# ansible-plabook keeps saying ansible-vault variables are undefined!!

**URL:** <https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284>\
**Category:** Get Help\
**Tags:** macosx, ansible-vault, playbook\
**Created:** [August 13, 2025, 4:17am UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284 "2025-08-13T04:17:31Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gittes](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@Gittes](https://forum.ansible.com/u/Gittes)\
**Post date:** [August 13, 2025, 4:17am UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/1 "2025-08-13T04:17:31Z")

</div>

Hello everyone!

I’m working on a project for a company I am working for.

Whenever I use ansible-playbook with three variable files, two files are encrypted with ansible-vault and each file has one variable. The variables for each file are the\_vault\_test, the\_vault\_test2 and the\_test.

Here is the file/directory structure and the output of ansible-playbook:

CAPSULE-V-001-MM037:test chris$ tree  
.  
├── 003\_vault\_secrets\_test.enc  
├── ansible.cfg  
├── group\_vars  
│ └── all  
│ ├── 002\_vault\_secrets\_test.enc  
│ ├── 003\_vault\_secrets\_test.enc  
│ └── vars.yml  
├── inventory  
└── test\_vault.yml

3 directories, 7 files

CAPSULE-V-001-MM037:test chris$ ansible-playbook --inventory inventory --private-key ~/.ssh/staging\_ansible\_id\_ed25519 --user staging\_ansible test\_vault.yml --vault-password ~/.secrets/ansible\_vault\_password.txt --extra-vars group\_vars/all/002\_vault\_secrets\_test.enc --extra-vars 003\_vault\_secrets\_test.enc

PLAY [My First Play] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [capsule-v-001-mm037]  
ok: [capsule-v-001-mm038]

TASK [debug vault\_the\_test] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [capsule-v-001-mm037] =\> {  
“vault\_the\_test”: “VARIABLE IS NOT DEFINED!”  
}  
ok: [capsule-v-001-mm038] =\> {  
“vault\_the\_test”: “VARIABLE IS NOT DEFINED!”  
}

TASK [debug vault\_the\_test] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [capsule-v-001-mm037] =\> {  
“vault\_the\_test2”: “VARIABLE IS NOT DEFINED!”  
}  
ok: [capsule-v-001-mm038] =\> {  
“vault\_the\_test2”: “VARIABLE IS NOT DEFINED!”  
}

TASK [debug the\_test] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [capsule-v-001-mm037] =\> {  
“the\_test”: “Will this work?”  
}  
ok: [capsule-v-001-mm038] =\> {  
“the\_test”: “Will this work?”  
}

PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
capsule-v-001-mm037 : ok=4 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0  
capsule-v-001-mm038 : ok=4 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

CAPSULE-V-001-MM037:test chris$ ansible-playbook --version  
ansible-playbook [core 2.18.7]  
config file = /Users/chris/Projects/checkouts/test/ansible.cfg  
configured module search path = [‘/Users/chris/.ansible/plugins/modules’, ‘/usr/share/ansible/plugins/modules’]  
ansible python module location = /opt/homebrew/Cellar/ansible/11.8.0/libexec/lib/python3.13/site-packages/ansible  
ansible collection location = /Users/chris/.ansible/collections:/usr/share/ansible/collections  
executable location = /opt/homebrew/bin/ansible-playbook  
python version = 3.13.6 (main, Aug 6 2025, 13:05:20) [Clang 17.0.0 (clang-1700.0.13.3)] (/opt/homebrew/Cellar/ansible/11.8.0/libexec/bin/python)  
jinja version = 3.1.6  
libyaml = True  
CAPSULE-V-001-MM037:test chris$ uname  
Darwin  
CAPSULE-V-001-MM037:test chris$ uname -a  
Darwin CAPSULE-V-001-MM037.local 24.4.0 Darwin Kernel Version 24.4.0: Wed Mar 19 21:11:02 PDT 2025; root:xnu-11417.101.15~1/RELEASE\_ARM64\_T8132 arm64  
CAPSULE-V-001-MM037:test chris$ sw  
sw\_vers swcutil swift swift-inspect swiftc  
CAPSULE-V-001-MM037:test chris$ sw\_vers  
ProductName: macOS  
ProductVersion: 15.4  
BuildVersion: 24E248  
CAPSULE-V-001-MM037:test chris$ brew --version  
Homebrew \>=4.3.0 (shallow or no git repository)

It use to work and now it doesn’t! I made a simple test outside of git! I even asked a friend that works at Red Hat and works with Ansible everyday!

Please help!

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [August 13, 2025, 4:32am UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/2 "2025-08-13T04:32:53Z")

</div>

Maybe the problem is the `.enc` file extension? I think the default vars plugin only looks for `.yml`/`.yaml`/`.json` files, so it will ignore `.enc` files.

