# Multi-cloud deployment, use site.yml or --extra-vars

**URL:** <https://forum.ansible.com/t/multi-cloud-deployment-use-site-yml-or-extra-vars/15525>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [June 23, 2014, 12:41pm UTC](https://forum.ansible.com/t/multi-cloud-deployment-use-site-yml-or-extra-vars/15525 "2014-06-23T12:41:47Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Roman\_Valls](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@Roman\_Valls](https://forum.ansible.com/u/Roman_Valls)\
**Post date:** [June 23, 2014, 12:41pm UTC](https://forum.ansible.com/t/multi-cloud-deployment-use-site-yml-or-extra-vars/15525/1 "2014-06-23T12:41:47Z")

</div>

Hello Ansible-Project,

I would like to know which best practices are there when it comes to deploying a playbook to several different cloud providers (mainly AWS and GCE now, but more might come later).

More specifically, which one feels more natural to you:

```auto
ansible-playbook site.yml --extra-vars "cloud_provider=aws aws_access_key=..."
ansible-playbook site.yml --extra-vars="cloud_provider=gce gce_service_email=..."

```

Which follows ansible docs on Best Practices…

… or the following, shorter version instead?

```auto
ansible-playbook aws.yml --extra-vars "aws_access_key=..."
ansible-playbook gce.yml --extra-vars="gce_service_email=..."

```

Here’s the original GitHub discussion that triggered this email, thanks Michael DeeHann for pointing this google group:

[https://github.com/nimiq/ansible-biostar/issues/11](https://github.com/nimiq/ansible-biostar/issues/11)

Thanks in advance,  
Roman

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [June 23, 2014, 2:12pm UTC](https://forum.ansible.com/t/multi-cloud-deployment-use-site-yml-or-extra-vars/15525/2 "2014-06-23T14:12:21Z")

</div>

I’d probably keep the provisioning playbooks seperate and then have them include the configuration portion using the usual “add\_host” handoff.

Also I should point out

–extra-vars @from\_file.yml

is an option

---

<div class="post-metadata">

**Author:** ![Roman\_Valls](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@Roman\_Valls](https://forum.ansible.com/u/Roman_Valls)\
**Post date:** [June 23, 2014, 4:17pm UTC](https://forum.ansible.com/t/multi-cloud-deployment-use-site-yml-or-extra-vars/15525/3 "2014-06-23T16:17:51Z")

</div>

Thanks Michael,

I see, so you would go for the second option and implement the add\_host trick described here? Clever:

[http://skvidal.wordpress.com/2012/10/31/ansible-and-cloud-instances/](http://skvidal.wordpress.com/2012/10/31/ansible-and-cloud-instances/)

The inline extra-vars are meant to have things like aws\_access\_key and other sensitive tokens away from potentially public version-controlled files.

In the future we might check if those are on, for instance, $HOME/.botorc instead of having them in a .yml file in our playbook, just one commit away from being published in the open.

Thanks again!  
Roman

---

<div class="post-metadata">

**Author:** ![Paolo](https://avatars.discourse-cdn.com/v4/letter/p/6f9a4e/32.png) [@Paolo](https://forum.ansible.com/u/Paolo)\
**Post date:** [June 23, 2014, 4:28pm UTC](https://forum.ansible.com/t/multi-cloud-deployment-use-site-yml-or-extra-vars/15525/4 "2014-06-23T16:28:00Z")

</div>

Just a note: we already use add\_host in the way Michael said.  
F.i. we first launch a EC2 instance, then add its public IP to the Ansible host file using add\_host module:  
[https://github.com/nimiq/ansible-biostar/blob/master/roles/ec2\_instance/tasks/main.yml#L83](https://github.com/nimiq/ansible-biostar/blob/master/roles/ec2_instance/tasks/main.yml#L83)

Paolo

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [June 23, 2014, 6:04pm UTC](https://forum.ansible.com/t/multi-cloud-deployment-use-site-yml-or-extra-vars/15525/5 "2014-06-23T18:04:58Z")

</div>

“The inline extra-vars are meant to have things like aws\_access\_key and other sensitive tokens away from potentially public version-controlled files.”

That makes sense, though if you want to keep them private, also consider ansible-vault (and maybe not keeping them in source control paths) if you want.

---

<div class="post-metadata">

**Author:** ![Roman\_Valls](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@Roman\_Valls](https://forum.ansible.com/u/Roman_Valls)\
**Post date:** [June 24, 2014, 1:10pm UTC](https://forum.ansible.com/t/multi-cloud-deployment-use-site-yml-or-extra-vars/15525/6 "2014-06-24T13:10:38Z")

</div>

Thanks Michael for the ansible-vault insight, I knew of its existence but never used it … yet.

Anyhow, Paolo has a point there, we already use add\_host handoff in our playbook, what I guess you meant is that we should call the actual “application payload” (in our case, docker containers):

[https://github.com/nimiq/ansible-biostar/blob/master/biostar.yml](https://github.com/nimiq/ansible-biostar/blob/master/biostar.yml)

At the end of each cloud instantiation:

[https://github.com/nimiq/ansible-biostar/tree/master/roles/ec2\_instance](https://github.com/nimiq/ansible-biostar/tree/master/roles/ec2_instance)

[https://github.com/nimiq/ansible-biostar/tree/master/roles/gce\_instance](https://github.com/nimiq/ansible-biostar/tree/master/roles/gce_instance)

Perhaps via a simple “include” at the end of the {ec2|gce}\_instance?

Thanks!  
Roman