Ansible Configuration Settings 

# some basic default values...
inventory = /etc/ansible/hosts  ; This points to the file that lists your hosts
Generating a sample ansible.cfg file
You can generate a fully commented-out example ansible.cfg file, for example:
$ ansible-config init --disabled > ansible.cfg
You can also have a more complete file that includes existing plugins:
$ ansible-config init --disabled -t all > ansible.cfg
You can use these as starting points to create your own ansible.cfg file.
Avoiding security risks with ansible.cfg in the current directory
If Ansible were to load ansible.cfg from a world-writable current working
directory, it would create a serious security risk. Another user could place
their own config file there, designed to make Ansible run malicious code both
locally and remotely, possibly with elevated privileges. For this reason,
Ansible will not automatically load a config file from the current working
directory if the directory is world-writable.
If you depend on using Ansible with a config file in the current working
directory, the best way to avoid this problem is to restrict access to your
Ansible directories to particular user(s) and/or group(s). If your Ansible
directories live on a filesystem which has to emulate Unix permissions, like
Vagrant or Windows Subsystem for Linux (WSL), you may, at first, not know how
you can fix this as chmod, chown, and chgrp might not work there.
In most of those cases, the correct fix is to modify the mount options of the
filesystem so the files and directories are readable and writable by the users
and groups running Ansible but closed to others.  For more details on the
correct settings, see:
for Vagrant, the Vagrant documentation covers synced folder permissions.
for WSL, the WSL docs
and this Microsoft blog post cover mount options.
If you absolutely depend on storing your Ansible config in a world-writable current
working directory, you can explicitly specify the config file via the
ANSIBLE_CONFIG environment variable. Please take
appropriate steps to mitigate the security concerns above before doing so.
Relative paths for configuration
You can specify a relative path for many configuration options. In most of
those cases the path used will be relative to the ansible.cfg file used
for the current execution. If you need a path relative to your current working
directory (CWD) you can use the {{CWD}} macro to specify
it. We do not recommend this approach, as using your CWD as the root of
relative paths can be a security risk. For example:
cd /tmp; secureinfo=./newrootpassword ansible-playbook ~/safestuff/change_root_pwd.yml.
Common Options
This is a copy of the options available from our release, your local install might have extra options due to additional plugins,
you can use the command line utility mentioned above (ansible-config) to browse through those.
ACTION_WARNINGS
Description:
By default, Ansible will issue a warning when received from a task action (module or action plugin). These warnings can be silenced by adjusting this setting to False.
Type:
boolean
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
action_warnings
Environment:
Variable:
ANSIBLE_ACTION_WARNINGS
Description:
Display an agnostic become prompt instead of displaying a prompt containing the command line supplied become method.
Type:
boolean
Default:
Version Added:
Ini:
Section:
[privilege_escalation]
Key:
agnostic_become_prompt
Environment:
Variable:
ANSIBLE_AGNOSTIC_BECOME_PROMPT
Description:
Specify where to look for the ansible-connection script. This location will be checked before searching $PATH. If null, ansible will start with the same directory as the ansible script.
Type:
Default:
Version Added:
Ini:
Section:
[persistent_connection]
Key:
ansible_connection_path
Environment:
Variable:
ANSIBLE_CONNECTION_PATH
Description:
Accept a list of cowsay templates that are ‘safe’ to use, set to an empty list if you want to enable all installed templates.
Type:
Default:
['bud-frogs', 'bunny', 'cheese', 'daemon', 'default', 'dragon', 'elephant-in-snake', 'elephant', 'eyes', 'hellokitty', 'kitty', 'luke-koala', 'meow', 'milk', 'moofasa', 'moose', 'ren', 'sheep', 'small', 'stegosaurus', 'stimpy', 'supermilker', 'three-eyes', 'turkey', 'turtle', 'tux', 'udder', 'vader-koala', 'vader', 'www']
Ini:
Section:
[defaults]
Key:
cowsay_enabled_stencils
:Version Added: 2.11
Environment:
Variable:
ANSIBLE_COW_ACCEPTLIST
:Version Added: 2.11
Description:
Specify a custom cowsay path or swap in your cowsay implementation of choice.
Type:
string
Default:
Ini:
Section:
[defaults]
Key:
cowpath
Environment:
Variable:
ANSIBLE_COW_PATH
Description:
This allows you to choose a specific cowsay stencil for the banners or use ‘random’ to cycle through them.




    

Default:
default
Ini:
Section:
[defaults]
Key:
cow_selection
Environment:
Variable:
ANSIBLE_COW_SELECTION
Description:
This option forces color mode even when running without a TTY or the “nocolor” setting is True.
Type:
boolean
Default:
False
Ini:
Section:
[defaults]
Key:
force_color
Environment:
Variable:
ANSIBLE_FORCE_COLOR
Description:
This setting allows suppressing colorizing output, which is used to give a better indication of failure and status information.
Type:
boolean
Default:
False
Ini:
Section:
[defaults]
Key:
nocolor
Environment:
Variable:
ANSIBLE_NOCOLOR
Description:
If you have cowsay installed but want to avoid the ‘cows’ (why????), use this.
Type:
boolean
Default:
False
Ini:
Section:
[defaults]
Key:
nocows
Environment:
Variable:
ANSIBLE_NOCOWS
Description:
This is a global option, each connection plugin can override either by having more specific options or not supporting pipelining at all. Pipelining, if supported by the connection plugin, reduces the number of network operations required to execute a module on the remote server, by executing many Ansible modules without actual file transfer. It can result in a very significant performance improvement when enabled. However this conflicts with privilege escalation (become). For example, when using ‘sudo:’ operations you must first disable ‘requiretty’ in /etc/sudoers on all managed hosts, which is why it is disabled by default. This setting will be disabled if ANSIBLE_KEEP_REMOTE_FILES is enabled.
Type:
boolean
Default:
False
Ini:
Section:
[connection]
Key:
pipelining
Description:
Sets the default value for the any_errors_fatal keyword, if True, Task failures will be considered fatal errors.
Type:
boolean
Default:
False
Version Added:
Ini:
Section:
[defaults]
Key:
any_errors_fatal
Environment:
Variable:
ANSIBLE_ANY_ERRORS_FATAL
Description:
When False``(default), Ansible will skip using become if the remote user is the same as the become user, as this is normally a redundant operation. In other words root sudo to root. If ``True, this forces Ansible to use the become plugin anyways as there are cases in which this is needed.
Type:
boolean
Default:
False
Ini:
Section:
[privilege_escalation]
Key:
become_allow_same_user
Environment:
Variable:
ANSIBLE_BECOME_ALLOW_SAME_USER
Description:
The password file to use for the become plugin. --become-password-file. If executable, it will be run and the resulting stdout will be used as the password.
Type:
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
become_password_file
Environment:
Variable:
ANSIBLE_BECOME_PASSWORD_FILE
{{ ANSIBLE_HOME ~ "/plugins/become:/usr/share/ansible/plugins/become" }}
Version Added:
Ini:
Section:
[defaults]
Key:
become_plugins
Environment:
Variable:
ANSIBLE_BECOME_PLUGINS
Description:
List of enabled callbacks, not all callbacks need enabling, but many of those shipped with Ansible do as we don’t want them activated by default.
Type:
Default:
Ini:
Section:
[defaults]
Key:
callbacks_enabled
:Version Added: 2.11
Environment:
Variable:
ANSIBLE_CALLBACKS_ENABLED
:Version Added: 2.11
Description:
When a collection is loaded that does not support the running Ansible version (with the collection metadata key requires_ansible).
Default:
warning
Choices:
error:
issue a ‘fatal’ error and stop the play
Description:
Colon-separated paths in which Ansible will search for collections content. Collections must be in nested subdirectories, not directly in these directories. For example, if COLLECTIONS_PATHS includes '{{ ANSIBLE_HOME ~ "/collections" }}', and you want to add my.collection to that directory, it must be saved as '{{ ANSIBLE_HOME} ~ "/collections/ansible_collections/my/collection" }}'.
Type:
pathspec
Default:
{{ ANSIBLE_HOME ~ "/collections:/usr/share/ansible/collections" }}
Ini:
Section:
[defaults]
Key:
collections_paths
Deprecated in:
Deprecated detail:
does not fit var naming standard, use the singular form collections_path instead
Description:
A boolean to enable or disable scanning the sys.path for installed collections.
Type:
boolean
Default:
Ini:
Section:
[defaults]
Key:
collections_scan_sys_path
Environment:
Variable:
ANSIBLE_COLLECTIONS_SCAN_SYS_PATH
Description:
Defines the color to use when emitting verbose messages. In other words, those that show with ‘-v’s.
Default:
Ini:
Section:
[colors]
Key:
verbose
Environment:
Variable:
ANSIBLE_COLOR_VERBOSE
Description:
Which modules to run during a play’s fact gathering stage based on connection
Type:
Default:
{'asa': 'ansible.legacy.asa_facts', 'cisco.asa.asa': 'cisco.asa.asa_facts', 'eos': 'ansible.legacy.eos_facts', 'arista.eos.eos': 'arista.eos.eos_facts', 'frr': 'ansible.legacy.frr_facts', 'frr.frr.frr': 'frr.frr.frr_facts', 'ios': 'ansible.legacy.ios_facts', 'cisco.ios.ios': 'cisco.ios.ios_facts', 'iosxr': 'ansible.legacy.iosxr_facts', 'cisco.iosxr.iosxr': 'cisco.iosxr.iosxr_facts', 'junos': 'ansible.legacy.junos_facts', 'junipernetworks.junos.junos': 'junipernetworks.junos.junos_facts', 'nxos': 'ansible.legacy.nxos_facts', 'cisco.nxos.nxos': 'cisco.nxos.nxos_facts', 'vyos': 'ansible.legacy.vyos_facts', 'vyos.vyos.vyos': 'vyos.vyos.vyos_facts', 'exos': 'ansible.legacy.exos_facts', 'extreme.exos.exos': 'extreme.exos.exos_facts', 'slxos': 'ansible.legacy.slxos_facts', 'extreme.slxos.slxos': 'extreme.slxos.slxos_facts', 'voss': 'ansible.legacy.voss_facts', 'extreme.voss.voss': 'extreme.voss.voss_facts', 'ironware': 'ansible.legacy.ironware_facts', 'community.network.ironware': 'community.network.ironware_facts'}




    

