Ansible Playbook Directory Structure - using /files at playbook_dir level

Viewed 471

QUESTION; TLDR

Are there suggestions on handling FILES and VAULT FILES within a playbook and not within ROLES?

EXPLANATION

I'm familiar with the following best practices from ansible where the following directory structure is listed as such:

inventories/
   production/
      hosts               # inventory file for production servers
      group_vars/
         group1.yml       # here we assign variables to particular groups
         group2.yml
      host_vars/
         hostname1.yml    # here we assign variables to particular systems
         hostname2.yml

   staging/
      hosts               # inventory file for staging environment
      group_vars/
         group1.yml       # here we assign variables to particular groups
         group2.yml
      host_vars/
         stagehost1.yml   # here we assign variables to particular systems
         stagehost2.yml

library/
module_utils/
filter_plugins/

site.yml
webservers.yml
dbservers.yml

roles/
    common/
    webtier/
    monitoring/
    fooapp/

This structure works for simple projects. However a very large playbook, that uses requirements.yml to git clone roles into it's structure makes it hard to maintain items like vault files because of possible drift in vault-passwords amongst the myriad repos. From my perspective, it would be useful if the vaulted files were in a central location at the playbook level.

I was wondering if there is a way to create a playbook_dir/vault | files directory, at the same level as inventories or perhaps a playbook_dir/inventories/group_vars/vault | files directory. Then within this vault | files folder I can centralize all my necessary secret/non-secret files (such as certs and other items too long winded to be stored as a variable).

That way when the playbook is ran for [servers] it will get all the necessary variables AND vaulted | files that I need the host group to share.

1 Answers

I'm going to work with the advised by seshadri_c and Vladimir Botka. The search paths appear to be the best solution for the vault files and regular files.

  1. Place a files folder at the root of playbook
  2. Place a valuted file in the base files folder
  3. Within the role, refer to a general variable '{{ vaulted-file }}'
  4. Hopefully, the search paths will resolve without having to do relative pathing (such as ../../files/{{ vaulted-file }} )

Thank you.

Related