# Proxmox inventory plugin: get secrets from vault.yml

**URL:** <https://forum.ansible.com/t/proxmox-inventory-plugin-get-secrets-from-vault-yml/40868>\
**Category:** Get Help\
**Tags:** proxmox\
**Created:** [March 8, 2025, 8:16pm UTC](https://forum.ansible.com/t/proxmox-inventory-plugin-get-secrets-from-vault-yml/40868 "2025-03-08T20:16:35Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![DengelFred](https://avatars.discourse-cdn.com/v4/letter/d/87869e/32.png) [@DengelFred](https://forum.ansible.com/u/DengelFred)\
**Post date:** [March 8, 2025, 8:16pm UTC](https://forum.ansible.com/t/proxmox-inventory-plugin-get-secrets-from-vault-yml/40868/1 "2025-03-08T20:16:35Z")

</div>

Hello,

I use the proxmox inventory plugin and would like to use the secrets from group\_vars/all for the api secret. I use the follwing folder structure:

```auto
inventory/
├── group_vars
│ └── all
│ ├── vars.yml
│ └── vault.yml
├── host_vars
│ ├── ...
├── inventory.proxmox.yml
├── inventory.yml
└── z_inventory.constructed.yml

```

Now I would like to access the variable “token\_secret” from group\_vars/all/vault.yml inside the “inventory.proxmox.yml”, but unfortunately it’s not available.  
Any hints how to do that? I would like to have a “single source of truth”…

Thanks a lot!  
Thomas

---

<div class="post-metadata">

**Author:** ![Thulium-Drake](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/thulium-drake/32/833_2.png) [@Thulium-Drake](https://forum.ansible.com/u/Thulium-Drake)\
**Post date:** [March 9, 2025, 10:50am UTC](https://forum.ansible.com/t/proxmox-inventory-plugin-get-secrets-from-vault-yml/40868/2 "2025-03-09T10:50:42Z")

</div>

Hi there!

Good question, I did some testing, I couldn’t make it work with either of the ones below:

```auto
password: "{{ my_var }}"

```

Results in:

```auto
[WARNING]: * Failed to parse /home/ansible/projects/test/inventory/proxmox.yml with auto plugin:
'proxmox_readonly_password' is undefined

```

Using lookups didn’t fix it either

```auto
password: "{{ query('ansible.builtin.vars', 'proxmox_readonly_password') }}"

```

Results in:

```auto
[WARNING]: * Failed to parse /home/ansible/projects/test/inventory/proxmox.yml with auto plugin: No variable found with
this name: proxmox_readonly_password

```

I tried with a `lookup` as well as a `query` using Vaultwarden/Bitwarden to see if it’s reachable when it’s outside the inventory, but also nothing 😔

```auto
[WARNING]: * Failed to parse /home/ansible/projects/test/inventory/proxmox.yml with auto plugin: 'NoneType' object is
not subscriptable

```

I also tested it with the Foreman plugin, same results, makes me think that Ansible just can’t do it 😅 unless I’m missing something…

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [March 9, 2025, 12:00pm UTC](https://forum.ansible.com/t/proxmox-inventory-plugin-get-secrets-from-vault-yml/40868/3 "2025-03-09T12:00:14Z")

</div>

Inventory plugins cannot access anything in host\_vars and group\_vars, since these are only loaded _after_ the inventory is loaded.

Generally inventory plugins don’t support templating, unless the plugin explicitly templates something. Some inventory plugins allow templating for things like usernames and passwords, but usually not for everything. The proxmox inventory plugin templates the following inputs: `url`, `user`, `password`, `token_id`, `token_secret`.

What you can do is use the [`ansible.builtin.unvault` lookup](https://docs.ansible.com/ansible/devel/collections/ansible/builtin/unvault_lookup.html#ansible-collections-ansible-builtin-unvault-lookup) to explicitly load the file, apply the [`ansible.builtin.from_yaml` filter](https://docs.ansible.com/ansible/devel/collections/ansible/builtin/from_yaml_filter.html#ansible-collections-ansible-builtin-from-yaml-filter), and then access the right field. Something like this:

```auto
password: >-
  (lookup("ansible.builtin.unvault", "group_vars/all/vault.yml") | ansible.builtin.from_yaml).token_secret

```

(You might need to add the `| string` filter before `| from_yaml`.)