Description:
The password file to use for the connection plugin. --connection-password-file.
Type:
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
connection_password_file
Environment:
Variable:
ANSIBLE_CONNECTION_PASSWORD_FILE
Description:
Sets the output directory on the remote host to generate coverage reports into. Currently only used for remote coverage on PowerShell modules. This is for internal use only.
Type:
Version Added:
Environment:
Variable:
_ANSIBLE_COVERAGE_REMOTE_OUTPUT
Variables:
name:
_ansible_coverage_remote_output
Description:
A list of paths for files on the Ansible controller to run coverage for when executing on the remote host. Only files that match the path glob will have their coverage collected. Multiple path globs can be specified and are separated by :. Currently only used for remote coverage on PowerShell modules. This is for internal use only.
Type:
Default:
Version Added:
Environment:
Variable:
_ANSIBLE_COVERAGE_REMOTE_PATH_FILTER
Description:
When enabled, this option allows lookup plugins (whether used in variables as {{lookup('foo')}} or as a loop as with_foo) to return data that is not marked ‘unsafe’. By default, such data is marked as unsafe to prevent the templating engine from evaluating any jinja2 templating language, as this could represent a security risk. This option is provided to allow for backward compatibility, however, users should first consider adding allow_unsafe=True to any lookups that may be expected to contain data that may be run through the templating engine late.
Type:
boolean
Default:
False
Version Added:
2.2.3
Ini:
Section:
[defaults]
Key:
allow_unsafe_lookups
Description:
This controls whether an Ansible playbook should prompt for a login password. If using SSH keys for authentication, you probably do not need to change this setting.
Type:
boolean
Default:
False
Ini:
Section:
[defaults]
Key:
ask_pass
Environment:
Variable:
ANSIBLE_ASK_PASS
Description:
This controls whether an Ansible playbook should prompt for a vault password.
Type:
boolean
Default:
False
Ini:
Section:
[defaults]
Key:
ask_vault_pass
Environment:
Variable:
ANSIBLE_ASK_VAULT_PASS
Description:
Toggles the use of privilege escalation, allowing you to ‘become’ another user after login.
Type:
boolean
Default:
False
Ini:
Section:
[privilege_escalation]
Key:
become
Environment:
Variable:
ANSIBLE_BECOME
Description:
executable to use for privilege escalation, otherwise Ansible will depend on PATH.
Default:
Ini:
Section:
[privilege_escalation]
Key:
become_exe
Environment:
Variable:
ANSIBLE_BECOME_EXE
Description:
The user your login/remote user ‘becomes’ when using privilege escalation, most systems will use ‘root’ when no user is specified.
Default:
Ini:
Section:
[privilege_escalation]
Key:
become_user
Environment:
Variable:
ANSIBLE_BECOME_USER
Default:
{{ ANSIBLE_HOME ~ "/plugins/callback:/usr/share/ansible/plugins/callback" }}
Ini:
Section:
[defaults]
Key:
callback_plugins
Environment:
Variable:
ANSIBLE_CALLBACK_PLUGINS
Default:
{{ ANSIBLE_HOME ~ "/plugins/connection:/usr/share/ansible/plugins/connection" }}
Ini:
Section:
[defaults]
Key:
connection_plugins
Environment:
Variable:
ANSIBLE_CONNECTION_PLUGINS
Description:
Toggles debug output in Ansible. This is very verbose and can hinder multiprocessing. Debug output can also include secret information despite no_log settings being enabled, which means debug mode should not be used in production.
Type:
boolean
Default:
False
Ini:
Section:
[defaults]
Key:
debug
Environment:
Variable:
ANSIBLE_DEBUG
Description:
This indicates the command to use to spawn a shell under, which is required for Ansible’s execution needs on a target. Users may need to change this in rare instances when shell usage is constrained, but in most cases, it may be left as is.
Default:
/bin/sh
Ini:
Section:
[defaults]
Key:
executable
Environment:
Variable:
ANSIBLE_EXECUTABLE
Description:
This option allows you to globally configure a custom path for ‘local_facts’ for the implied ansible_collections.ansible.builtin.setup_module task when using fact gathering. If not set, it will fall back to the default from the ansible.builtin.setup module: /etc/ansible/facts.d. This does not affect user defined tasks that use the ansible.builtin.setup module. The real action being created by the implicit task is currently ansible.legacy.gather_facts module, which then calls the configured fact modules, by default this will be ansible.builtin.setup for POSIX systems but other platforms might have different defaults.
Type:
string
Ini:
Section:
[defaults]
Key:
fact_path
Environment:
Variable:
ANSIBLE_FACT_PATH
Deprecated in:
Deprecated detail:
the module_defaults keyword is a more generic version and can apply to all calls to the M(ansible.builtin.gather_facts) or M(ansible.builtin.setup) actions
Deprecated alternatives:
module_defaults
Description:
Colon-separated paths in which Ansible will search for Jinja2 Filter Plugins.
Type:
pathspec
Default:
{{ ANSIBLE_HOME ~ "/plugins/filter:/usr/share/ansible/plugins/filter" }}
Ini:
Section:
[defaults]




    

Key:
filter_plugins
Environment:
Variable:
ANSIBLE_FILTER_PLUGINS
Description:
This option controls if notified handlers run on a host even if a failure occurs on that host. When false, the handlers will not run if a failure has occurred on a host. This can also be set per play or on the command line. See Handlers and Failure for more details.
Type:
boolean
Default:
False
Version Added:
1.9.1
Ini:
Section:
[defaults]
Key:
force_handlers
Environment:
Variable:
ANSIBLE_FORCE_HANDLERS
Description:
Set the gather_subset option for the ansible_collections.ansible.builtin.setup_module task in the implicit fact gathering. See the module documentation for specifics. It does not apply to user defined ansible.builtin.setup tasks.
Type:
Version Added:
Ini:
Section:
[defaults]
Key:
gather_subset
Environment:
Variable:
ANSIBLE_GATHER_SUBSET
Deprecated in:
Deprecated detail:
the module_defaults keyword is a more generic version and can apply to all calls to the M(ansible.builtin.gather_facts) or M(ansible.builtin.setup) actions
Deprecated alternatives:
module_defaults
Description:
Set the timeout in seconds for the implicit fact gathering, see the module documentation for specifics. It does not apply to user defined ansible_collections.ansible.builtin.setup_module tasks.
Type:
integer
Ini:
Section:
[defaults]
Key:
gather_timeout
Environment:
Variable:
ANSIBLE_GATHER_TIMEOUT
Deprecated in:
Deprecated detail:
the module_defaults keyword is a more generic version and can apply to all calls to the M(ansible.builtin.gather_facts) or M(ansible.builtin.setup) actions
Deprecated alternatives:
module_defaults
Description:
This setting controls the default policy of fact gathering (facts discovered about remote systems). This option can be useful for those wishing to save fact gathering time. Both ‘smart’ and ‘explicit’ will use the cache plugin.
Default:
implicit
Choices:
implicit:
the cache plugin will be ignored and facts will be gathered per play unless ‘gather_facts: False’ is set.
Description:
This setting controls how duplicate definitions of dictionary variables (aka hash, map, associative array) are handled in Ansible. This does not affect variables whose values are scalars (integers, strings) or arrays. WARNING, changing this setting is not recommended as this is fragile and makes your content (plays, roles, collections) nonportable, leading to continual confusion and misuse. Don’t change this setting unless you think you have an absolute need for it. We recommend avoiding reusing variable names and relying on the combine filter and vars and varnames lookups to create merged versions of the individual variables. In our experience, this is rarely needed and is a sign that too much complexity has been introduced into the data structures and plays. For some uses you can also look into custom vars_plugins to merge on input, even substituting the default host_group_vars that is in charge of parsing the host_vars/ and group_vars/ directories. Most users of this setting are only interested in inventory scope, but the setting itself affects all sources and makes debugging even harder. All playbooks and roles in the official examples repos assume the default for this setting. Changing the setting to merge applies across variable sources, but many sources will internally still overwrite the variables. For example include_vars will dedupe variables internally before updating Ansible, with ‘last defined’ overwriting previous definitions in same file. The Ansible project recommends you avoid ``merge`` for new projects. It is the intention of the Ansible developers to eventually deprecate and remove this setting, but it is being kept as some users do heavily rely on it. New projects should avoid ‘merge’.
Type:
string
Default:
replace
Choices:
replace:
Any variable that is defined more than once is overwritten using the order from variable precedence rules (highest wins).
Description:
This sets the interval (in seconds) of Ansible internal processes polling each other. Lower values improve performance with large playbooks at the expense of extra CPU load. Higher values are more suitable for Ansible usage in automation scenarios when UI responsiveness is not required but CPU usage might be a concern. The default corresponds to the value hardcoded in Ansible <= 2.1
Type:
float
Default:
0.001
Version Added:
Ini:
Section:
[defaults]
Key:
internal_poll_interval
Default:
{{ ANSIBLE_HOME ~ "/plugins/inventory:/usr/share/ansible/plugins/inventory" }}
Ini:
Section:
[defaults]
Key:
inventory_plugins
Environment:
Variable:
ANSIBLE_INVENTORY_PLUGINS
Description:
This is a developer-specific feature that allows enabling additional Jinja2 extensions. See the Jinja2 documentation for details. If you do not know what these do, you probably don’t need to change this setting :)
Default:
Ini:
Section:
[defaults]
Key:
jinja2_extensions
Environment:
Variable:
ANSIBLE_JINJA2_EXTENSIONS
Description:
Enables/disables the cleaning up of the temporary files Ansible used to execute the tasks on the remote. If this option is enabled it will disable ANSIBLE_PIPELINING.
Type:
boolean
Default:
False
Ini:
Section:
[defaults]
Key:
keep_remote_files
Environment:
Variable:
ANSIBLE_KEEP_REMOTE_FILES
Description:
This setting causes libvirt to connect to LXC containers by passing --noseclabel parameter to virsh command. This is necessary when running on systems which do not have SELinux.
Type:
boolean
Default:
False
Version Added:
Ini:
Section:
[selinux]
Key:
libvirt_lxc_noseclabel
Environment:
Variable:
ANSIBLE_LIBVIRT_LXC_NOSECLABEL
Description:
Controls whether callback plugins are loaded when running /usr/bin/ansible. This may be used to log activity from the command line, send notifications, and so on. Callback plugins are always loaded for ansible-playbook.
Type:
boolean
Default:
False
Version Added:
Ini:
Section:
[defaults]
Key:
bin_ansible_callbacks
Environment:
Variable:
ANSIBLE_LOAD_CALLBACK_PLUGINS
Description:
File to which Ansible will log on the controller. When empty logging is disabled.
Type:
Default:
Ini:
Section:
[defaults]
Key:
log_path
Environment:
Variable:
ANSIBLE_LOG_PATH
Description:
Sets the macro for the ‘ansible_managed’ variable available for ansible_collections.ansible.builtin.template_module and ansible_collections.ansible.windows.win_template_module.  This is only relevant to those two modules.
Default:
Ansible managed




    

