# How to include a variable vault in inventory.ini or ansible.cfg **URL:** \ **Category:** Get Help\ **Tags:** rhel9, ansible-vault\ **Created:** [December 5, 2024, 6:31am UTC](https://forum.ansible.com/t/how-to-include-a-variable-vault-in-inventory-ini-or-ansible-cfg/38906 "2024-12-05T06:31:54Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![halloleo](https://avatars.discourse-cdn.com/v4/letter/h/ccd318/32.png) [@halloleo](https://forum.ansible.com/u/halloleo)\ **Post date:** [December 5, 2024, 6:31am UTC](https://forum.ansible.com/t/how-to-include-a-variable-vault-in-inventory-ini-or-ansible-cfg/38906/1 "2024-12-05T06:31:55Z")
I have a vault file in `vault/secrets.enc` with some credential definitions. When I add the file on the command line like this: ```auto ansible-playbook myplay.yml -e '@vault/secrets.enc' --ask-vault-pass ``` it works perfectly. But how can I include this encrypted variables file in `inventory.ini` or `ansible.cfg`, so that I don’t need to add it on each CLI invocation? I tried setting `vars_files`, but could not make it work. _Note:_ I would like to avoid changing my play files for this, because they should work even with a plain `-K` invocation as well. Thanks for any pointers! ---
**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\ **Post date:** [December 5, 2024, 6:43pm UTC](https://forum.ansible.com/t/how-to-include-a-variable-vault-in-inventory-ini-or-ansible-cfg/38906/2 "2024-12-05T18:43:55Z")
Make it part of inventory: ```auto inventory.ini group_vars/ all/ secrets.enc main.yml # what you normally have in all.yml ``` ---
**Author:** ![halloleo](https://avatars.discourse-cdn.com/v4/letter/h/ccd318/32.png) [@halloleo](https://forum.ansible.com/u/halloleo)\ **Post date:** [December 5, 2024, 9:08pm UTC](https://forum.ansible.com/t/how-to-include-a-variable-vault-in-inventory-ini-or-ansible-cfg/38906/3 "2024-12-05T21:08:07Z")
Thank you for your suggestion! > [@bcoca](#): > > ```auto > inventory.ini > group_vars/ > > ``` I don’t really understand what you mean: Do I write “groups\_vars/” in the `inventory.ini` file? In which section? What exactly do I add to the INI file to include the vault file? ---
**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\ **Post date:** [December 5, 2024, 9:11pm UTC](https://forum.ansible.com/t/how-to-include-a-variable-vault-in-inventory-ini-or-ansible-cfg/38906/4 "2024-12-05T21:11:37Z")
not inside the file, what i posted above represents the file system. It uses a ‘vars plugin’, the one shipped with ansible itself (host\_group\_vars) which will look in directories adjacent to the inventory source file ( group\_vars/ and host\_vars/) to populate variables for the hosts that have matching group or host name. The ‘all’ group applies to all hosts and i use it as a directory so you can have multiple files, one of them vaulted. ---
**Author:** ![halloleo](https://avatars.discourse-cdn.com/v4/letter/h/ccd318/32.png) [@halloleo](https://forum.ansible.com/u/halloleo)\ **Post date:** [December 6, 2024, 7:22am UTC](https://forum.ansible.com/t/how-to-include-a-variable-vault-in-inventory-ini-or-ansible-cfg/38906/5 "2024-12-06T07:22:00Z")
Ok, makes sense. Thanks. Hoping to understand your details correctly I just have tried the following directory structure: ```auto tree automate automate ├── all │ └── secrets.enc ├── inventory.ini └── myplay.yml ``` (`automate` is my directory with all Ansible stuff.) However when I run ``` ansible-playbook myplay.yml --ask-vault-pass ``` I get the error “_The field ‘become\_pass’ has an invalid value,_ […]”, while ``` ansible-playbook myplay.yml -e '@all/secrets.enc' --ask-vault-pass ``` works as expected. Do I have to enable the `vars_plugin` (via my an sible.cfg I guess)? Is it part of the normal Ansible distro? (I’m on a machine without Internet.) Or even better, is there a way to load the `secrets.enc` file without an extra plugin, just with some directives in a config file? ---
**Author:** ![bvitnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bvitnik/32/4132_2.png) [@bvitnik](https://forum.ansible.com/u/bvitnik)\ **Post date:** [December 6, 2024, 12:56pm UTC](https://forum.ansible.com/t/how-to-include-a-variable-vault-in-inventory-ini-or-ansible-cfg/38906/6 "2024-12-06T12:56:33Z")
Your tree must look like this: ```auto tree automate automate ├── group_vars │ └── all │ └── secrets.yml ├── inventory.ini └── myplay.yml ``` Please study this: [https://docs.ansible.com/ansible/latest/playbook\_guide/playbooks\_variables.html#tips-on-where-to-set-variables](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_variables.html#tips-on-where-to-set-variables) `group_vars` and `host_vars` are described in detail in documentation. ---
**Author:** ![halloleo](https://avatars.discourse-cdn.com/v4/letter/h/ccd318/32.png) [@halloleo](https://forum.ansible.com/u/halloleo)\ **Post date:** [December 9, 2024, 12:32am UTC](https://forum.ansible.com/t/how-to-include-a-variable-vault-in-inventory-ini-or-ansible-cfg/38906/7 "2024-12-09T00:32:33Z")
> [@bvitnik](#): > > Your tree must look like this: > > ```auto > ... > > ``` Thanks so much for spelling this out for me. Now it works like a charm! ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [January 8, 2025, 12:32am UTC](https://forum.ansible.com/t/how-to-include-a-variable-vault-in-inventory-ini-or-ansible-cfg/38906/8 "2025-01-08T00:32:48Z")
Closed on January 8, 2025, 12:32am UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.