# Feature idea: Adding a vault/ subdir to group\_vars and host\_vars **URL:** \ **Category:** Ansible Project\ **Created:** [May 21, 2014, 2:19pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293 "2014-05-21T14:19:58Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Hagai\_Kariti](https://avatars.discourse-cdn.com/v4/letter/h/4491bb/32.png) [@Hagai\_Kariti](https://forum.ansible.com/u/Hagai_Kariti)\ **Post date:** [May 21, 2014, 2:19pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/1 "2014-05-21T14:19:58Z")
Hi all Using Vault in group\_vars has the downside of losing version control on the vaulted file, so the logical thing is to separate sensitive variables from “normal” ones. What we do is create a vault/ subdirectory under group\_vars and include that in vars\_file. The dir structure looks like this: hosts group\_vars/ vault/ some\_group some\_group And the playbook starts like this: - hosts: some\_group vars: - "{{ inventory\_dir }}/group\_vars/vault/some\_group It seems like a good convention, any thoughts about making it a feature? ---
**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\ **Post date:** [May 21, 2014, 2:32pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/2 "2014-05-21T14:32:55Z")
If it’s meant to be included by vars\_file, that doesn’t seem like a good place to me. Also, this would conflict if one has a ‘vault’ group, as dirs are also allowed in host/group\_vars, instead of plain files. ---
**Author:** ![Hagai\_Kariti](https://avatars.discourse-cdn.com/v4/letter/h/4491bb/32.png) [@Hagai\_Kariti](https://forum.ansible.com/u/Hagai_Kariti)\ **Post date:** [May 21, 2014, 2:39pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/3 "2014-05-21T14:39:32Z")
I currenty use vars\_files because Ansible doesn’t include these files automatically. I was suggesting making a standard place to put vaulted group\_vars (or host\_vars) and gave mine as an example. Do you object to the idea or just my convention? ---
**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\ **Post date:** [May 21, 2014, 2:44pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/4 "2014-05-21T14:44:32Z")
​At least the convention, beneath group\_vars is definetely not the right place​. The idea, I'm not sure what exactly having this standard place would exactly mean? Vault files are just encrypted files, users might want to 'vault' a file at any location they want. Say you have a default vault dir somewhere, what would happen then? ---
**Author:** ![Hagai\_Kariti](https://avatars.discourse-cdn.com/v4/letter/h/4491bb/32.png) [@Hagai\_Kariti](https://forum.ansible.com/u/Hagai_Kariti)\ **Post date:** [May 21, 2014, 2:53pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/5 "2014-05-21T14:53:09Z")
> > I currenty use vars\_files because Ansible doesn’t include these files automatically. I was suggesting making a standard place to put vaulted group\_vars (or host\_vars) and gave mine as an example. > > Do you object to the idea or just my convention? > > ​At least the convention, beneath group\_vars is definetely not the right place​. > The idea, I’m not sure what exactly having this standard place would exactly mean? It’s really the same idea as group\_vars. For each group a host is a member of, two files are included:- The file under group\_vars/, as usual - The vaulted file under the vaulted group\_vars dir This allows you to separate the sensitive and normal parts of your group\_vars, so that you won’t lose version control on the normal parts. > Vault files are just encrypted files, users might want to ‘vault’ a file at any location they want. Same thing can be said about group\_vars. You can include any variable file you want, but having a convention that uses your hostgroup structure is a good thing. ---
**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\ **Post date:** [May 21, 2014, 3:16pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/6 "2014-05-21T15:16:19Z")
​OK, actually, you already can do something similar, what I do: for each group X I have a directory group\_vars/X/ every file in that dir will be loaded for group X then you van have a group\_vars/X/secret.yml e.g. which is vaulted.​ Would that work for you? ---