Ini:
Section:
[defaults]
Key:
ansible_managed
Description:
This sets the default arguments to pass to the ansible adhoc binary if no -a is specified.
Default:
Ini:
Section:
[defaults]
Key:
module_args
Environment:
Variable:
ANSIBLE_MODULE_ARGS
Description:
Colon-separated paths in which Ansible will search for Module utils files, which are shared by modules.
Type:
pathspec
Default:
{{ ANSIBLE_HOME ~ "/plugins/module_utils:/usr/share/ansible/plugins/module_utils" }}
Ini:
Section:
[defaults]
Key:
module_utils
Environment:
Variable:
ANSIBLE_MODULE_UTILS
Description:
Toggle Ansible’s display and logging of task details, mainly used to avoid security disclosures.
Type:
boolean
Default:
False
Ini:
Section:
[defaults]
Key:
no_log
Environment:
Variable:
ANSIBLE_NO_LOG
Description:
Toggle Ansible logging to syslog on the target when it executes tasks. On Windows hosts, this will disable a newer style PowerShell modules from writing to the event log.
Type:
boolean
Default:
False
Ini:
Section:
[defaults]
Key:
no_target_syslog
Environment:
Variable:
ANSIBLE_NO_TARGET_SYSLOG
Variables:
name:
ansible_no_target_syslog
:Version Added: 2.10
Description:
What templating should return as a ‘null’ value. When not set it will let Jinja2 decide.
Type:
Default:
Ini:
Section:
[defaults]
Key:
null_representation
Environment:
Variable:
ANSIBLE_NULL_REPRESENTATION
Description:
For asynchronous tasks in Ansible (covered in Asynchronous Actions and Polling), this is how often to check back on the status of those tasks when an explicit poll interval is not supplied. The default is a reasonably moderate 15 seconds which is a tradeoff between checking in frequently and providing a quick turnaround when something may have completed.
Type:
integer
Default:
Ini:
Section:
[defaults]
Key:
poll_interval
Environment:
Variable:
ANSIBLE_POLL_INTERVAL
Description:
Option for connections using a certificate or key file to authenticate, rather than an agent or passwords, you can set the default value here to avoid re-specifying --private-key with every invocation.
Type:
Default:
Ini:
Section:
[defaults]
Key:
private_key_file
Environment:
Variable:
ANSIBLE_PRIVATE_KEY_FILE
Description:
By default, imported roles publish their variables to the play and other roles, this setting can avoid that. This was introduced as a way to reset role variables to default values if a role is used more than once in a playbook. Starting in version ‘2.17’ M(ansible.builtin.include_roles) and M(ansible.builtin.import_roles) can indivudually override this via the C(public) parameter. Included roles only make their variables public at execution, unlike imported roles which happen at playbook compile time.
Type:
boolean
Default:
False
Ini:
Section:
[defaults]
Key:
private_role_vars
Environment:
Variable:
ANSIBLE_PRIVATE_ROLE_VARS
Description:
Port to use in remote connections, when blank it will use the connection plugin default.
Type:
integer
Default:
Ini:
Section:
[defaults]
Key:
remote_port
Environment:
Variable:
ANSIBLE_REMOTE_PORT
Description:
Sets the login user for the target machines When blank it uses the connection plugin’s default, normally the user currently executing Ansible.
Ini:
Section:
[defaults]
Key:
remote_user
Environment:
Variable:
ANSIBLE_REMOTE_USER
Description:
Some filesystems do not support safe operations and/or return inconsistent errors, this setting makes Ansible ‘tolerate’ those in the list without causing fatal errors. Data corruption may occur and writes are not always verified when a filesystem is in the list.
Type:
Default:
fuse, nfs, vboxsf, ramfs, 9p, vfat
Ini:
Section:
[selinux]
Key:
special_context_filesystems
Environment:
Variable:
ANSIBLE_SELINUX_SPECIAL_FS
:Version Added: 2.9
Description:
Set the main callback used to display Ansible output. You can only have one at a time. You can have many other callbacks, but just one can be in charge of stdout. See Callback plugins for a list of available options.
Default:
default
Ini:
Section:
[defaults]
Key:
stdout_callback
Environment:
Variable:
ANSIBLE_STDOUT_CALLBACK
Default:
{{ ANSIBLE_HOME ~ "/plugins/strategy:/usr/share/ansible/plugins/strategy" }}
Ini:
Section:
[defaults]
Key:
strategy_plugins
Environment:
Variable:
ANSIBLE_STRATEGY_PLUGINS
Default:
{{ ANSIBLE_HOME ~ "/plugins/terminal:/usr/share/ansible/plugins/terminal" }}
Ini:
Section:
[defaults]
Key:
terminal_plugins
Environment:
Variable:
ANSIBLE_TERMINAL_PLUGINS
Description:
Can be any connection plugin available to your ansible installation. There is also a (DEPRECATED) special ‘smart’ option, that will toggle between ‘ssh’ and ‘paramiko’ depending on controller OS and ssh versions.
Default:
Ini:
Section:
[defaults]
Key:
transport
Environment:
Variable:
ANSIBLE_TRANSPORT
Description:
When True, this causes ansible templating to fail steps that reference variable names that are likely typoed. Otherwise, any ‘{{ template_expression }}’ that contains undefined variables will be rendered in a template or ansible action line exactly as written.
Type:
boolean
Default:
Version Added:
Ini:
Section:
[defaults]




    

Key:
error_on_undefined_vars
Environment:
Variable:
ANSIBLE_ERROR_ON_UNDEFINED_VARS
Description:
The vault_id to use for encrypting by default. If multiple vault_ids are provided, this specifies which to use for encryption. The --encrypt-vault-id CLI option overrides the configured value.
Ini:
Section:
[defaults]
Key:
vault_encrypt_identity
Environment:
Variable:
ANSIBLE_VAULT_ENCRYPT_IDENTITY
Description:
If true, decrypting vaults with a vault id will only try the password from the matching vault-id.
Default:
False
Ini:
Section:
[defaults]
Key:
vault_id_match
Environment:
Variable:
ANSIBLE_VAULT_ID_MATCH
Description:
The label to use for the default vault id label in cases where a vault id label is not provided.
Default:
default
Ini:
Section:
[defaults]
Key:
vault_identity
Environment:
Variable:
ANSIBLE_VAULT_IDENTITY
Description:
A list of vault-ids to use by default. Equivalent to multiple --vault-id args. Vault-ids are tried in order.
Type:
Default:
Ini:
Section:
[defaults]
Key:
vault_identity_list
Environment:
Variable:
ANSIBLE_VAULT_IDENTITY_LIST
Description:
The vault password file to use. Equivalent to --vault-password-file or --vault-id. If executable, it will be run and the resulting stdout will be used as the password.
Type:
Default:
Ini:
Section:
[defaults]
Key:
vault_password_file
Environment:
Variable:
ANSIBLE_VAULT_PASSWORD_FILE
Description:
Sets the default verbosity, equivalent to the number of -v passed in the command line.
Type:
integer
Default:
Ini:
Section:
[defaults]
Key:
verbosity
Environment:
Variable:
ANSIBLE_VERBOSITY
Description:
Configuration toggle to tell modules to show differences when in ‘changed’ status, equivalent to --diff.
Type:
Default:
False
Ini:
Section:
[diff]
Key:
always
Environment:
Variable:
ANSIBLE_DIFF_ALWAYS
Description:
Number of lines of context to show when displaying the differences between files.
Type:
integer
Default:
Ini:
Section:
[diff]
Key:
context
Environment:
Variable:
ANSIBLE_DIFF_CONTEXT
Description:
Normally ansible-playbook will print a header for each task that is run. These headers will contain the name: field from the task if you specified one. If you didn’t then ansible-playbook uses the task’s action to help you tell which task is presently running. Sometimes you run many of the same action and so you want more information about the task to differentiate it from others of the same action. If you set this variable to True in the config then ansible-playbook will also include the task’s arguments in the header. This setting defaults to False because there is a chance that you have sensitive values in your parameters and you do not want those to be printed. If you set this to True you should be sure that you have secured your environment’s stdout (no one can shoulder surf your screen and you aren’t saving stdout to an insecure file) or made sure that all of your playbooks explicitly added the no_log: True parameter to tasks that have sensitive values How do I keep secret data in my playbook? for more information.
Type:
boolean
Default:
False
Version Added:
Ini:
Section:
[defaults]
Key:
display_args_to_stdout
Environment:
Variable:
ANSIBLE_DISPLAY_ARGS_TO_STDOUT
Description:
Toggle to control displaying skipped task/host entries in a task in the default callback.
Type:
boolean
Default:
Ini:
Section:
[defaults]
Key:
display_skipped_hosts
Environment:
Variable:
ANSIBLE_DISPLAY_SKIPPED_HOSTS
Description:
Colon-separated paths in which Ansible will search for Documentation Fragments Plugins.
Type:
pathspec
Default:
{{ ANSIBLE_HOME ~ "/plugins/doc_fragments:/usr/share/ansible/plugins/doc_fragments" }}
Ini:
Section:
[defaults]
Key:
doc_fragment_plugins
Environment:
Variable:
ANSIBLE_DOC_FRAGMENT_PLUGINS
Description:
Root docsite URL used to generate docs URLs in warning/error text; must be an absolute URL with a valid scheme and trailing slash.
Default:
https://docs.ansible.com/ansible-core/
Version Added:
Ini:
Section:
[defaults]
Key:
docsite_root_url
Description:
By default, Ansible will issue a warning when a duplicate dict key is encountered in YAML. These warnings can be silenced by adjusting this setting to False.
Type:
string
Default:
Choices:
error:
issue a ‘fatal’ error and stop the play
Description:
Whether or not to enable the task debugger, this previously was done as a strategy plugin. Now all strategy plugins can inherit this behavior. The debugger defaults to activating when a task is failed on unreachable. Use the debugger keyword for more flexibility.
Type:
boolean
Default:
False
Version Added:
Ini:
Section:
[defaults]
Key:
enable_task_debugger
Environment:
Variable:
ANSIBLE_ENABLE_TASK_DEBUGGER
Description:
Toggle to allow missing handlers to become a warning instead of an error when notifying.
Type:
boolean
Default:
Ini:
Section:
[defaults]
Key:
error_on_missing_handler
Environment:
Variable:
ANSIBLE_ERROR_ON_MISSING_HANDLER
Description:
Which modules to run during a play’s fact gathering stage, using the default of ‘smart’ will try to figure it out based on connection type. If adding your own modules but you still want to use the default Ansible facts, you will want to include ‘setup’ or corresponding network module to the list (if you add ‘smart’, Ansible will also figure it out). This does not affect explicit calls to the ‘setup’ module, but does always affect the ‘gather_facts’ action (implicit or explicit).




    

