title: How to store ansible_become_pass in a vault and how to use it?
body: <p>I am a newbie to ansible and I am using a very simple playbook to issue <code>sudo apt-get update</code> and <code>sudo apt-get upgrade</code> on a couple of servers.</p>
  
  <p>This is the playbook I am using:</p>
  
  <pre><code>---
  
  - name: Update Servers
    hosts: my-servers
    become: yes
    become_user: root
    tasks:
      - name: update packages
        apt: update_cache=yes
  
      - name: upgrade packages
        apt: upgrade=dist
  </code></pre>
  
  <p>and this is an extract from my <code>~/.ansible/inventory/hosts</code> file:</p>
  
  <pre><code>[my-servers]
  san-francisco ansible_host=san-francisco ansible_ssh_user=user ansible_become_pass=&lt;my_sudo_password_for_user_on_san-francisco&gt;
  san-diego     ansible_host=san-diego     ansible_ssh_user=user ansible_become_pass=&lt;my_sudo_password_for_user_on_san-diego&gt;
  </code></pre>
  
  <p>This is what I get if I launch the playbook:</p>
  
  <pre><code>$ ansible-playbook update-servers-playbook.yml                                                                                                                                     
  
  PLAY [Update Servers] **********************************************************
  
  TASK [setup] *******************************************************************
  ok: [san-francisco]
  ok: [san-diego]
  
  TASK [update packages] *********************************************************
  ok: [san-francisco]
  ok: [san-diego]
  
  TASK [upgrade packages] ********************************************************
  ok: [san-francisco]
  ok: [san-diego]
  
  PLAY RECAP *********************************************************************
  san-francisco              : ok=3    changed=0    unreachable=0    failed=0   
  san-diego                  : ok=3    changed=0    unreachable=0    failed=0
  </code></pre>
  
  <p>What is bothering me is the fact that I have the password for my user <code>user</code> stored in plaintext in my <code>~/.ansible/inventory/hosts</code> file.</p>
  
  <p>I have read about <a href="https://docs.ansible.com/ansible/playbooks_vault.html#what-can-be-encrypted-with-vault" rel="noreferrer">vaults</a>, I have also read about the <a href="https://docs.ansible.com/ansible/playbooks_best_practices.html#best-practices-for-variables-and-vaults" rel="noreferrer">best practices for variables and vaults</a> but I do not understand how to apply this to my very minimal use case.</p>
  
  <p>I also tried to use <a href="https://docs.ansible.com/playbooks_lookups.html" rel="noreferrer">lookups</a>. While in general they also work in the inventory file, and I am able to do something like this:</p>
  
  <pre><code>[my-servers]
  san-francisco ansible_host=san-francisco ansible_ssh_user=user ansible_become_pass="{{ lookup('env', 'ANSIBLE_BECOME_PASSWORD_SAN_FRANCISCO') }}"
  </code></pre>
  
  <p>where this case the password would be stored in an environment variable called <code>ANSIBLE_BECOME_PASSWORD_SAN_FRANCISCO</code>; there is no way to look up variables in vaults as far as I know.</p>
  
  <p>So, how could I organize my file such that I would be able to lookup up my passwords from somewhere and have them safely stored?</p>