**Author:** ![Hagai\_Kariti](https://avatars.discourse-cdn.com/v4/letter/h/4491bb/32.png) [@Hagai\_Kariti](https://forum.ansible.com/u/Hagai_Kariti)\ **Post date:** [May 21, 2014, 3:21pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/7 "2014-05-21T15:21:20Z")
Whoa, dude. Didn’t know that trick. Yeah that actually solves my case pretty nicely. Thanks a bunch. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [May 21, 2014, 10:16pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/8 "2014-05-21T22:16:12Z")
“Using Vault in group\_vars has the downside of losing version control on the vaulted file” This is not neccessarily the case. group\_vars/ folders are also loaded if they live alongside the playbook, so that can be a good option. You could also keep the variables in a role vars/ directory and pull them in to hosts that need them. In fact, a role can contain nothing but vars, and that works too! ---
**Author:** ![Hagai\_Kariti](https://avatars.discourse-cdn.com/v4/letter/h/4491bb/32.png) [@Hagai\_Kariti](https://forum.ansible.com/u/Hagai_Kariti)\ **Post date:** [May 22, 2014, 8:57am UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/9 "2014-05-22T08:57:31Z")
> "Using Vault in group\_vars has the downside of losing version control on > the vaulted file" > > This is not neccessarily the case. > > group\_vars/ folders are also loaded if they live alongside the playbook, > so that can be a good option. > > You could also keep the variables in a role vars/ directory and pull them > in to hosts that need them. > > In fact, a role can contain nothing but vars, and that works too! Yeah I know, but that's not helping my specific use case, as I need different sensitive variables based on inventory, not role or playbook. Serge's suggestion was what solved it for me - too bad this feature isn't documented! ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [May 23, 2014, 12:19pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/10 "2014-05-23T12:19:34Z")
Docs are open source and there’s already an open pull request for that in the docs. ---
**Author:** ![Hagai\_Kariti](https://avatars.discourse-cdn.com/v4/letter/h/4491bb/32.png) [@Hagai\_Kariti](https://forum.ansible.com/u/Hagai_Kariti)\ **Post date:** [May 23, 2014, 1:36pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/11 "2014-05-23T13:36:11Z")
Yeah that’s me 🙂 ---
**Author:** ![Chris\_Adams](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@Chris\_Adams](https://forum.ansible.com/u/Chris_Adams)\ **Post date:** [December 9, 2014, 1:14pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/12 "2014-12-09T13:14:33Z")
Hi all, I just came across this after puzzling over how best to use ansible-vault to manage sensitive credentials in group vars, without encrypting everything, and I couldn’t find the pull request for this when looking through the github issues for Would someone share a link to it? Thanks Chris ---
**Author:** ![Hagai\_Kariti](https://avatars.discourse-cdn.com/v4/letter/h/4491bb/32.png) [@Hagai\_Kariti](https://forum.ansible.com/u/Hagai_Kariti)\ **Post date:** [December 9, 2014, 2:28pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/13 "2014-12-09T14:28:48Z")
The pull request for the docs has been merged already. The relevant doc page is here: [http://docs.ansible.com/intro\_inventory.html](http://docs.ansible.com/intro_inventory.html) Just search for ‘vault’ in that page. It doesn’t have info this thread doesn’t though… ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [December 9, 2014, 2:40pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/14 "2014-12-09T14:40:15Z")
You can have subdirectories under group\_vars/groupname/\*.yml if you want, and some of those can be vault encrypted. ---
**Author:** ![Igor\_Homyakov](https://avatars.discourse-cdn.com/v4/letter/i/f4b2a3/32.png) [@Igor\_Homyakov](https://forum.ansible.com/u/Igor_Homyakov)\ **Post date:** [December 9, 2014, 2:51pm UTC](https://forum.ansible.com/t/feature-idea-adding-a-vault-subdir-to-group-vars-and-host-vars/15293/15 "2014-12-09T14:51:38Z")
Hi, I'm using a following naming scheme in my projects [inventory\_group]/secret/self-documented-name.yml for example : group\_vars ├── all │ └── secret │ ├── deployment\_keys.yml │ ├── api\_keys.yml │ └── hipchat\_token.yml ├── redis │ └── secret │ └── aws.yml └── webapp    └── secret       └── ssl.yml I hope it would be useful. -- Best, Igor