Type:
Default:
['smart']
Ini:
Section:
[defaults]
Key:
facts_modules
Environment:
Variable:
ANSIBLE_FACTS_MODULES
Variables:
name:
ansible_facts_modules
Description:
The directory that stores cached responses from a Galaxy server. This is only used by the ansible-galaxy collection install and download commands. Cache files inside this dir will be ignored if they are world writable.
Type:
Default:
{{ ANSIBLE_HOME ~ "/galaxy_cache" }}
Version Added:
Ini:
Section:
[galaxy]
Key:
cache_dir
Environment:
Variable:
ANSIBLE_GALAXY_CACHE_DIR
Description:
Collection skeleton directory to use as a template for the init action in ansible-galaxy collection, same as --collection-skeleton.
Type:
Ini:
Section:
[galaxy]
Key:
collection_skeleton
Environment:
Variable:
ANSIBLE_GALAXY_COLLECTION_SKELETON
Description:
whether ansible-galaxy collection install should warn about --collections-path missing from configured COLLECTIONS_PATHS.
Type:
Default:
Version Added:
Ini:
Section:
[galaxy]
Key:
collections_path_warning
Environment:
Variable:
ANSIBLE_GALAXY_COLLECTIONS_PATH_WARNING
Description:
Some steps in ansible-galaxy display a progress wheel which can cause issues on certain displays or when outputting the stdout to a file. This config option controls whether the display wheel is shown or not. The default is to show the display wheel if stdout has a tty.
Type:
Default:
Version Added:
Ini:
Section:
[galaxy]
Key:
display_progress
Environment:
Variable:
ANSIBLE_GALAXY_DISPLAY_PROGRESS
Description:
Configure the keyring used for GPG signature verification during collection installation and verification.
Type:
Version Added:
Ini:
Section:
[galaxy]
Key:
gpg_keyring
Environment:
Variable:
ANSIBLE_GALAXY_GPG_KEYRING
Description:
If set to yes, ansible-galaxy will not validate TLS certificates. This can be useful for testing against a server with a self-signed certificate.
Type:
boolean
Ini:
Section:
[galaxy]
Key:
ignore_certs
Environment:
Variable:
ANSIBLE_GALAXY_IGNORE
Description:
A list of GPG status codes to ignore during GPG signature verification. See L(https://github.com/gpg/gnupg/blob/master/doc/DETAILS#general-status-codes) for status code descriptions. If fewer signatures successfully verify the collection than GALAXY_REQUIRED_VALID_SIGNATURE_COUNT, signature verification will fail even if all error codes are ignored.
Type:
Choices:
EXPSIG
EXPKEYSIG
REVKEYSIG
BADSIG
ERRSIG
NO_PUBKEY
MISSING_PASSPHRASE
BAD_PASSPHRASE
NODATA
UNEXPECTED
ERROR
FAILURE
BADARMOR
KEYEXPIRED
KEYREVOKED
NO_SECKEY
Ini:
Section:
[galaxy]
Key:
ignore_signature_status_codes
Environment:
Variable:
ANSIBLE_GALAXY_IGNORE_SIGNATURE_STATUS_CODES
Description:
The number of signatures that must be successful during GPG signature verification while installing or verifying collections. This should be a positive integer or all to indicate all signatures must successfully validate the collection. Prepend + to the value to fail if no valid signatures are found for the collection.
Type:
Default:
Ini:
Section:
[galaxy]
Key:
required_valid_signature_count
Environment:
Variable:
ANSIBLE_GALAXY_REQUIRED_VALID_SIGNATURE_COUNT
Description:
Role skeleton directory to use as a template for the init action in ansible-galaxy/ansible-galaxy role, same as --role-skeleton.
Type:
Ini:
Section:
[galaxy]
Key:
role_skeleton
Environment:
Variable:
ANSIBLE_GALAXY_ROLE_SKELETON
Description:
patterns of files to ignore inside a Galaxy role or collection skeleton directory.
Type:
Default:
['^.git$', '^.*/.git_keep$']
Ini:
Section:
[galaxy]
Key:
role_skeleton_ignore
Environment:
Variable:
ANSIBLE_GALAXY_ROLE_SKELETON_IGNORE
Description:
URL to prepend when roles don’t specify the full URI, assume they are referencing this server as the source.
Default:
https://galaxy.ansible.com
Ini:
Section:
[galaxy]
Key:
server
Environment:
Variable:
ANSIBLE_GALAXY_SERVER
Description:
A list of Galaxy servers to use when installing a collection. The value corresponds to the config ini header [galaxy_server.{{item}}] which defines the server details. See Configuring the ansible-galaxy client for more details on how to define a Galaxy server. The order of servers in this list is used as the order in which a collection is resolved. Setting this config option will ignore the GALAXY_SERVER config option.
Type:
Version Added:
Ini:
Section:
[galaxy]
Key:
server_list
Environment:
Variable:
ANSIBLE_GALAXY_SERVER_LIST
Description:
The default timeout for Galaxy API calls. Galaxy servers that don’t configure a specific timeout will fall back to this value.
Type:
Default:
Ini:
Section:
[galaxy]
Key:
server_timeout
Environment:
Variable:
ANSIBLE_GALAXY_SERVER_TIMEOUT
Description:
Set this to “False” if you want to avoid host key checking by the underlying connection plugin Ansible uses to connect to the host. Please read the documentation of the specific connection plugin used for details.
Type:
boolean
Default:
Ini:
Section:
[defaults]
Key:
host_key_checking




    

Environment:
Variable:
ANSIBLE_HOST_KEY_CHECKING
Description:
This setting changes the behaviour of mismatched host patterns, it allows you to force a fatal error, a warning or just ignore it.
Default:
warning
Choices:
error:
issue a ‘fatal’ error and stop the play
Description:
Facts are available inside the ansible_facts variable, this setting also pushes them as their own vars in the main namespace. Unlike inside the ansible_facts dictionary, these will have an ansible_ prefix.
Type:
boolean
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
inject_facts_as_vars
Environment:
Variable:
ANSIBLE_INJECT_FACT_VARS
Description:
Path to the Python interpreter to be used for module execution on remote targets, or an automatic discovery mode. Supported discovery modes are auto (the default), auto_silent, auto_legacy, and auto_legacy_silent. All discovery modes employ a lookup table to use the included system Python (on distributions known to include one), falling back to a fixed ordered list of well-known Python interpreter locations if a platform-specific default is not available. The fallback behavior will issue a warning that the interpreter should be set explicitly (since interpreters installed later may change which one is used). This warning behavior can be disabled by setting auto_silent or auto_legacy_silent. The value of auto_legacy provides all the same behavior, but for backward-compatibility with older Ansible releases that always defaulted to /usr/bin/python, will use that interpreter if present.
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
interpreter_python
Environment:
Variable:
ANSIBLE_PYTHON_INTERPRETER
Variables:
name:
ansible_python_interpreter
Default:
['python3.12', 'python3.11', 'python3.10', 'python3.9', 'python3.8', 'python3.7', '/usr/bin/python3', 'python3']
Version Added:
Variables:
name:
ansible_interpreter_python_fallback
Description:
If ‘false’, invalid attributes for a task will result in warnings instead of errors.
Type:
boolean
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
invalid_task_attribute_failed
Environment:
Variable:
ANSIBLE_INVALID_TASK_ATTRIBUTE_FAILED
Description:
If ‘true’, it is a fatal error when any given inventory source cannot be successfully parsed by any available inventory plugin; otherwise, this situation only attracts a warning.
Type:
boolean
Default:
False
Version Added:
Ini:
Section:
[inventory]
Key:
any_unparsed_is_failed
Environment:
Variable:
ANSIBLE_INVENTORY_ANY_UNPARSED_IS_FAILED
Description:
Toggle to turn on inventory caching. This setting has been moved to the individual inventory plugins as a plugin option Inventory plugins. The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory configuration. This message will be removed in 2.16.
Type:
Default:
False
Ini:
Section:
[inventory]
Key:
cache
Environment:
Variable:
ANSIBLE_INVENTORY_CACHE
Description:
The plugin for caching inventory. This setting has been moved to the individual inventory plugins as a plugin option Inventory plugins. The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration. This message will be removed in 2.16.
Ini:
Section:
[inventory]
Key:
cache_plugin
Environment:
Variable:
ANSIBLE_INVENTORY_CACHE_PLUGIN
Description:
The inventory cache connection. This setting has been moved to the individual inventory plugins as a plugin option Inventory plugins. The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration. This message will be removed in 2.16.
Ini:
Section:
[inventory]
Key:
cache_connection
Environment:
Variable:
ANSIBLE_INVENTORY_CACHE_CONNECTION
Description:
The table prefix for the cache plugin. This setting has been moved to the individual inventory plugins as a plugin option Inventory plugins. The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration. This message will be removed in 2.16.
Default:
ansible_inventory_
Ini:
Section:
[inventory]
Key:
cache_prefix
Environment:
Variable:
ANSIBLE_INVENTORY_CACHE_PLUGIN_PREFIX
Description:
Expiration timeout for the inventory cache plugin data. This setting has been moved to the individual inventory plugins as a plugin option Inventory plugins. The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration. This message will be removed in 2.16.
Default:
Ini:
Section:
[inventory]
Key:
cache_timeout
Environment:
Variable:
ANSIBLE_INVENTORY_CACHE_TIMEOUT
Description:
List of enabled inventory plugins, it also determines the order in which they are used.
Type:
Default:
['host_list', 'script', 'auto', 'yaml', 'ini', 'toml']
Ini:
Section:
[inventory]
Key:
enable_plugins
Environment:
Variable:
ANSIBLE_INVENTORY_ENABLED
Description:
Controls if ansible-inventory will accurately reflect Ansible’s view into inventory or its optimized for exporting.
Type:
Default:
False
Ini:
Section:
[inventory]
Key:
export
Environment:
Variable:
ANSIBLE_INVENTORY_EXPORT
Description:
If ‘true’ it is a fatal error if every single potential inventory source fails to parse, otherwise, this situation will only attract a warning.
Type:
Default:
False
Ini:
Section:
[inventory]
Key:
unparsed_is_failed
Environment:
Variable:
ANSIBLE_INVENTORY_UNPARSED_FAILED
Description:
By default, Ansible will issue a warning when no inventory was loaded and notes that it will use an implicit localhost-only inventory. These warnings can be silenced by adjusting this setting to False.
Type:
boolean




    

Default:
Version Added:
Ini:
Section:
[inventory]
Key:
inventory_unparsed_warning
Environment:
Variable:
ANSIBLE_INVENTORY_UNPARSED_WARNING
Description:
By default, Ansible will issue a warning when there are no hosts in the inventory. These warnings can be silenced by adjusting this setting to False.
Type:
boolean
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
localhost_warning
Environment:
Variable:
ANSIBLE_LOCALHOST_WARNING
Description:
This will set log verbosity if higher than the normal display verbosity, otherwise it will match that.
Type:
Version Added:
Ini:
Section:
[defaults]
Key:
log_verbosity
Environment:
Variable:
ANSIBLE_LOG_VERBOSITY
Description:
List of extensions to ignore when looking for modules to load. This is for rejecting script and binary module fallback extensions.
Type:
Default:
{{(REJECT_EXTS + ('.yaml', '.yml', '.ini'))}}
Ini:
Section:
[defaults]
Key:
module_ignore_exts
Environment:
Variable:
ANSIBLE_MODULE_IGNORE_EXTS
Description:
Enables whether module responses are evaluated for containing non-UTF-8 data. Disabling this may result in unexpected behavior. Only ansible-core should evaluate this configuration.
Type:
Default:
Ini:
Section:
[defaults]
Key:
module_strict_utf8_response
Environment:
Variable:
ANSIBLE_MODULE_STRICT_UTF8_RESPONSE
Description:
This variable is used to enable bastion/jump host with netconf connection. If set to True the bastion/jump host ssh settings should be present in ~/.ssh/config file, alternatively it can be set to custom ssh configuration file path to read the bastion/jump host settings.
Default:
Ini:
Section:
[netconf_connection]
Key:
ssh_config
Environment:
Variable:
ANSIBLE_NETCONF_SSH_CONFIG
Default:
['eos', 'nxos', 'ios', 'iosxr', 'junos', 'enos', 'ce', 'vyos', 'sros', 'dellos9', 'dellos10', 'dellos6', 'asa', 'aruba', 'aireos', 'bigip', 'ironware', 'onyx', 'netconf', 'exos', 'voss', 'slxos']
Ini:
Section:
[defaults]
Key:
network_group_modules
Environment:
Variable:
ANSIBLE_NETWORK_GROUP_MODULES
Description:
Previously Ansible would only clear some of the plugin loading caches when loading new roles, this led to some behaviors in which a plugin loaded in previous plays would be unexpectedly ‘sticky’. This setting allows the user to return to that behavior.
Type:
boolean
Default:
False
Version Added:
Ini:
Section:
[defaults]
Key:
old_plugin_cache_clear
Environment:
Variable:
ANSIBLE_OLD_PLUGIN_CACHE_CLEAR
Description:
This controls the amount of time to wait for a response from a remote device before timing out a persistent connection.
Type:
Default:
Ini:
Section:
[persistent_connection]
Key:
command_timeout
Environment:
Variable:
ANSIBLE_PERSISTENT_COMMAND_TIMEOUT
Description:
This controls the retry timeout for persistent connection to connect to the local domain socket.
Type:
integer
Default:
Ini:
Section:
[persistent_connection]
Key:
connect_retry_timeout
Environment:
Variable:
ANSIBLE_PERSISTENT_CONNECT_RETRY_TIMEOUT
Description:
This controls how long the persistent connection will remain idle before it is destroyed.
Type:
integer
Default:
Ini:
Section:
[persistent_connection]
Key:
connect_timeout
Environment:
Variable:
ANSIBLE_PERSISTENT_CONNECT_TIMEOUT
Description:
A number of non-playbook CLIs have a --playbook-dir argument; this sets the default value for it.
Type:
Version Added:
Ini:
Section:
[defaults]
Key:
playbook_dir
Environment:
Variable:
ANSIBLE_PLAYBOOK_DIR
Description:
This sets which playbook dirs will be used as a root to process vars plugins, which includes finding host_vars/group_vars.
Default:
Choices:
top:
follows the traditional behavior of using the top playbook in the chain to find the root directory.
Description:
A path to configuration for filtering which plugins installed on the system are allowed to be used. See Rejecting modules for details of the filter file’s format.  The default is /etc/ansible/plugin_filters.yml
Type:
Default:
Version Added:
2.5.0
Ini:
Section:
[defaults]
Key:
plugin_filters_cfg
Description:
Attempts to set RLIMIT_NOFILE soft limit to the specified value when executing Python modules (can speed up subprocess usage on Python 2.x. See https://bugs.python.org/issue11284). The value will be limited by the existing hard limit. Default value of 0 does not attempt to adjust existing system-defined limits.
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
python_module_rlimit_nofile
Environment:
Variable:
ANSIBLE_PYTHON_MODULE_RLIMIT_NOFILE
Variables:
name:
ansible_python_module_rlimit_nofile
Description:
This controls whether a failed Ansible playbook should create a .retry file.
Type:
Default:
False
Ini:
Section:
[defaults]
Key:
retry_files_enabled
Environment:
Variable:
ANSIBLE_RETRY_FILES_ENABLED
Description:
This sets the path in which Ansible will save .retry files when a playbook fails and retry files are enabled. This file will be overwritten after each run with the list of failed hosts from all plays.
Type:
Default:
Ini:
Section:
[defaults]
Key:
retry_files_save_path
Environment:
Variable:
ANSIBLE_RETRY_FILES_SAVE_PATH