---

<div class="post-metadata">

**Author:** ![Thulium-Drake](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/thulium-drake/32/833_2.png) [@Thulium-Drake](https://forum.ansible.com/u/Thulium-Drake)\
**Post date:** [March 9, 2025, 2:05pm UTC](https://forum.ansible.com/t/proxmox-inventory-plugin-get-secrets-from-vault-yml/40868/4 "2025-03-09T14:05:08Z")

</div>

First of all, @felixfontein Legend for thinking of even more clever tricks to try! 😉

I gave it a shot with what you suggested, but Ansible doesn’t seem to like it ☹

I made a file with my credentials in it and then vaulted the whole thing (I normally only use `encrypt_string`:

`inventory/group_vars/all/proxmox_creds.yml`:

```auto
user: 'blahblah'
password: 'secret_blahblah'

```

And I added the following in my inventory for the password:

```auto
user: 'search@pve' # I'm only testing the password right now
password: >-
  (lookup("ansible.builtin.unvault", "group_vars/all/proxmox_creds.yml") | string | ansible.builtin.from_yaml).password

```

I also tried adding `inventory` to the path, no dice.

So, these files:

```auto
./inventory/group_vars/all/proxmox_creds.yml
./inventory/proxmox.yml

```

When asked to generate an inventory, produce:

```auto
ansible-inventory --graph
[WARNING]: * Failed to parse /home/ansible/projects/test/inventory/proxmox.yml with auto plugin: 'NoneType' object is
not subscriptable
[WARNING]: * Failed to parse /home/ansible/projects/test/inventory/proxmox.yml with yaml plugin: Plugin configuration
YAML file, not YAML inventory
[WARNING]: * Failed to parse /home/ansible/projects/test/inventory/proxmox.yml with ini plugin: Invalid host pattern
'---' supplied, '---' is normally a sign this is a YAML file.
[WARNING]: Unable to parse /home/ansible/projects/test/inventory/proxmox.yml as an inventory source
@all:
<snip>

```

---

<div class="post-metadata">

**Author:** ![kristianheljas](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kristianheljas/32/7702_2.png) [@kristianheljas](https://forum.ansible.com/u/kristianheljas)\
**Post date:** [March 9, 2025, 7:51pm UTC](https://forum.ansible.com/t/proxmox-inventory-plugin-get-secrets-from-vault-yml/40868/5 "2025-03-09T19:51:52Z")

</div>

It’s almost correct.

1. Missing template brackets
2. File lookup not relative to inventory directory, need to prepend `inventory/`

So following does the trick for me:

```auto
token_secret: >-
  {{ (lookup("ansible.builtin.unvault", "inventory/group_vars/all/vault.yml") | ansible.builtin.from_yaml).token_secret }}

```

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [March 9, 2025, 8:05pm UTC](https://forum.ansible.com/t/proxmox-inventory-plugin-get-secrets-from-vault-yml/40868/6 "2025-03-09T20:05:44Z")

</div>

Ooops, the `{{` / `}}` were pretty obvious 😃

---

<div class="post-metadata">

**Author:** ![Thulium-Drake](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/thulium-drake/32/833_2.png) [@Thulium-Drake](https://forum.ansible.com/u/Thulium-Drake)\
**Post date:** [March 9, 2025, 9:55pm UTC](https://forum.ansible.com/t/proxmox-inventory-plugin-get-secrets-from-vault-yml/40868/7 "2025-03-09T21:55:24Z")

</div>

That did the trick! So, to summarize:

1. Create a file with the variables you need, e.g.:

```auto
---
proxmox_readonly_username: 'search@pve'
proxmox_readonly_password: 'blabla'

```

1. Encrypt the file with Ansible Vault
2. Update the inventory to use the string suggested by @felixfontein with the fixes from @kristianheljas

```auto
---
plugin: 'community.general.proxmox'
url: 'https://pve.example.nl:8006'
user: "{{ (lookup('ansible.builtin.unvault', 'inventory/group_vars/all/proxmox.yml') | ansible.builtin.from_yaml).proxmox_readonly_username }}"
password: "{{ (lookup('ansible.builtin.unvault', 'inventory/group_vars/all/proxmox.yml') | ansible.builtin.from_yaml).proxmox_readonly_password }}"
validate_certs: true
want_facts: true
want_proxmox_nodes_ansible_host: false

```

1. Bingo

And this also works with other lookups! Below is the one for Bitwarden:

```auto
---
plugin: 'community.general.proxmox'
url: 'https://pve.example.nl:8006'
user: "{{ lookup('community.general.bitwarden', 'Proxmox - search@pve', field='username')[0] }}"
password: "{{ lookup('community.general.bitwarden', 'Proxmox - search@pve', field='password')[0] }}"
validate_certs: true                                                                  
want_facts: true                                                                                      
want_proxmox_nodes_ansible_host: false

```

Not a question I asked, but grateful nonetheless! I just made my homelab codebase a touch better today 😉

---

<div class="post-metadata">

**Author:** ![DengelFred](https://avatars.discourse-cdn.com/v4/letter/d/87869e/32.png) [@DengelFred](https://forum.ansible.com/u/DengelFred)\
**Post date:** [March 10, 2025, 6:34pm UTC](https://forum.ansible.com/t/proxmox-inventory-plugin-get-secrets-from-vault-yml/40868/8 "2025-03-10T18:34:43Z")

</div>

Works perfect 🙂 Thank you all!