcome this?

**Tags:** ansible, ansible-vault

> **Comments:**
> **username_1**: I'd say it sounds like you need to split your repo into two repos.  
> **username_0**: Thanks Chicks. Though I prefer to keep everything together. I know I could work with submodules in git, but it seems such a hassle...  

---

## 1 answers

### Answer by username_0 on 2019-10-14. Score: 1

Eventually I just got rid of the group_vars all together.
I specified a new role that includes several other roles with 'include_role:' and added the vars directly to those roles with inline-vault variables:
- name: include ipaclient
  include_role:
    name: ipaclient
  vars:
    my_user: user
    my_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          123456123456123456123456123456132456...


---