    

Description:
This setting can be used to optimize vars_plugin usage depending on the user’s inventory size and play selection.
Type:
Default:
demand
Choices:
demand:
will run vars_plugins relative to inventory sources anytime vars are ‘demanded’ by tasks.
Description:
This adds the custom stats set via the set_stats plugin to the default output.
Type:
Default:
False
Ini:
Section:
[defaults]
Key:
show_custom_stats
Environment:
Variable:
ANSIBLE_SHOW_CUSTOM_STATS
Description:
Action to take when a module parameter value is converted to a string (this does not affect variables). For string parameters, values such as ‘1.00’, “[‘a’, ‘b’,]”, and ‘yes’, ‘y’, etc. will be converted by the YAML parser unless fully quoted. Valid options are ‘error’, ‘warn’, and ‘ignore’. Since 2.8, this option defaults to ‘warn’ but will change to ‘error’ in 2.12.
Type:
string
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
string_conversion_action
Environment:
Variable:
ANSIBLE_STRING_CONVERSION_ACTION
Deprecated in:
Deprecated detail:
This option is no longer used in the Ansible Core code base.
Deprecated alternatives:
There is no alternative at the moment. A different mechanism would have to be implemented in the current code base.
Description:
This list of filters avoids ‘type conversion’ when templating variables. Useful when you want to avoid conversion into lists or dictionaries for JSON strings, for example.
Type:
Default:
['string', 'to_json', 'to_nice_json', 'to_yaml', 'to_nice_yaml', 'ppretty', 'json']
Ini:
Section:
[jinja2]
Key:
dont_type_filters
Environment:
Variable:
ANSIBLE_STRING_TYPE_FILTERS
Description:
Allows disabling of warnings related to potential issues on the system running Ansible itself (not on the managed hosts). These may include warnings about third-party packages or other conditions that should be resolved if possible.
Type:
boolean
Default:
Ini:
Section:
[defaults]
Key:
system_warnings
Environment:
Variable:
ANSIBLE_SYSTEM_WARNINGS
Description:
This option defines whether the task debugger will be invoked on a failed task when ignore_errors=True is specified. True specifies that the debugger will honor ignore_errors, and False will not honor ignore_errors.
Type:
boolean
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
task_debugger_ignore_errors
Environment:
Variable:
ANSIBLE_TASK_DEBUGGER_IGNORE_ERRORS
Description:
Set the maximum time (in seconds) that a task can run for. If set to 0 (the default) there is no timeout.
Type:
integer
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
task_timeout
Environment:
Variable:
ANSIBLE_TASK_TIMEOUT
Description:
Make ansible transform invalid characters in group names supplied by inventory sources.
Type:
string
Default:
never
Choices:
always:
it will replace any invalid characters with ‘_’ (underscore) and warn the user
Description:
A toggle to disable validating a collection’s ‘metadata’ entry for a module_defaults action group. Metadata containing unexpected fields or value types will produce a warning when this is True.
Type:
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
validate_action_group_metadata
Environment:
Variable:
ANSIBLE_VALIDATE_ACTION_GROUP_METADATA
Default:
['all_inventory', 'groups_inventory', 'all_plugins_inventory', 'all_plugins_play', 'groups_plugins_inventory', 'groups_plugins_play']
Version Added:
Ini:
Section:
[defaults]
Key:
precedence
Environment:
Variable:
ANSIBLE_PRECEDENCE
Description:
The salt to use for the vault encryption. If it is not provided, a random salt will be used.
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
vault_encrypt_salt
Environment:
Variable:
ANSIBLE_VAULT_ENCRYPT_SALT
Description:
For asynchronous tasks in Ansible (covered in Asynchronous Actions and Polling), this is how long, in seconds, to wait for the task spawned by Ansible to connect back to the named pipe used on Windows systems. The default is 5 seconds. This can be too low on slower systems, or systems under heavy load. This is not the total time an async command can run for, but is a separate timeout to wait for an async command to start. The task will only start to be timed against its async_timeout once it has connected to the pipe, so the overall maximum duration the task can take will be extended by the amount specified here.
Type:
integer
Default:
Version Added:
Ini:
Section:
[defaults]
Key:
win_async_startup_timeout
Environment:
Variable:
ANSIBLE_WIN_ASYNC_STARTUP_TIMEOUT
Variables:
name:
ansible_win_async_startup_timeout
Description:
The maximum number of times to check Task Queue Manager worker processes to verify they have exited cleanly. After this limit is reached any worker processes still running will be terminated. This is for internal use only.
Type:
integer
Default:
Version Added:
Environment:
Variable:
ANSIBLE_WORKER_SHUTDOWN_POLL_COUNT
Description:
The number of seconds to sleep between polling loops when checking Task Queue Manager worker processes to verify they have exited cleanly. This is for internal use only.
Type:
float
Default:
Version Added:
Environment:
Variable:
ANSIBLE_WORKER_SHUTDOWN_POLL_DELAY
Description:
Check all of these extensions when looking for ‘variable’ files which should be YAML or JSON or vaulted versions of these. This affects vars_files, include_vars, inventory and vars plugins among others.
Type:
Default:
['.yml', '.yaml', '.json']
Ini:
Section:
[defaults]
Key:
yaml_valid_extensions
Environment:
Variable:
ANSIBLE_YAML_FILENAME_EXT
Environment Variables
Other environment variables to configure plugins in collections can be found in Index of all Collection Environment Variables.
ANSIBLE_CONFIG
Override the default ansible config file
ANSIBLE_CONNECTION_PATH
Specify where to look for the ansible-connection script. This location will be checked before searching $PATH.If null, ansible will start with the same directory as the ansible script.




    

See also ANSIBLE_CONNECTION_PATH
ANSIBLE_COW_SELECTION
This allows you to choose a specific cowsay stencil for the banners or use ‘random’ to cycle through them.
See also ANSIBLE_COW_SELECTION
ANSIBLE_COW_ACCEPTLIST
Accept a list of cowsay templates that are ‘safe’ to use, set to an empty list if you want to enable all installed templates.
See also ANSIBLE_COW_ACCEPTLIST
Version Added:
ANSIBLE_FORCE_COLOR
This option forces color mode even when running without a TTY or the “nocolor” setting is True.
See also ANSIBLE_FORCE_COLOR
ANSIBLE_NOCOLOR
This setting allows suppressing colorizing output, which is used to give a better indication of failure and status information.
See also ANSIBLE_NOCOLOR
NO_COLOR
This setting allows suppressing colorizing output, which is used to give a better indication of failure and status information.
See also ANSIBLE_NOCOLOR
Version Added:
ANSIBLE_NOCOWS
If you have cowsay installed but want to avoid the ‘cows’ (why????), use this.
See also ANSIBLE_NOCOWS
ANSIBLE_COW_PATH
Specify a custom cowsay path or swap in your cowsay implementation of choice.
See also ANSIBLE_COW_PATH
ANSIBLE_PIPELINING
This is a global option, each connection plugin can override either by having more specific options or not supporting pipelining at all.Pipelining, if supported by the connection plugin, reduces the number of network operations required to execute a module on the remote server, by executing many Ansible modules without actual file transfer.It can result in a very significant performance improvement when enabled.However this conflicts with privilege escalation (become). For example, when using ‘sudo:’ operations you must first disable ‘requiretty’ in /etc/sudoers on all managed hosts, which is why it is disabled by default.This setting will be disabled if ANSIBLE_KEEP_REMOTE_FILES is enabled.
See also ANSIBLE_PIPELINING
ANSIBLE_ANY_ERRORS_FATAL
Sets the default value for the any_errors_fatal keyword, if True, Task failures will be considered fatal errors.
See also ANY_ERRORS_FATAL
ANSIBLE_BECOME_ALLOW_SAME_USER
When False``(default), Ansible will skip using become if the remote user is the same as the become user, as this is normally a redundant operation. In other words root sudo to root.If ``True, this forces Ansible to use the become plugin anyways as there are cases in which this is needed.
See also BECOME_ALLOW_SAME_USER
ANSIBLE_BECOME_PASSWORD_FILE
The password file to use for the become plugin. --become-password-file.If executable, it will be run and the resulting stdout will be used as the password.
See also BECOME_PASSWORD_FILE
ANSIBLE_AGNOSTIC_BECOME_PROMPT
Display an agnostic become prompt instead of displaying a prompt containing the command line supplied become method.
See also AGNOSTIC_BECOME_PROMPT
ANSIBLE_CACHE_PLUGIN
Chooses which cache plugin to use, the default ‘memory’ is ephemeral.
See also CACHE_PLUGIN
ANSIBLE_CACHE_PLUGIN_CONNECTION
Defines connection or path information for the cache plugin.
See also CACHE_PLUGIN_CONNECTION
ANSIBLE_COLLECTIONS_SCAN_SYS_PATH
A boolean to enable or disable scanning the sys.path for installed collections.
See also COLLECTIONS_SCAN_SYS_PATH
ANSIBLE_COLLECTIONS_PATHS
Colon-separated paths in which Ansible will search for collections content. Collections must be in nested subdirectories, not directly in these directories. For example, if COLLECTIONS_PATHS includes '{{ ANSIBLE_HOME ~ "/collections" }}', and you want to add my.collection to that directory, it must be saved as '{{ ANSIBLE_HOME} ~ "/collections/ansible_collections/my/collection" }}'.
See also COLLECTIONS_PATHS
Deprecated in:
Deprecated detail:
does not fit var naming standard, use the singular form ANSIBLE_COLLECTIONS_PATH instead
ANSIBLE_COLLECTIONS_PATH
Colon-separated paths in which Ansible will search for collections content. Collections must be in nested subdirectories, not directly in these directories. For example, if COLLECTIONS_PATHS includes '{{ ANSIBLE_HOME ~ "/collections" }}', and you want to add my.collection to that directory, it must be saved as '{{ ANSIBLE_HOME} ~ "/collections/ansible_collections/my/collection" }}'.
See also COLLECTIONS_PATHS
Version Added:
ANSIBLE_COLLECTIONS_ON_ANSIBLE_VERSION_MISMATCH
When a collection is loaded that does not support the running Ansible version (with the collection metadata key requires_ansible).
See also COLLECTIONS_ON_ANSIBLE_VERSION_MISMATCH
ANSIBLE_COLOR_VERBOSE
Defines the color to use when emitting verbose messages. In other words, those that show with ‘-v’s.
See also COLOR_VERBOSE
ANSIBLE_CONNECTION_PASSWORD_FILE
The password file to use for the connection plugin. --connection-password-file.
See also CONNECTION_PASSWORD_FILE
_ANSIBLE_COVERAGE_REMOTE_OUTPUT
Sets the output directory on the remote host to generate coverage reports into.Currently only used for remote coverage on PowerShell modules.This is for internal use only.
See also COVERAGE_REMOTE_OUTPUT
_ANSIBLE_COVERAGE_REMOTE_PATH_FILTER
A list of paths for files on the Ansible controller to run coverage for when executing on the remote host.Only files that match the path glob will have their coverage collected.Multiple path globs can be specified and are separated by :.Currently only used for remote coverage on PowerShell modules.This is for internal use only.
See also COVERAGE_REMOTE_PATHS
ANSIBLE_ACTION_WARNINGS
By default, Ansible will issue a warning when received from a task action (module or action plugin).These warnings can be silenced by adjusting this setting to False.
See also ACTION_WARNINGS
ANSIBLE_LOCALHOST_WARNING
By default, Ansible will issue a warning when there are no hosts in the inventory.These warnings can be silenced by adjusting this setting to False.
See also LOCALHOST_WARNING
ANSIBLE_LOG_VERBOSITY
This will set log verbosity if higher than the normal display verbosity, otherwise it will match that.
See also LOG_VERBOSITY
ANSIBLE_INVENTORY_UNPARSED_WARNING
By default, Ansible will issue a warning when no inventory was loaded and notes that it will use an implicit localhost-only inventory.These warnings can be silenced by adjusting this setting to False.
See also INVENTORY_UNPARSED_WARNING
ANSIBLE_DOC_FRAGMENT_PLUGINS
Colon-separated paths in which Ansible will search for Documentation Fragments Plugins.
See also DOC_FRAGMENT_PLUGIN_PATH
ANSIBLE_ACTION_PLUGINS
Colon-separated paths in which Ansible will search for Action Plugins.
See also DEFAULT_ACTION_PLUGIN_PATH
ANSIBLE_ASK_PASS
This controls whether an Ansible playbook should prompt for a login password. If using SSH keys for authentication, you probably do not need to change this setting.
See also DEFAULT_ASK_PASS
ANSIBLE_ASK_VAULT_PASS
This controls whether an Ansible playbook should prompt for a vault password.
See also DEFAULT_ASK_VAULT_PASS
ANSIBLE_BECOME
Toggles the use of privilege escalation, allowing you to ‘become’ another user after login.
See also DEFAULT_BECOME
ANSIBLE_BECOME_EXE
executable to use for privilege escalation, otherwise Ansible will depend on PATH.




