Ansible vars_prompt — Interactive Playbook Input

Introduction

vars_prompt asks for variable values interactively when a playbook starts. Use it for deployment versions, environment selection, password entry, and confirmation prompts — situations where you want human input before automation runs. Unlike --extra-vars, prompts appear at runtime with custom messages and optional input hiding.

Basic Usage

---
- name: Interactive deployment
  hosts: webservers
  vars_prompt:
    - name: app_version
      prompt: "Enter version to deploy"
      private: false

  tasks:
    - name: Deploy version
      ansible.builtin.debug:
        msg: "Deploying v{{ app_version }}"

Multiple Prompts

  vars_prompt:
    - name: app_version
      prompt: "Version to deploy (e.g., 2.5.1)"
      private: false

    - name: target_env
      prompt: "Target environment (dev/staging/production)"
      private: false
      default: "staging"

    - name: confirm
      prompt: "Deploy v{{ app_version }} to {{ target_env }}? (yes/no)"
      private: false

Password Input

  vars_prompt:
    - name: db_password
      prompt: "Enter database admin password"
      private: true          # Input is hidden (no echo)
      confirm: true          # Ask twice to confirm match

    - name: sudo_password
      prompt: "Enter sudo password"
      private: true
      encrypt: sha512_crypt  # Hash the input
      salt_size: 16

Default Values

  vars_prompt:
    - name: workers
      prompt: "Number of workers"
      default: "4"           # Used if user presses Enter
      private: false

    - name: branch
      prompt: "Git branch"
      default: "main"
      private: false

    - name: port
      prompt: "Application port"
      default: "8080"
      private: false

Encryption Options

  vars_prompt:
    - name: user_password
      prompt: "New user password"
      private: true
      encrypt: sha512_crypt    # SHA-512 hash
      confirm: true
      salt_size: 16

  tasks:
    - name: Create user with hashed password
      ansible.builtin.user:
        name: deploy
        password: "{{ user_password }}"
        state: present

Available encrypt values:

sha512_crypt — SHA-512 (recommended)
sha256_crypt — SHA-256
md5_crypt — MD5 (legacy, avoid)
bcrypt — bcrypt (requires passlib)

Practical Examples

Deployment Workflow

- name: Production deployment
  hosts: production
  vars_prompt:
    - name: version
      prompt: "Release version"
      private: false

    - name: deployer
      prompt: "Your name (for audit log)"
      private: false

    - name: confirm_prod
      prompt: "⚠️  This is PRODUCTION. Type 'DEPLOY' to confirm"
      private: false

  tasks:
    - name: Abort if not confirmed
      ansible.builtin.fail:
        msg: "Deployment cancelled — confirmation not received"
      when: confirm_prod != 'DEPLOY'

    - name: Log deployment
      ansible.builtin.lineinfile:
        path: /var/log/deployments.log
        line: "{{ ansible_date_time.iso8601 }} {{ deployer }} deployed v{{ version }}"
      delegate_to: localhost

    - name: Deploy
      ansible.builtin.command:
        cmd: "/opt/deploy.sh {{ version }}"

Environment Selection

- name: Multi-environment playbook
  hosts: "{{ target_hosts }}"
  vars_prompt:
    - name: environment
      prompt: |
        Select environment:
          1) dev
          2) staging
          3) production
        Choice
      private: false
      default: "1"

  vars:
    env_map:
      "1": { name: dev, hosts: dev_servers }
      "2": { name: staging, hosts: staging_servers }
      "3": { name: production, hosts: prod_servers }
    target_hosts: "{{ env_map[environment].hosts }}"
    env_name: "{{ env_map[environment].name }}"

  tasks:
    - name: Show environment
      ansible.builtin.debug:
        msg: "Configuring {{ env_name }} environment"

User Account Setup

- name: Create user accounts
  hosts: all
  vars_prompt:
    - name: new_username
      prompt: "Username to create"
      private: false

    - name: new_password
      prompt: "Password for new user"
      private: true
      confirm: true
      encrypt: sha512_crypt
      salt_size: 16

    - name: ssh_key
      prompt: "SSH public key (paste full key, or press Enter to skip)"
      private: false
      default: ""

  tasks:
    - name: Create user
      ansible.builtin.user:
        name: "{{ new_username }}"
        password: "{{ new_password }}"
        shell: /bin/bash
        state: present

    - name: Add SSH key
      ansible.builtin.authorized_key:
        user: "{{ new_username }}"
        key: "{{ ssh_key }}"
      when: ssh_key | length > 0

Override with extra-vars

# Skip prompts by providing values on command line
ansible-playbook deploy.yml -e "app_version=2.5.1 target_env=staging confirm=yes"

# In CI/CD, always override — prompts hang in non-interactive mode
ansible-playbook deploy.yml \
  -e "app_version=${VERSION}" \
  -e "target_env=production" \
  -e "confirm=DEPLOY"

vars_prompt vs pause vs extra-vars

Feature	`vars_prompt`	`pause`	`--extra-vars`
When asked	Before play starts	During task execution	Command line
Hidden input	✅ `private: true`	✅ `echo: false`	❌ Visible in process list
Default value	✅	❌	✅
Encryption	✅ Built-in	❌	❌
Confirm input	✅ `confirm: true`	❌	❌
CI/CD friendly	Override with `-e`	❌ Hangs	✅ Native

Troubleshooting

Issue	Solution
Prompt hangs in CI/CD	Override all prompts with `-e`
Can't see what I'm typing	`private: true` is set — change to `false` for non-sensitive input
Password doesn't match	`confirm: true` requires typing twice — match exactly
Encrypted password doesn't work	Ensure target system supports the hash algorithm
Default not used	Press Enter without typing; don't type spaces

Best Practices

Default values for common choices — reduce typing for standard cases
private: true for secrets — always hide password input
confirm: true for passwords — prevent typos in critical values
Override in CI/CD — use -e to skip prompts in automation
Validate input in tasks — fail module to check format/value
Keep prompts minimal — 2-4 prompts max; too many slows users down

Conclusion

vars_prompt adds a human gate at playbook start — perfect for deployment versions, environment selection, and password entry. Combined with encrypt for automatic password hashing and confirm for double-entry verification, it handles the most common interactive scenarios. For CI/CD, always provide -e overrides to skip prompts and run non-interactively.