The inventory tells Ansible which hosts to manage and how to group them. It can be a static file (INI/YAML) or dynamic (a script/plugin that queries a cloud for current hosts). Group hosts so plays target the right set, and attach group_vars / host_vars for per-group/host configuration.

Secrets (passwords, API keys) needed by playbooks must not sit in plaintext. Ansible Vault encrypts variable files or single values with a password, so they can live safely in git and are decrypted at runtime.

# inventory.yml
all:
  children:
    web:
      hosts:
        web1.example.com:
        web2.example.com:
      vars:
        http_port: 443

# Encrypt a secrets file
ansible-vault encrypt group_vars/web/secrets.yml
# Run a playbook, supplying the vault password
ansible-playbook site.yml --ask-vault-pass

1. Write a YAML inventory with a group and a group variable.
2. Explain the difference between static and dynamic inventory.
3. Encrypt a secrets file with Ansible Vault (in words) and run a playbook with it.
4. Describe when group_vars vs host_vars is appropriate.

• ↗ Ansible — Vault