    

See also DEFAULT_BECOME_EXE
ANSIBLE_BECOME_PLUGINS
Colon-separated paths in which Ansible will search for Become Plugins.
See also BECOME_PLUGIN_PATH
ANSIBLE_BECOME_USER
The user your login/remote user ‘becomes’ when using privilege escalation, most systems will use ‘root’ when no user is specified.
See also DEFAULT_BECOME_USER
ANSIBLE_CACHE_PLUGINS
Colon-separated paths in which Ansible will search for Cache Plugins.
See also DEFAULT_CACHE_PLUGIN_PATH
ANSIBLE_CALLBACK_PLUGINS
Colon-separated paths in which Ansible will search for Callback Plugins.
See also DEFAULT_CALLBACK_PLUGIN_PATH
ANSIBLE_CALLBACKS_ENABLED
List of enabled callbacks, not all callbacks need enabling, but many of those shipped with Ansible do as we don’t want them activated by default.
See also CALLBACKS_ENABLED
Version Added:
ANSIBLE_CLICONF_PLUGINS
Colon-separated paths in which Ansible will search for Cliconf Plugins.
See also DEFAULT_CLICONF_PLUGIN_PATH
ANSIBLE_CONNECTION_PLUGINS
Colon-separated paths in which Ansible will search for Connection Plugins.
See also DEFAULT_CONNECTION_PLUGIN_PATH
ANSIBLE_DEBUG
Toggles debug output in Ansible. This is very verbose and can hinder multiprocessing. Debug output can also include secret information despite no_log settings being enabled, which means debug mode should not be used in production.
See also DEFAULT_DEBUG
ANSIBLE_EXECUTABLE
This indicates the command to use to spawn a shell under, which is required for Ansible’s execution needs on a target. Users may need to change this in rare instances when shell usage is constrained, but in most cases, it may be left as is.
See also DEFAULT_EXECUTABLE
ANSIBLE_FACT_PATH
This option allows you to globally configure a custom path for ‘local_facts’ for the implied ansible_collections.ansible.builtin.setup_module task when using fact gathering.If not set, it will fall back to the default from the ansible.builtin.setup module: /etc/ansible/facts.d.This does not affect user defined tasks that use the ansible.builtin.setup module.The real action being created by the implicit task is currently ansible.legacy.gather_facts module, which then calls the configured fact modules, by default this will be ansible.builtin.setup for POSIX systems but other platforms might have different defaults.
See also DEFAULT_FACT_PATH
ANSIBLE_FILTER_PLUGINS
Colon-separated paths in which Ansible will search for Jinja2 Filter Plugins.
See also DEFAULT_FILTER_PLUGIN_PATH
ANSIBLE_FORCE_HANDLERS
This option controls if notified handlers run on a host even if a failure occurs on that host.When false, the handlers will not run if a failure has occurred on a host.This can also be set per play or on the command line. See Handlers and Failure for more details.
See also DEFAULT_FORCE_HANDLERS
ANSIBLE_FORKS
Maximum number of forks Ansible will use to execute tasks on target hosts.
See also DEFAULT_FORKS
ANSIBLE_GATHERING
This setting controls the default policy of fact gathering (facts discovered about remote systems).This option can be useful for those wishing to save fact gathering time. Both ‘smart’ and ‘explicit’ will use the cache plugin.
See also DEFAULT_GATHERING
ANSIBLE_GATHER_SUBSET
Set the gather_subset option for the ansible_collections.ansible.builtin.setup_module task in the implicit fact gathering. See the module documentation for specifics.It does not apply to user defined ansible.builtin.setup tasks.
See also DEFAULT_GATHER_SUBSET
ANSIBLE_GATHER_TIMEOUT
Set the timeout in seconds for the implicit fact gathering, see the module documentation for specifics.It does not apply to user defined ansible_collections.ansible.builtin.setup_module tasks.
See also DEFAULT_GATHER_TIMEOUT
ANSIBLE_HASH_BEHAVIOUR
This setting controls how duplicate definitions of dictionary variables (aka hash, map, associative array) are handled in Ansible.This does not affect variables whose values are scalars (integers, strings) or arrays.**WARNING**, changing this setting is not recommended as this is fragile and makes your content (plays, roles, collections) nonportable, leading to continual confusion and misuse. Don’t change this setting unless you think you have an absolute need for it.We recommend avoiding reusing variable names and relying on the combine filter and vars and varnames lookups to create merged versions of the individual variables. In our experience, this is rarely needed and is a sign that too much complexity has been introduced into the data structures and plays.For some uses you can also look into custom vars_plugins to merge on input, even substituting the default host_group_vars that is in charge of parsing the host_vars/ and group_vars/ directories. Most users of this setting are only interested in inventory scope, but the setting itself affects all sources and makes debugging even harder.All playbooks and roles in the official examples repos assume the default for this setting.Changing the setting to merge applies across variable sources, but many sources will internally still overwrite the variables. For example include_vars will dedupe variables internally before updating Ansible, with ‘last defined’ overwriting previous definitions in same file.The Ansible project recommends you avoid ``merge`` for new projects.**It is the intention of the Ansible developers to eventually deprecate and remove this setting, but it is being kept as some users do heavily rely on it. New projects should **avoid ‘merge’.
See also DEFAULT_HASH_BEHAVIOUR
ANSIBLE_HTTPAPI_PLUGINS
Colon-separated paths in which Ansible will search for HttpApi Plugins.
See also DEFAULT_HTTPAPI_PLUGIN_PATH
ANSIBLE_INVENTORY_PLUGINS
Colon-separated paths in which Ansible will search for Inventory Plugins.
See also DEFAULT_INVENTORY_PLUGIN_PATH
ANSIBLE_JINJA2_EXTENSIONS
This is a developer-specific feature that allows enabling additional Jinja2 extensions.See the Jinja2 documentation for details. If you do not know what these do, you probably don’t need to change this setting :)
See also DEFAULT_JINJA2_EXTENSIONS
ANSIBLE_KEEP_REMOTE_FILES
Enables/disables the cleaning up of the temporary files Ansible used to execute the tasks on the remote.If this option is enabled it will disable ANSIBLE_PIPELINING.
See also DEFAULT_KEEP_REMOTE_FILES
ANSIBLE_LIBVIRT_LXC_NOSECLABEL
This setting causes libvirt to connect to LXC containers by passing --noseclabel parameter to virsh command. This is necessary when running on systems which do not have SELinux.
See also DEFAULT_LIBVIRT_LXC_NOSECLABEL
ANSIBLE_LOAD_CALLBACK_PLUGINS
Controls whether callback plugins are loaded when running /usr/bin/ansible. This may be used to log activity from the command line, send notifications, and so on. Callback plugins are always loaded for ansible-playbook.
See also DEFAULT_LOAD_CALLBACK_PLUGINS
ANSIBLE_LOG_PATH
File to which Ansible will log on the controller. When empty logging is disabled.
See also DEFAULT_LOG_PATH
ANSIBLE_LOOKUP_PLUGINS
Colon-separated paths in which Ansible will search for Lookup Plugins.
See also DEFAULT_LOOKUP_PLUGIN_PATH
ANSIBLE_MODULE_ARGS
This sets the default arguments to pass to the ansible adhoc binary if no -a is specified.
See also DEFAULT_MODULE_ARGS
ANSIBLE_MODULE_UTILS
Colon-separated paths in which Ansible will search for Module utils files, which are shared by modules.
See also DEFAULT_MODULE_UTILS_PATH
ANSIBLE_NETCONF_PLUGINS
Colon-separated paths in which Ansible will search for Netconf Plugins.
See also DEFAULT_NETCONF_PLUGIN_PATH
ANSIBLE_NO_LOG
Toggle Ansible’s display and logging of task details, mainly used to avoid security disclosures.
See also DEFAULT_NO_LOG
ANSIBLE_NO_TARGET_SYSLOG
Toggle Ansible logging to syslog on the target when it executes tasks. On Windows hosts, this will disable a newer style PowerShell modules from writing to the event log.
See also DEFAULT_NO_TARGET_SYSLOG
ANSIBLE_NULL_REPRESENTATION
What templating should return as a ‘null’ value. When not set it will let Jinja2 decide.




