# How to point \`vars\` to matching \`vault\_\`?

**URL:** <https://forum.ansible.com/t/how-to-point-vars-to-matching-vault/22622>\
**Category:** Ansible Project\
**Created:** [September 22, 2016, 10:24pm UTC](https://forum.ansible.com/t/how-to-point-vars-to-matching-vault/22622 "2016-09-22T22:24:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jason.bornhoft](https://avatars.discourse-cdn.com/v4/letter/j/b9bd4f/32.png) [@jason.bornhoft](https://forum.ansible.com/u/jason.bornhoft)\
**Post date:** [September 22, 2016, 10:24pm UTC](https://forum.ansible.com/t/how-to-point-vars-to-matching-vault/22622/1 "2016-09-22T22:24:55Z")

</div>

I’m using vault for the first time (previously used dotenv) and am following the instructions [here](http://docs.ansible.com/ansible/playbooks_best_practices.html#best-practices-for-variables-and-vaults).

Specifically, the line:

> You should adjust the variables in the `vars` file to point to the matching`vault_` variables

Any guidance please on how to achieve this?

Many thanks!

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [September 23, 2016, 7:15am UTC](https://forum.ansible.com/t/how-to-point-vars-to-matching-vault/22622/2 "2016-09-23T07:15:47Z")

</div>

Lets say you have a group webservers, the doc recommends this approach.

group\_vars/webservers/vars

---

<div class="post-metadata">

**Author:** ![jason.bornhoft](https://avatars.discourse-cdn.com/v4/letter/j/b9bd4f/32.png) [@jason.bornhoft](https://forum.ansible.com/u/jason.bornhoft)\
**Post date:** [September 23, 2016, 3:41pm UTC](https://forum.ansible.com/t/how-to-point-vars-to-matching-vault/22622/3 "2016-09-23T15:41:46Z")

</div>

Hi, Kai;

Thanks for your reply. I followed your instructions (which is what I had already tried) but it doesn’t work for me.

Here is my tree:

10:35 $ tree

.

├── group\_vars

│ ├── standalone.yml

│ ├── vault.yml

And here is the command I am running:

ansible-playbook -v -i inventory/standalone/standalone services/standalone.yml --vault-password-file ~/.vault\_pass.txt -u vagrant --tags “filebeat”

This gives me the following error:

fatal: [192.168.1.99]: FAILED! =\> {“changed”: false, “failed”: true, “msg”: “AnsibleUndefinedVariable: {{ vault\_forwarder\_crt }}: ‘vault\_forwarder\_crt’ is undefined”}

In my standalone.yml I have `forwarder_crt: "{{ vault_forwarder_crt }}"` and then I have the variable `vault_forwarder_crt` in vault.yml (which is encrypted).

Did I miss something from your instructions, or misunderstand?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Andrew\_Feller](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@Andrew\_Feller](https://forum.ansible.com/u/Andrew_Feller)\
**Post date:** [September 23, 2016, 3:59pm UTC](https://forum.ansible.com/t/how-to-point-vars-to-matching-vault/22622/4 "2016-09-23T15:59:51Z")

</div>

Within group\_vars there needs to be a directory named after the group which contains vars(.yml) and vault(.yml)

Kai's example uses the group named webservers and works

---

<div class="post-metadata">

**Author:** ![jason.bornhoft](https://avatars.discourse-cdn.com/v4/letter/j/b9bd4f/32.png) [@jason.bornhoft](https://forum.ansible.com/u/jason.bornhoft)\
**Post date:** [September 23, 2016, 4:02pm UTC](https://forum.ansible.com/t/how-to-point-vars-to-matching-vault/22622/5 "2016-09-23T16:02:50Z")

</div>

Confirmed, works!

Thank you to both!

---

<div class="post-metadata">

**Author:** ![Andrew\_Feller](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@Andrew\_Feller](https://forum.ansible.com/u/Andrew_Feller)\
**Post date:** [September 23, 2016, 4:45pm UTC](https://forum.ansible.com/t/how-to-point-vars-to-matching-vault/22622/6 "2016-09-23T16:45:44Z")

</div>

Awesome!

Even though you could stick vaults within roles, I wholeheartedly recommend managing them within inventories preferably within groups as it’ll let your environments vary and avoid cherry picking hosts.