Vars Files vs Extra Vars: Which Minimizes Accidental Public Exposure?

Goal

Prevent secrets from being unintentionally exposed or overridden during Ansible playbook execution, especially in CI/CD pipelines.

Constraints

Variable precedence places --extra-vars at the top, meaning any value supplied via the command line will override all other sources. In contrast, vars_files are loaded after role defaults but before play-level vars, providing a more controlled override path. Both methods can be used to supply sensitive data, but their visibility and auditability differ.

Uncertainty

It is unclear whether relying on vars_files (with encrypted vault files) consistently reduces the risk of accidental public exposure compared to using --extra-vars, which may be logged or exposed in CI logs. The trade‑off between ease of use, audit trail, and secret leakage remains unresolved.

Questions

• Does using vars_files with Ansible Vault provide a measurable reduction in accidental public exposure compared to --extra-vars in typical CI pipelines?
• How does the variable precedence order affect the auditability of secret sources when both vars_files and --extra-vars are present?
• What best practices exist to ensure that --extra-vars values are not inadvertently logged or displayed during playbook runs?