Dynamically include vaulted vars within playbook only for certain hosts

Archives Ansible Project
1

Greetings!

I’m trying to figure out the best way to dynamically include vaulted vars files in a playbook only for certain hosts. The situation is I’m building out production and pre-prod environments from a common playbook, including development (via vagrant) where the vault password will not be available. The vault password wont be distributed anywhere except for the build box. I tried using group_vars, but the problem I run into is ansible tries to decrypt vars files for other hosts when running the playbook in dev where the vault password is not available. The only work-around I could find is to make a task or role that sets those variables using set_fact, and only including that task in the hosts that need it. I’m wondering if there is a better way or if I’m doing it wrong.

`

2

To include variables, use include_vars, not include (this only works
for plays or tasks).

Include_vars is always dynamic, so you just need a when:

    - include_vars: vault_vars/ci_prod/vault.yml
      when: myenv != 'dev'

# example when condition