Q: "Does the hosts: all pattern only match hosts specified in inventory, or does it also match add_host hosts?"
A: Simple test shows hosts: all includes also added hosts by add_host. In the same playbook, of course. The dynamic groups live inside a playbook only.
Given the inventory
shell> cat hosts
- name: Only 2 ...
There are pros and cons for both options:
A single master key for your Ansible account would reduce complexity but you would need to ensure the private key is very secure, even if the key were password protected you would want to ensure the key is encrypted at rest with a tool like BlackBox and backed up somewhere.
System unique SSH keys would help with ...
There are a couple of things here:
The indent of "with_items" on the debug module is wrong, it should the same level as the "debug" word.
More importantly, in this case the "with_items" variable on the debug is wrong. When you added "register" to the cli_command module, you actually said "collect the output from ...
This sounds like you are applying Ansible playbooks locally on peoples workstations.
The best way to protect this would be applying the playbooks using a remote system, like AWX or a CI system such as GitHub Actions or TeamCity. The CI system would have the ability to decrypt the vault and run the playbooks.
Mostly the CI system can expose the vault password ...
You can use kustomization to run kubectl commands/apply files and can achieve the deployment.
However if you really want to get into the k8s ecosystem you can have look into the various tools available for a more controlled deployment workflow.
Packaging:- Manage/package your k8s objects.E.g Helm,jsonnet
Helm Repository:- Centralised helm chart repository. ...