Quiz Entry - updated: 2026.11.05
In short: how do variables, Vault and facts work together in an Ansible project?
Variables put values in one place so they can be reused (inventory, group_vars/host_vars, playbook, command line, with a fixed precedence). Vault encrypts the variable files that hold secrets. Facts are variables Ansible collects from each host, so a play can adapt to the actual machine.
| Concept | Answers the question | Defined by | Typical place |
|---|---|---|---|
| Inventory variables | What differs per group or host? | you | group_vars/, host_vars/ |
| Play / task variables | What does this job need? | you | vars, vars_files |
| Extra variables | What should be different in this one run? | you, at run time | -e |
| Registered variables | What did that task return? | a task | register: |
| Vault | How do I keep secrets in Git safely? | you | encrypted vars/vault files |
| Facts | What is this machine actually like? | Ansible (setup) |
ansible_facts[...] |
| Custom facts | What does this machine know about itself? | you, on the host | /etc/ansible/facts.d/*.fact |
| Magic variables | What does Ansible know about the run? | Ansible | hostvars, groups, … |
A single task often draws on all of them, for example: copy {{ httpdconf_src }} (a play variable) to a path built from {{ web_root }} (a group variable), log in with {{ web_pass }} (from a vaulted file), and write {{ ansible_facts['fqdn'] }} (a fact) into the page.
Go deeper:
Discovering variables: facts and magic variables (official docs) — the facts and magic-variables overview.- Using variables (official docs) — where variables come from and how they combine.