1

How do I ignore the group_vars vault file when running ansible-pull?

My repository (among other stuff) does machine init, joining the domain and software updates. I would like the software part to be handled by ansible-pull. No passwords are required for this, and no vault is necessary.

Unfortunately, initial machine setup after a fresh install does require some passwords which are set in group_vars/all.yml and is encrypted by vault. Whenever I run the ansible-pull command I run into vault decryption issues as there is no password provided.

Any advice on how to overcome this?

Improve this question
2
  • I'd say it sounds like you need to split your repo into two repos.
    – chicks
    Oct 10, 2019 at 16:56
  • Thanks Chicks. Though I prefer to keep everything together. I know I could work with submodules in git, but it seems such a hassle...
    – Frank Vermeulen
    Oct 14, 2019 at 8:28

1 Answer 1

Reset to default
1

Eventually I just got rid of the group_vars all together. I specified a new role that includes several other roles with 'include_role:' and added the vars directly to those roles with inline-vault variables:

- name: include ipaclient
  include_role:
    name: ipaclient
  vars:
    my_user: user
    my_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          123456123456123456123456123456132456...
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.