Ansible playbooks can use encrypted files and variables to keep track of secrets. This is achieved through Ansible vault and requires a vault password to be provided. The Ansible plugin should support storing the vault password in the Jenkins credential store.

https://docs.ansible.com/ansible/2.4/vault.html