    

See also DEFAULT_NULL_REPRESENTATION
ANSIBLE_POLL_INTERVAL
For asynchronous tasks in Ansible (covered in Asynchronous Actions and Polling), this is how often to check back on the status of those tasks when an explicit poll interval is not supplied. The default is a reasonably moderate 15 seconds which is a tradeoff between checking in frequently and providing a quick turnaround when something may have completed.
See also DEFAULT_POLL_INTERVAL
ANSIBLE_PRIVATE_KEY_FILE
Option for connections using a certificate or key file to authenticate, rather than an agent or passwords, you can set the default value here to avoid re-specifying --private-key with every invocation.
See also DEFAULT_PRIVATE_KEY_FILE
ANSIBLE_PRIVATE_ROLE_VARS
By default, imported roles publish their variables to the play and other roles, this setting can avoid that.This was introduced as a way to reset role variables to default values if a role is used more than once in a playbook.Starting in version ‘2.17’ M(ansible.builtin.include_roles) and M(ansible.builtin.import_roles) can indivudually override this via the C(public) parameter.Included roles only make their variables public at execution, unlike imported roles which happen at playbook compile time.
See also DEFAULT_PRIVATE_ROLE_VARS
ANSIBLE_REMOTE_PORT
Port to use in remote connections, when blank it will use the connection plugin default.
See also DEFAULT_REMOTE_PORT
ANSIBLE_REMOTE_USER
Sets the login user for the target machinesWhen blank it uses the connection plugin’s default, normally the user currently executing Ansible.
See also DEFAULT_REMOTE_USER
ANSIBLE_SELINUX_SPECIAL_FS
Some filesystems do not support safe operations and/or return inconsistent errors, this setting makes Ansible ‘tolerate’ those in the list without causing fatal errors.Data corruption may occur and writes are not always verified when a filesystem is in the list.
See also DEFAULT_SELINUX_SPECIAL_FS
Version Added:
ANSIBLE_STDOUT_CALLBACK
Set the main callback used to display Ansible output. You can only have one at a time.You can have many other callbacks, but just one can be in charge of stdout.See Callback plugins for a list of available options.
See also DEFAULT_STDOUT_CALLBACK
ANSIBLE_ENABLE_TASK_DEBUGGER
Whether or not to enable the task debugger, this previously was done as a strategy plugin.Now all strategy plugins can inherit this behavior. The debugger defaults to activating whena task is failed on unreachable. Use the debugger keyword for more flexibility.
See also ENABLE_TASK_DEBUGGER
ANSIBLE_TASK_DEBUGGER_IGNORE_ERRORS
This option defines whether the task debugger will be invoked on a failed task when ignore_errors=True is specified.True specifies that the debugger will honor ignore_errors, and False will not honor ignore_errors.
See also TASK_DEBUGGER_IGNORE_ERRORS
ANSIBLE_STRATEGY_PLUGINS
Colon-separated paths in which Ansible will search for Strategy Plugins.
See also DEFAULT_STRATEGY_PLUGIN_PATH
ANSIBLE_TERMINAL_PLUGINS
Colon-separated paths in which Ansible will search for Terminal Plugins.
See also DEFAULT_TERMINAL_PLUGIN_PATH
ANSIBLE_TEST_PLUGINS
Colon-separated paths in which Ansible will search for Jinja2 Test Plugins.
See also DEFAULT_TEST_PLUGIN_PATH
ANSIBLE_TRANSPORT
Can be any connection plugin available to your ansible installation.There is also a (DEPRECATED) special ‘smart’ option, that will toggle between ‘ssh’ and ‘paramiko’ depending on controller OS and ssh versions.
See also DEFAULT_TRANSPORT
ANSIBLE_ERROR_ON_UNDEFINED_VARS
When True, this causes ansible templating to fail steps that reference variable names that are likely typoed.Otherwise, any ‘{{ template_expression }}’ that contains undefined variables will be rendered in a template or ansible action line exactly as written.
See also DEFAULT_UNDEFINED_VAR_BEHAVIOR
ANSIBLE_VARS_PLUGINS
Colon-separated paths in which Ansible will search for Vars Plugins.
See also DEFAULT_VARS_PLUGIN_PATH
ANSIBLE_VAULT_ID_MATCH
If true, decrypting vaults with a vault id will only try the password from the matching vault-id.
See also DEFAULT_VAULT_ID_MATCH
ANSIBLE_VAULT_IDENTITY
The label to use for the default vault id label in cases where a vault id label is not provided.
See also DEFAULT_VAULT_IDENTITY
ANSIBLE_VAULT_ENCRYPT_SALT
The salt to use for the vault encryption. If it is not provided, a random salt will be used.
See also VAULT_ENCRYPT_SALT
ANSIBLE_VAULT_ENCRYPT_IDENTITY
The vault_id to use for encrypting by default. If multiple vault_ids are provided, this specifies which to use for encryption. The --encrypt-vault-id CLI option overrides the configured value.
See also DEFAULT_VAULT_ENCRYPT_IDENTITY
ANSIBLE_VAULT_IDENTITY_LIST
A list of vault-ids to use by default. Equivalent to multiple --vault-id args. Vault-ids are tried in order.
See also DEFAULT_VAULT_IDENTITY_LIST
ANSIBLE_VAULT_PASSWORD_FILE
The vault password file to use. Equivalent to --vault-password-file or --vault-id.If executable, it will be run and the resulting stdout will be used as the password.
See also DEFAULT_VAULT_PASSWORD_FILE
ANSIBLE_VERBOSITY
Sets the default verbosity, equivalent to the number of -v passed in the command line.
See also DEFAULT_VERBOSITY
ANSIBLE_DIFF_ALWAYS
Configuration toggle to tell modules to show differences when in ‘changed’ status, equivalent to --diff.
See also DIFF_ALWAYS
ANSIBLE_DIFF_CONTEXT
Number of lines of context to show when displaying the differences between files.
See also DIFF_CONTEXT
ANSIBLE_DISPLAY_ARGS_TO_STDOUT
Normally ansible-playbook will print a header for each task that is run. These headers will contain the name: field from the task if you specified one. If you didn’t then ansible-playbook uses the task’s action to help you tell which task is presently running. Sometimes you run many of the same action and so you want more information about the task to differentiate it from others of the same action. If you set this variable to True in the config then ansible-playbook will also include the task’s arguments in the header.This setting defaults to False because there is a chance that you have sensitive values in your parameters and you do not want those to be printed.If you set this to True you should be sure that you have secured your environment’s stdout (no one can shoulder surf your screen and you aren’t saving stdout to an insecure file) or made sure that all of your playbooks explicitly added the no_log: True parameter to tasks that have sensitive values How do I keep secret data in my playbook? for more information.
See also DISPLAY_ARGS_TO_STDOUT
ANSIBLE_DISPLAY_SKIPPED_HOSTS
Toggle to control displaying skipped task/host entries in a task in the default callback.
See also DISPLAY_SKIPPED_HOSTS
ANSIBLE_DUPLICATE_YAML_DICT_KEY
By default, Ansible will issue a warning when a duplicate dict key is encountered in YAML.These warnings can be silenced by adjusting this setting to False.
See also DUPLICATE_YAML_DICT_KEY
ANSIBLE_ERROR_ON_MISSING_HANDLER
Toggle to allow missing handlers to become a warning instead of an error when notifying.
See also ERROR_ON_MISSING_HANDLER
ANSIBLE_FACTS_MODULES
Which modules to run during a play’s fact gathering stage, using the default of ‘smart’ will try to figure it out based on connection type.If adding your own modules but you still want to use the default Ansible facts, you will want to include ‘setup’ or corresponding network module to the list (if you add ‘smart’, Ansible will also figure it out).This does not affect explicit calls to the ‘setup’ module, but does always affect the ‘gather_facts’ action (implicit or explicit).
See also FACTS_MODULES
ANSIBLE_GALAXY_IGNORE
If set to yes, ansible-galaxy will not validate TLS certificates. This can be useful for testing against a server with a self-signed certificate.
See also GALAXY_IGNORE_CERTS
ANSIBLE_GALAXY_SERVER_TIMEOUT
The default timeout for Galaxy API calls. Galaxy servers that don’t configure a specific timeout will fall back to this value.
See also GALAXY_SERVER_TIMEOUT
ANSIBLE_GALAXY_ROLE_SKELETON
Role skeleton directory to use as a template for the init action in ansible-galaxy/ansible-galaxy role, same as --role-skeleton.
See also GALAXY_ROLE_SKELETON




    

