# Per-play private keys?

**URL:** <https://forum.ansible.com/t/per-play-private-keys/12430>\
**Category:** Ansible Project\
**Tags:** ansible-project\
**Created:** [February 28, 2013, 3:09am UTC](https://forum.ansible.com/t/per-play-private-keys/12430 "2013-02-28T03:09:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\
**Post date:** [February 28, 2013, 3:09am UTC](https://forum.ansible.com/t/per-play-private-keys/12430/1 "2013-02-28T03:09:22Z")

</div>

So we have "--private-key-file". Currently that is not settable per  
play as a play level option but I'm not against it.

Right now I think everyone uses common keyfiles for everything  
addressed in the same playbook run.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\
**Post date:** [February 28, 2013, 3:10am UTC](https://forum.ansible.com/t/per-play-private-keys/12430/2 "2013-02-28T03:10:41Z")

</div>

Best way to do this is probably to allow it to be set as an inventory  
variable, like ansible\_private\_key\_file, BTW.

That would allow it per host. Which may be sufficient, it's not  
quite a per play thing, and it can be a per "host+user" thing, but I  
think that would work for most people.

---

<div class="post-metadata">

**Author:** ![tom.blackwell](https://avatars.discourse-cdn.com/v4/letter/t/b5a626/32.png) [@tom.blackwell](https://forum.ansible.com/u/tom.blackwell)\
**Post date:** [February 28, 2013, 5:13am UTC](https://forum.ansible.com/t/per-play-private-keys/12430/3 "2013-02-28T05:13:16Z")

</div>

Does this mean that inventory variables can be used in any meaningful way to pass key info to plays?

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\
**Post date:** [February 28, 2013, 12:49pm UTC](https://forum.ansible.com/t/per-play-private-keys/12430/4 "2013-02-28T12:49:48Z")

</div>

I'm discussing future possibles about a very small patch idea.

They can already be used to pass some things like the connection type,  
so it's not a stretch to do this at all.

Please file a github ticket so we don't forget (and you can be  
notified once that is there!)

---

<div class="post-metadata">

**Author:** ![travis](https://avatars.discourse-cdn.com/v4/letter/t/bbce88/32.png) [@travis](https://forum.ansible.com/u/travis)\
**Post date:** [June 19, 2013, 8:20pm UTC](https://forum.ansible.com/t/per-play-private-keys/12430/5 "2013-06-19T20:20:09Z")

</div>

I’d like this capability also - I haven’t seen anything in the docs about being able to do this, or any other traffic on the list that makes it seem like this has been added in (though I might’ve missed it). I didn’t see an issue open for it - so I wasn’t sure if it had been resolved. Should I file a ticket for it?

Thanks,

---

<div class="post-metadata">

**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\
**Post date:** [June 19, 2013, 9:40pm UTC](https://forum.ansible.com/t/per-play-private-keys/12430/6 "2013-06-19T21:40:18Z")

</div>

if you use ssh connector, you can have private keys per host (in .ssh/config).

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [June 19, 2013, 11:56pm UTC](https://forum.ansible.com/t/per-play-private-keys/12430/7 "2013-06-19T23:56:43Z")

</div>

Actually it’s already doable.

ansible\_ssh\_private\_key\_file is a valid inventory variable.