4

When I create playbooks I often add a comments section at the top on how to run the Ansible playbook. With more options becoming available in Ansible, the list of command-line arguments also seems to grow. It made me curious to see if there is a way to specify defaults for these arguments in the playbook.

For example my playbook needs the following arguments:

  • the hosts file: -i hosts
  • the password for become: -K
  • the password for the vault: --ask-vault-pass
  • the name of the playbook: myplaybook.yml

It would be easier if I could just run the following command (especially for co-workers):
ansible-playbook myplaybook.yml

And specify in the playbook, that by default it should look for a hosts inventory file and ask for sudo + vault passwords. Of course I could create a script and wrap the playbook command, but that adds another layer on top of it.

I guess I'm looking for adding something like this to my playbook:

vars:
  inventory_file: hosts
  ask_become_pass: true
  ask_vault_pass: true

Is that possible?

Yvo
  • 143
  • 4

1 Answers1

3

That's what the configuration file is for. Create an ansible.cfg in the directory from where you run ansible, like so:

[defaults]
inventory = hosts
ask_vault_pass = True

[privilege_escalation]
become_ask_pass = True

See also http://docs.ansible.com/ansible/latest/reference_appendices/config.html

The ansible.cfg in the working directory precedes /etc/ansible/ansible.cfg. The full search order is described on the page linked above. Command line options you pass on invocation override all configuration files.

simonz
  • 274
  • 1
  • 5
  • Thanks, that works great! Is there a way to specify ask_vault_pass in the playbook though? My folder contains multiple playbooks, some require the vault and others don't. – Yvo May 17 '18 at 14:07
  • 1
    According to http://docs.ansible.com/ansible/latest/reference_appendices/playbooks_keywords.html, no. You can specify the vault_password as a secret, but I'm not sure that's an option for you. I haven't used vaults yet, so can't tell you more. – simonz May 17 '18 at 14:53