<p>Sometimes docs have the habit that they are talking about everything, except what is needed. It might be also an ansible bug, I do not know - in some hours, I could finally find some example similar extra vars, and these seemed working well.</p>
<p>After source debugging I found that this extra_vars file format has to follow a syntax organized after the hosts or host groups. To define extra vars visible everywhere, we need this syntax:</p>
<pre><code>---
all:
  vars:
    somewhere_a_password: fds3t435re
    other_key: 4352kjh3kj435
    thing_i_wont_say: 3245lkh243k5jh
</code></pre>
<p>In general, how things look in the brain of the ansible, this playbook might help a lot:</p>
<pre><code>- name: Print debugging info
  hosts:
    - &lt;any host you have, does not matter&gt;
  gather_facts: no
  tasks:
    - name: print debug info
      ansible.builtin.debug:
        #var: ansible_facts
        #var: inventory_hostname
        var: vars
        verbosity: 4
</code></pre>

CC BY-SA 4.0
2024-04-14T18:26:26.920Z
If a better answer happens, that will get the pipe.
peterh
CC BY-SA 4.0
2024-04-14T18:26:06.890Z
2024-04-14T19:16:31.593Z
2024-04-14T19:16:31.593Z
peterh
<p>I am thinking on a trival secret ansible vault:</p>
<p>I have a <code>secret.yml</code> in my inventory, which is the single encrypted file in my ansible workspace, containing all the secret data. Its structure is very simple:</p>
<pre><code>somewhere_a_password: fds3t435re
other_key: 4352kjh3kj435
thing_i_wont_say: 3245lkh243k5jh
</code></pre>
<p>I want to refer the keys in this yml in my whole workspace (which is organized anyways as usual).</p>
<p>I am calling ansible with this:</p>
<pre><code>ansible-playbook -i ./inv/ --ask-vault-pass -e @./inv/secret.yml -vvvv playbooks/$1.yml
</code></pre>
<p>So, my <code>secret.yml</code> must be included! And yes, of course it is asking for my vault pass.</p>
<p>I refer the secret keys in my tasks, for example, on this way:</p>
<pre><code>- name: Create postgresql user
  community.postgresql.postgresql_user:
    name: a_user
    password: &quot;{{ somewhere_a_password }}&quot;
    state: present
  become: yes
  become_user: postgres
</code></pre>
<p>However, I get this error:</p>
<pre><code>[WARNING]: Skipping 'somewhere_a_password' as this is not a valid group definition
</code></pre>
<p>Why? What is going on? Unfortunately, ansible-vault does not deserve a medal for its documentation quality.</p>

<ansible>
How to include a simple ansible vault file and refer its content from the whole ansible workspace?
peterh
# How to include a simple ansible vault file and refer its content from the whole ansible workspace?

(Asked by: username_0 on 2024-04-14)

I am thinking on a trival secret ansible vault:
I have a secret.yml in my inventory, which is the single encrypted file in my ansible workspace, containing all the secret data. Its structure is very simple:
somewhere_a_password: fds3t435re
other_key: 4352kjh3kj435
thing_i_wont_say: 3245lkh243k5jh

I want to refer the keys in this yml in my whole workspace (which is organized anyways as usual).
I am calling ansible with this:
ansible-playbook -i ./inv/ --ask-vault-pass -e @./inv/secret.yml -vvvv playbooks/$1.yml

So, my secret.yml must be included! And yes, of course it is asking for my vault pass.
I refer the secret keys in my tasks, for example, on this way:
- name: Create postgresql user
  community.postgresql.postgresql_user:
    name: a_user
    password: "{{ somewhere_a_password }}"
    state: present
  become: yes
  become_user: postgres

However, I get this error:
[WARNING]: Skipping 'somewhere_a_password' as this is not a valid group definition

Why? What is going on? Unfortunately, ansible-vault does not deserve a medal for its documentation quality.

**Tags:** ansible


---

## 1 answers

### Answer by username_0 on 2024-04-14. Score: 0

Sometimes docs have the habit that they are talking about everything, except what is needed. It might be also an ansible bug, I do not know - in some hours, I could finally find some example similar extra vars, and these seemed working well.
After source debugging I found that this extra_vars file format has to follow a syntax organized after the hosts or host groups. To define extra vars visible everywhere, we need this syntax:
---
all:
  vars:
    somewhere_a_password: fds3t435re
    other_key: 4352kjh3kj435
    thing_i_wont_say: 3245lkh243k5jh

In general, how things look in the brain of the ansible, this playbook might help a lot:
- name: Print debugging info
  hosts:
    - 
  gather_facts: no
  tasks:
    - name: print debug info
      ansible.builtin.debug:
        #var: ansible_facts
        #var: inventory_hostname
        var: vars
        verbosity: 4

> **Comments:**
> **username_0**: If a better answer happens, that will get the pipe.  

---

