Mixing encrypted data with plain YAML

Before the release of Ansible 2.3, secure data had to be encrypted in a separate file. For the reasons we discussed earlier, it is desirable to encrypt as little data as possible. This is now possible (and also saves the need for too many individual files as part of a playbook) through the use of the encrypt_string subcommand of ansible-vault, which produces an encrypted string that can be placed into an Ansible YAML file. Let's start with the following basic playbook as an example:

---
- name: inline secret variable demonstration
  hosts: localhost
  gather_facts: false

  vars:
    my_secret: secure_password

  tasks:
    - name: print the secure variable
      debug:
        var: my_secret

When we run the preceding code, it should work as shown in the following screenshot:

Now, obviously, it is not clever to leave a secure password in plain...