ANSIBLE_GALAXY_ROLE_SKELETON_IGNORE
patterns of files to ignore inside a Galaxy role or collection skeleton directory.
See also GALAXY_ROLE_SKELETON_IGNORE
ANSIBLE_GALAXY_COLLECTION_SKELETON
Collection skeleton directory to use as a template for the init action in ansible-galaxy collection, same as --collection-skeleton.
See also GALAXY_COLLECTION_SKELETON
ANSIBLE_GALAXY_COLLECTION_SKELETON_IGNORE
patterns of files to ignore inside a Galaxy collection skeleton directory.
See also GALAXY_COLLECTION_SKELETON_IGNORE
ANSIBLE_GALAXY_COLLECTIONS_PATH_WARNING
whether ansible-galaxy collection install should warn about --collections-path missing from configured COLLECTIONS_PATHS.
See also GALAXY_COLLECTIONS_PATH_WARNING
ANSIBLE_GALAXY_SERVER
URL to prepend when roles don’t specify the full URI, assume they are referencing this server as the source.
See also GALAXY_SERVER
ANSIBLE_GALAXY_SERVER_LIST
A list of Galaxy servers to use when installing a collection.The value corresponds to the config ini header [galaxy_server.{{item}}] which defines the server details.See Configuring the ansible-galaxy client for more details on how to define a Galaxy server.The order of servers in this list is used as the order in which a collection is resolved.Setting this config option will ignore the GALAXY_SERVER config option.
See also GALAXY_SERVER_LIST
ANSIBLE_GALAXY_DISPLAY_PROGRESS
Some steps in ansible-galaxy display a progress wheel which can cause issues on certain displays or when outputting the stdout to a file.This config option controls whether the display wheel is shown or not.The default is to show the display wheel if stdout has a tty.
See also GALAXY_DISPLAY_PROGRESS
ANSIBLE_GALAXY_CACHE_DIR
The directory that stores cached responses from a Galaxy server.This is only used by the ansible-galaxy collection install and download commands.Cache files inside this dir will be ignored if they are world writable.
See also GALAXY_CACHE_DIR
ANSIBLE_GALAXY_DISABLE_GPG_VERIFY
Disable GPG signature verification during collection installation.
See also GALAXY_DISABLE_GPG_VERIFY
ANSIBLE_GALAXY_GPG_KEYRING
Configure the keyring used for GPG signature verification during collection installation and verification.
See also GALAXY_GPG_KEYRING
ANSIBLE_GALAXY_IGNORE_SIGNATURE_STATUS_CODES
A list of GPG status codes to ignore during GPG signature verification. See L(https://github.com/gpg/gnupg/blob/master/doc/DETAILS#general-status-codes) for status code descriptions.If fewer signatures successfully verify the collection than GALAXY_REQUIRED_VALID_SIGNATURE_COUNT, signature verification will fail even if all error codes are ignored.
See also GALAXY_IGNORE_INVALID_SIGNATURE_STATUS_CODES
ANSIBLE_GALAXY_REQUIRED_VALID_SIGNATURE_COUNT
The number of signatures that must be successful during GPG signature verification while installing or verifying collections.This should be a positive integer or all to indicate all signatures must successfully validate the collection.Prepend + to the value to fail if no valid signatures are found for the collection.
See also GALAXY_REQUIRED_VALID_SIGNATURE_COUNT
ANSIBLE_HOST_KEY_CHECKING
Set this to “False” if you want to avoid host key checking by the underlying connection plugin Ansible uses to connect to the host.Please read the documentation of the specific connection plugin used for details.
See also HOST_KEY_CHECKING
ANSIBLE_HOST_PATTERN_MISMATCH
This setting changes the behaviour of mismatched host patterns, it allows you to force a fatal error, a warning or just ignore it.
See also HOST_PATTERN_MISMATCH
ANSIBLE_PYTHON_INTERPRETER
Path to the Python interpreter to be used for module execution on remote targets, or an automatic discovery mode. Supported discovery modes are auto (the default), auto_silent, auto_legacy, and auto_legacy_silent. All discovery modes employ a lookup table to use the included system Python (on distributions known to include one), falling back to a fixed ordered list of well-known Python interpreter locations if a platform-specific default is not available. The fallback behavior will issue a warning that the interpreter should be set explicitly (since interpreters installed later may change which one is used). This warning behavior can be disabled by setting auto_silent or auto_legacy_silent. The value of auto_legacy provides all the same behavior, but for backward-compatibility with older Ansible releases that always defaulted to /usr/bin/python, will use that interpreter if present.
See also INTERPRETER_PYTHON
ANSIBLE_TRANSFORM_INVALID_GROUP_CHARS
Make ansible transform invalid characters in group names supplied by inventory sources.
See also TRANSFORM_INVALID_GROUP_CHARS
ANSIBLE_INVALID_TASK_ATTRIBUTE_FAILED
If ‘false’, invalid attributes for a task will result in warnings instead of errors.
See also INVALID_TASK_ATTRIBUTE_FAILED
ANSIBLE_INVENTORY_ANY_UNPARSED_IS_FAILED
If ‘true’, it is a fatal error when any given inventory source cannot be successfully parsed by any available inventory plugin; otherwise, this situation only attracts a warning.
See also INVENTORY_ANY_UNPARSED_IS_FAILED
ANSIBLE_INVENTORY_CACHE
Toggle to turn on inventory caching.This setting has been moved to the individual inventory plugins as a plugin option Inventory plugins.The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory configuration.This message will be removed in 2.16.
See also INVENTORY_CACHE_ENABLED
ANSIBLE_INVENTORY_CACHE_PLUGIN
The plugin for caching inventory.This setting has been moved to the individual inventory plugins as a plugin option Inventory plugins.The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration.This message will be removed in 2.16.
See also INVENTORY_CACHE_PLUGIN
ANSIBLE_INVENTORY_CACHE_CONNECTION
The inventory cache connection.This setting has been moved to the individual inventory plugins as a plugin option Inventory plugins.The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration.This message will be removed in 2.16.
See also INVENTORY_CACHE_PLUGIN_CONNECTION
ANSIBLE_INVENTORY_CACHE_PLUGIN_PREFIX
The table prefix for the cache plugin.This setting has been moved to the individual inventory plugins as a plugin option Inventory plugins.The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration.This message will be removed in 2.16.
See also INVENTORY_CACHE_PLUGIN_PREFIX
ANSIBLE_INVENTORY_CACHE_TIMEOUT
Expiration timeout for the inventory cache plugin data.This setting has been moved to the individual inventory plugins as a plugin option Inventory plugins.The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration.This message will be removed in 2.16.
See also INVENTORY_CACHE_TIMEOUT
ANSIBLE_INVENTORY_ENABLED
List of enabled inventory plugins, it also determines the order in which they are used.
See also INVENTORY_ENABLED
ANSIBLE_INVENTORY_EXPORT
Controls if ansible-inventory will accurately reflect Ansible’s view into inventory or its optimized for exporting.
See also INVENTORY_EXPORT
ANSIBLE_INVENTORY_IGNORE
List of extensions to ignore when using a directory as an inventory source.
See also INVENTORY_IGNORE_EXTS
ANSIBLE_INVENTORY_IGNORE_REGEX
List of patterns to ignore when using a directory as an inventory source.
See also INVENTORY_IGNORE_PATTERNS
ANSIBLE_INVENTORY_UNPARSED_FAILED
If ‘true’ it is a fatal error if every single potential inventory source fails to parse, otherwise, this situation will only attract a warning.
See also INVENTORY_UNPARSED_IS_FAILED
ANSIBLE_INJECT_FACT_VARS
Facts are available inside the ansible_facts variable, this setting also pushes them as their own vars in the main namespace.Unlike inside the ansible_facts dictionary, these will have an ansible_ prefix.
See also INJECT_FACTS_AS_VARS
ANSIBLE_MODULE_IGNORE_EXTS
List of extensions to ignore when looking for modules to load.This is for rejecting script and binary module fallback extensions.
See also MODULE_IGNORE_EXTS
ANSIBLE_MODULE_STRICT_UTF8_RESPONSE
Enables whether module responses are evaluated for containing non-UTF-8 data.Disabling this may result in unexpected behavior.Only ansible-core should evaluate this configuration.
See also MODULE_STRICT_UTF8_RESPONSE
ANSIBLE_OLD_PLUGIN_CACHE_CLEAR
Previously Ansible would only clear some of the plugin loading caches when loading new roles, this led to some behaviors in which a plugin loaded in previous plays would be unexpectedly ‘sticky’. This setting allows the user to return to that behavior.
See also OLD_PLUGIN_CACHE_CLEARING
ANSIBLE_PERSISTENT_CONTROL_PATH_DIR
Path to the socket to be used by the connection persistence system.
See also PERSISTENT_CONTROL_PATH_DIR
ANSIBLE_PERSISTENT_CONNECT_TIMEOUT
This controls how long the persistent connection will remain idle before it is destroyed.
See also PERSISTENT_CONNECT_TIMEOUT
ANSIBLE_PERSISTENT_CONNECT_RETRY_TIMEOUT
This controls the retry timeout for persistent connection to connect to the local domain socket.
See also PERSISTENT_CONNECT_RETRY_TIMEOUT
ANSIBLE_PERSISTENT_COMMAND_TIMEOUT
This controls the amount of time to wait for a response from a remote device before timing out a persistent connection.
See also PERSISTENT_COMMAND_TIMEOUT
ANSIBLE_PLAYBOOK_DIR
A number of non-playbook CLIs have a --playbook-dir argument; this sets the default value for it.
See also PLAYBOOK_DIR
ANSIBLE_PLAYBOOK_VARS_ROOT
This sets which playbook dirs will be used as a root to process vars plugins, which includes finding host_vars/group_vars.
See also PLAYBOOK_VARS_ROOT
ANSIBLE_PYTHON_MODULE_RLIMIT_NOFILE
Attempts to set RLIMIT_NOFILE soft limit to the specified value when executing Python modules (can speed up subprocess usage on Python 2.x. See https://bugs.python.org/issue11284). The value will be limited by the existing hard limit. Default value of 0 does not attempt to adjust existing system-defined limits.
See also PYTHON_MODULE_RLIMIT_NOFILE
ANSIBLE_RETRY_FILES_ENABLED
This controls whether a failed Ansible playbook should create a .retry file.
See also RETRY_FILES_ENABLED
ANSIBLE_RETRY_FILES_SAVE_PATH
This sets the path in which Ansible will save .retry files when a playbook fails and retry files are enabled.This file will be overwritten after each run with the list of failed hosts from all plays.
See also RETRY_FILES_SAVE_PATH
ANSIBLE_RUN_VARS_PLUGINS
This setting can be used to optimize vars_plugin usage depending on the user’s inventory size and play selection.
See also RUN_VARS_PLUGINS
ANSIBLE_SHOW_CUSTOM_STATS
This adds the custom stats set via the set_stats plugin to the default output.
See also SHOW_CUSTOM_STATS
ANSIBLE_STRING_TYPE_FILTERS
This list of filters avoids ‘type conversion’ when templating variables.Useful when you want to avoid conversion into lists or dictionaries for JSON strings, for example.
See also STRING_TYPE_FILTERS
ANSIBLE_SYSTEM_WARNINGS
Allows disabling of warnings related to potential issues on the system running Ansible itself (not on the managed hosts).These may include warnings about third-party packages or other conditions that should be resolved if possible.
See also SYSTEM_WARNINGS
ANSIBLE_SKIP_TAGS
default list of tags to skip in your plays, has precedence over Run Tags
See also TAGS_SKIP
ANSIBLE_TASK_TIMEOUT
Set the maximum time (in seconds) that a task can run for.If set to 0 (the default) there is no timeout.
See also TASK_TIMEOUT
ANSIBLE_WORKER_SHUTDOWN_POLL_COUNT
The maximum number of times to check Task Queue Manager worker processes to verify they have exited cleanly.After this limit is reached any worker processes still running will be terminated.This is for internal use only.
See also WORKER_SHUTDOWN_POLL_COUNT
ANSIBLE_WORKER_SHUTDOWN_POLL_DELAY
The number of seconds to sleep between polling loops when checking Task Queue Manager worker processes to verify they have exited cleanly.This is for internal use only.
See also WORKER_SHUTDOWN_POLL_DELAY
ANSIBLE_WIN_ASYNC_STARTUP_TIMEOUT
For asynchronous tasks in Ansible (covered in Asynchronous Actions and Polling), this is how long, in seconds, to wait for the task spawned by Ansible to connect back to the named pipe used on Windows systems. The default is 5 seconds. This can be too low on slower systems, or systems under heavy load.This is not the total time an async command can run for, but is a separate timeout to wait for an async command to start. The task will only start to be timed against its async_timeout once it has connected to the pipe, so the overall maximum duration the task can take will be extended by the amount specified here.
See also WIN_ASYNC_STARTUP_TIMEOUT
ANSIBLE_YAML_FILENAME_EXT
Check all of these extensions when looking for ‘variable’ files which should be YAML or JSON or vaulted versions of these.This affects vars_files, include_vars, inventory and vars plugins among others.
See also YAML_FILENAME_EXTENSIONS
ANSIBLE_NETCONF_SSH_CONFIG
This variable is used to enable bastion/jump host with netconf connection. If set to True the bastion/jump host ssh settings should be present in ~/.ssh/config file, alternatively it can be set to custom ssh configuration file path to read the bastion/jump host settings.
See also NETCONF_SSH_CONFIG
ANSIBLE_STRING_CONVERSION_ACTION
Action to take when a module parameter value is converted to a string (this does not affect variables). For string parameters, values such as ‘1.00’, “[‘a’, ‘b’,]”, and ‘yes’, ‘y’, etc. will be converted by the YAML parser unless fully quoted.Valid options are ‘error’, ‘warn’, and ‘ignore’.Since 2.8, this option defaults to ‘warn’ but will change to ‘error’ in 2.12.
See also STRING_CONVERSION_ACTION
ANSIBLE_VALIDATE_ACTION_GROUP_METADATA
A toggle to disable validating a collection’s ‘metadata’ entry for a module_defaults action group. Metadata containing unexpected fields or value types will produce a warning when this is True.
See also VALIDATE_ACTION_GROUP_METADATA