---

<div class="post-metadata">

**Author:** ![Gittes](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@Gittes](https://forum.ansible.com/u/Gittes)\
**Post date:** [August 13, 2025, 7:19am UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/3 "2025-08-13T07:19:33Z")

</div>

I did that! I did .yml and no file extension and it would give an error about encryption!

It’s not file extensions that is the issue.

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [August 13, 2025, 3:19pm UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/4 "2025-08-13T15:19:09Z")

</div>

The extensions are also configurable, so 2 ways to fix this [valid\_extensions](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/host_group_vars_vars.html#parameter-_valid_extensions)

---

<div class="post-metadata">

**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\
**Post date:** [August 13, 2025, 3:20pm UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/5 "2025-08-13T15:20:14Z")

</div>

There are a couple of things going on here. You said

> [@Gittes](#):
>
> The variables for each file are the\_vault\_test, the\_vault\_test2 and the\_test.

But the job log you posted says the variables `vault_the_test` and `vault_the_test2` are not defined. That’s true: `‘vault_the_test' != 'the_vault_test'`.

I set up files with the same names and same contents (as a best guess, since you didn’t show their exact contents), but _without any vaulting_. I wanted to see whether the issue has anything to do with vaulting or if it’s just “plain ol’ Ansible” issues. It’s the latter.

After I changed the variable names in my `ansible.builtin.debug` tasks to match those in the files, I got the same results you did.

Then I changed the extension on `group_vars/all/003_vault_secrets_test.enc` to `.yml` and re-ran the playbook. That change made the variable in that file work in the playbook.

Finally, when you use `--extra-vars` to specify a file, you must prefix the file path/name with a `@`. So in my case, that becomes:

```auto
ansible-playbook ./test_vault.yml -v --inventory ./inventory --extra-vars @group_vars/all/002_vault_secrets_test.enc --extra-vars @003_vault_secrets_test.enc

```

Only then do all the variables become defined from the playbook’s perspective.

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [August 13, 2025, 3:22pm UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/6 "2025-08-13T15:22:06Z")

</div>

Don’t use the same file as a group\_var/host\_var in extra vars or other methods, you are creating the variable x2 and masking it with itself and changing the precedence.

---

<div class="post-metadata">

**Author:** ![Gittes](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@Gittes](https://forum.ansible.com/u/Gittes)\
**Post date:** [August 13, 2025, 9:04pm UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/7 "2025-08-13T21:04:39Z")

</div>

I downgraded to Ansible version:

ansible [core 2.17.12]

Also, I wanted ahead and renamed the vault var files to be .vault and I used in ansible.cfg:

yaml\_valid\_extensions = .yml, .yaml, .json

I even added the same variable the\_vault\_test in vars.yml and it did override with a different value but it’s still not working with the vault files. It still says:

> CAPSULE-V-001-MM037:test chris$ ansible-playbook --inventory inventory test\_vault.yml --private-key ~/.ssh/staging\_ansible\_id\_ed25519 --user staging\_ansible --vault-password-file ~/.secrets/ansible\_vault\_password.txt
> 
> PLAY [My First Play] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
> 
> TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
> ok: [capsule-v-001-mm037]  
> ok: [capsule-v-001-mm038]
> 
> TASK [debug vault\_the\_test] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
> ok: [capsule-v-001-mm037] =\> {  
> “vault\_the\_test”: “Will this work form an non-vault file?”  
> }  
> ok: [capsule-v-001-mm038] =\> {  
> “vault\_the\_test”: “Will this work form an non-vault file?”  
> }
> 
> TASK [debug vault\_the\_test] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
> ok: [capsule-v-001-mm037] =\> {  
> “vault\_the\_test2”: “VARIABLE IS NOT DEFINED!”  
> }  
> ok: [capsule-v-001-mm038] =\> {  
> “vault\_the\_test2”: “VARIABLE IS NOT DEFINED!”  
> }
> 
> TASK [debug the\_test] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
> ok: [capsule-v-001-mm037] =\> {  
> “the\_test”: “Will this work?”  
> }  
> ok: [capsule-v-001-mm038] =\> {  
> “the\_test”: “Will this work?”  
> }
> 
> PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
> capsule-v-001-mm037 : ok=4 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0  
> capsule-v-001-mm038 : ok=4 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

I don’t think it’s the file extensions!

