Ansible Roles Explained with Examples - group_vars variable & linting
Ansible Roles Explained with Examples - group_vars variable & linting
You should encrypt sensitive or secret variables with Ansible Vault. However, encrypting the variable names as well as the variable values makes it hard to find the source of the values. You can keep the names of your variables accessible (by grep, for example) without exposing any secrets by adding a layer of indirection:
Create a group_vars/ subdirectory named after the group.
Inside this subdirectory, create two files named vars and vault.
In the vars file, define all of the variables needed, including any sensitive ones.
Copy all of the sensitive variables over to the vault file and prefix these variables with vault_.
Adjust the variables in the vars file to point to the matching vault_ variables using jinja2 syntax: db_password: {{ vault_db_password }}.
Encrypt the vault file to protect its contents.
Use the variable name from the vars file in your playbooks.