# Specify vault secret using variables

**URL:** <https://forum.ansible.com/t/specify-vault-secret-using-variables/36276>\
**Category:** Ansible Project\
**Created:** [February 2, 2022, 3:32pm UTC](https://forum.ansible.com/t/specify-vault-secret-using-variables/36276 "2022-02-02T15:32:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![orgabeke](https://avatars.discourse-cdn.com/v4/letter/o/d9b06d/32.png) [@orgabeke](https://forum.ansible.com/u/orgabeke)\
**Post date:** [February 2, 2022, 3:32pm UTC](https://forum.ansible.com/t/specify-vault-secret-using-variables/36276/1 "2022-02-02T15:32:50Z")

</div>

Hi all,

I’m new to Ansible and use it to add servers deployed using vRealize Automation 8 to AD domain. When the user deploys a new server they select which domain the server belongs to. Based on the domain selected I need to select the correct ad credential to join the server to the domain.

I’ve created a vault that contains the passwords for the account with permission to add the server to the domain:  
vault\_domain1.com: password1  
vault\_domain2.com: password2

If I in the playbook specifies one of the vault secrets it works for that domain:  
domain\_admin\_password: “{{ vault\_domain1.com }}”

But I need that the vault secret used in the playbook is dependent on the domain the user selects. If the user selects [domain2.com](http://domain2.com), the vault secret used in the playbook should be “vault\_domain2.com”.

In the vRA blueprint I’ve added a host variable that sets the vault secret based on the domain that the user selects:  
domain\_join\_password: vault\_${input.domain}

I’ve verified that the value for domain\_join\_password is vault\_domain1.com or vault\_domain2.com depending on what the user selects. The problem I’ve not been able to solve is how to get this in the playbook as a variable. I’ve tried the following that doesn’t work.  
domain\_admin\_password: “{{ domain\_join\_password }}”  
domain\_admin\_password: “{{ {{ domain\_join\_password }} }}”

I’ve searched for a solution to this but my search skills are failing me. Is it possible to achieve what I’m trying to do? Any help will be greatly appreciated.

Thanks.

---

<div class="post-metadata">

**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\
**Post date:** [February 2, 2022, 4:39pm UTC](https://forum.ansible.com/t/specify-vault-secret-using-variables/36276/2 "2022-02-02T16:39:22Z")

</div>

domain\_join\_password: “{{ lookup(‘vars’, ‘vault\_’ ~ input.domain) }}”

---

<div class="post-metadata">

**Author:** ![orgabeke](https://avatars.discourse-cdn.com/v4/letter/o/d9b06d/32.png) [@orgabeke](https://forum.ansible.com/u/orgabeke)\
**Post date:** [February 2, 2022, 5:46pm UTC](https://forum.ansible.com/t/specify-vault-secret-using-variables/36276/3 "2022-02-02T17:46:38Z")

</div>

Thanks for replying.

I change the host variable in vRA to "domain\_join\_password: “{{ lookup(‘vars’, ‘vault\_’ ~ ${input.domain}) }}”. After doing it it fails with this error:  
Failed to run Ansible Ad hoc command - sudo ansible localhost -m lineinfile -a dest=/opt/ansible/vra/host\_vars/sditest9/vra\_user\_host\_vars\_f6f19a39-6433-496f-93c0-85230e40ceb4.yml line='domain: [domain1.com](http://domain1.com)  
dns1: 8.8.8.8  
domain\_ou: ou=servers,DC=domain1,DC=com  
servername: sditest9  
domain\_join\_password: “{{ lookup(‘vars’, ‘vault\_’ ~ [domain1.com](http://domain1.com)) }}”  
ansible\_user: Administrator  
ansible\_password: password  
ansible\_winrm\_transport: ntlm  
ansible\_winrm\_port: 5985  
’ create=yes insertafter=EOF state=present --connection=local. Refer to logs at var/tmp/vmware/provider/user\_defined\_script/f6f19a39-6433-496f-93c0-85230e40ceb4 on Ansible Control Machine for more details.

I guess that vRA might confuse things a bit from “standard” Ansible. As you can see, the domain\_join\_password does get the correct but playbooks does not run.

onsdag 2. februar 2022 kl. 17:39:22 UTC+1 skrev [uto...@gmail.com](mailto:uto...@gmail.com):