ansible-playbook archlinux update
It will by default install yay on your system by using makepkg toghether with an aurman user which will be used to upgrade the systems.
you'll have to create a vault file which contains your passwords per host as described in the hosts inventory file.
$ ansible-vault create vault New Vault password: Confirm New Vault password: [WARNING]: does not exist, creating... su_password_localhost: THE-SUDO-PASSWORD
$ ansible-playbook -i hosts --diff update.yml --vault-password-file=.vault_pass