---

<div class="post-metadata">

**Author:** ![Gittes](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@Gittes](https://forum.ansible.com/u/Gittes)\
**Post date:** [August 13, 2025, 9:13pm UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/8 "2025-08-13T21:13:44Z")

</div>

Finally, ansible-config showed the file extensions were already defined by the default install:

```auto
CAPSULE-V-001-MM037:test chris$ ansible-config dump | grep -i json
STRING_TYPE_FILTERS(default) = ['string', 'to_json', 'to_nice_json', 'to_yaml', 'to_nice_yaml', 'ppretty', 'json']
YAML_FILENAME_EXTENSIONS(default) = ['.yml', '.yaml', '.json']

```

---

<div class="post-metadata">

**Author:** ![Gittes](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@Gittes](https://forum.ansible.com/u/Gittes)\
**Post date:** [August 13, 2025, 9:34pm UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/9 "2025-08-13T21:34:15Z")

</div>

By the way I just upgraded ansible and same results:

`CAPSULE-V-001-MM037:test chris$ ansible-playbook --version`  
`ansible-playbook [core 2.18.8]`  
`config file = /Users/chris/Projects/checkouts/test/ansible.cfg`  
`configured module search path = [‘/Users/chris/.ansible/plugins/modules’, ‘/usr/share/ansible/plugins/modules’]`  
`ansible python module location = /opt/homebrew/Cellar/ansible/11.9.0/libexec/lib/python3.13/site-packages/ansible`  
`ansible collection location = /Users/chris/.ansible/collections:/usr/share/ansible/collections`  
`executable location = /opt/homebrew/bin/ansible-playbook`  
`python version = 3.13.6 (main, Aug 6 2025, 13:05:20) [Clang 17.0.0 (clang-1700.0.13.3)] (/opt/homebrew/Cellar/ansible/11.9.0/libexec/bin/python)`  
`jinja version = 3.1.6`  
`libyaml = True`

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [August 14, 2025, 2:22pm UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/10 "2025-08-14T14:22:07Z")

</div>

My point with the configuration was that you could add `.enc` files, not that you needed to configure it for the common json/yaml extensions.

I suspect your issue is a data one, but without a full reproducer I don’t know what the exact problem is.

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [August 14, 2025, 5:31pm UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/11 "2025-08-14T17:31:51Z")

</div>

> Also, I wanted ahead and renamed the vault var files to be .vault and I used in ansible.cfg:  
> yaml\_valid\_extensions = .yml, .yaml, .json

That wouldn’t work for the same reason as .enc. .vault isn’t in the default list of valid extensions.

1. Use no extension or one of the configured extensions.
2. Ensure the files in group\_vars match the names of groups in your inventory. The hosts named capsule-v-001-mm037 and capsule-v-001-mm038 should be in the groups 002\_vault\_secrets\_test and 003\_vault\_secrets\_test if those hosts should load those group\_vars files.
3. Decrypt your vars and check the variable name matches the one the playbook is using. As pointed out above, you have a typo.

> I don’t think it’s the file extensions!

The non-standard extension is one issue, but there could be multiple.

---

<div class="post-metadata">

**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\
**Post date:** [August 14, 2025, 5:57pm UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/12 "2025-08-14T17:57:28Z")

</div>

> [@shertel](#):
>
> Ensure the files in group\_vars match the names of groups in your inventory. The hosts named capsule-v-001-mm037 and capsule-v-001-mm038 should be in the groups 002\_vault\_secrets\_test and 003\_vault\_secrets\_test if those hosts should load those group\_vars files.

Actually, those files are under `group_vars/all/` so the variables within will be available to all play hosts.

However, your first point, “Use no extension or one of the configured extensions” is spot on, as I showed in my post #5 above: “Then I changed the extension on `group_vars/all/003_vault_secrets_test.enc` to `.yml` and re-ran the playbook. That change made the variable in that file work in the playbook.”

---

<div class="post-metadata">

**Author:** ![Gittes](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@Gittes](https://forum.ansible.com/u/Gittes)\
**Post date:** [August 15, 2025, 1:00am UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/13 "2025-08-15T01:00:20Z")

</div>

I installed ansible via python virtualenv and I can’’t change it to .yml or blank for a file extension. I get the error:

> ERROR! Decryption failed (no vault secrets were found that could decrypt) on /opt/ChrisWasHere/test/group\_vars/all/002\_vault\_secrets\_test

Even changing it from a Homebrew install to a pip install still gives me the same issue of variable not defined! Can someone please help me debug this? It’s not file extensions!

---

<div class="post-metadata">

**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\
**Post date:** [August 15, 2025, 1:23am UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/14 "2025-08-15T01:23:16Z")

</div>

That’s a different error, one you’ve not told us about before. That error indicates it is reading the file, it sees the content is encrypted, and it doesn’t have any vault secret that can decrypt it.

You were passing `--vault-password-file ~/.secrets/ansible_vault_password.txt` before. Can you use that secrets file to decrypt `group_vars/all/002_vault_secrets_test` by use of the `ansible-vault` command on the command line? If not, well, there you go. If you can decrypt the file with that secret, then the problem has something to do with how you are presenting that secret to `ansible-playbook`.

Also, you’ve marked this thread as answered. You may want to remove that until this is fully resolved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [September 14, 2025, 1:24am UTC](https://forum.ansible.com/t/ansible-plabook-keeps-saying-ansible-vault-variables-are-undefined/44284/15 "2025-09-14T01:24:16Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.