Ansible-vault correct set up

Get Help
1

Hi everyone, I just need some help regarding Ansible Vault. My .ini inventory is currently encrypted with Ansible Vault, but after running it in the Rundeck GUI, I encountered an error. Here is the error:

[WARNING]: * Failed to parse /opt/ansible-lab/inventories/ubuntu.ini with ini

plugin: /opt/ansible-lab/inventories/ubuntu.ini:5: Error parsing host

definition 'w?"Մ???b?%0???8????q[???:$?u]:A?hP??f?3̥?Xp?Tn[???v??u?D3??

?2X
D?8#(мB?^0??)?D?m???k?)???ϯ?B?Ze?8S1w?W?R?BV???'gfB?-+¾d??A?4?B?

J
?C’: No closing quotation

[WARNING]: Unable to parse /opt/ansible-lab/inventories/ubuntu.ini as an

inventory source

[WARNING]: No inventory was parsed, only implicit localhost is available

[WARNING]: Could not match supplied host pattern, ignoring: ubuntu_servers

2

The INI format file for Ansible inventory cannot be vaulted, nor does it support inline encrypted vault strings. Instead, use a directory structure where your plain inventory.ini file sits next to a group_vars/ or host_vars/ folder containing encrypted YAML vault files.

3

Just to add the relevant section from the docs:

https://docs.ansible.com/projects/ansible/latest/vault_guide/vault_encrypting_content.html#encrypting-files-with-ansible-vault

Apparently, you can even encrypt your HDD… but not the inventory file(s) :laughing:

4

Vaulted inventory support depends on the inventory plugin itself. Plugins can choose to open the file with functions that support vaulted content, the ini inventory plugin does do this.

#>ansible-inventory -i ../testing/valutedini.ini --ask-vault-pass --list
[WARNING]: You are running the development version of Ansible. You should only run Ansible from "devel" if you are modifying the Ansible engine, or trying out features under development. This is a rapidly changing source of code and can become unstable at any point.
Vault password:  test
{
    "_meta": {
        "hostvars": {},
        "profile": "inventory_legacy"
    },
    "all": {
        "children": [
            "ungrouped"
        ]
    },
    "ungrouped": {
        "hosts": [
            "host1",
            "host2"
        ]
    }
}

#>cat ../testing/valutedini.ini 
$ANSIBLE_VAULT;1.1;AES256
32383232653430383435373334393566333566633738336235303637613532383930313032356630
3932643561613133333362623762353133383330383234300a356237343637303666376639306161
36396434666463363831366162386462626630396539343437326138613736333363366162626161
3638623038393964340a353433303336373535356130373561653062656532393733666265663166
3236
5

Are you saying that the error the OP is getting is caused by something else? Vault encrypted ini inventory should work?

6

Yes, at first i thought only the yaml plugin supported this, but then tested and realized we built this into the ini also. The error they are getting seem unrelated to ansible vault encryption and looks like a different encryption method.

7

That’s nice to know. Thanks!

Yeah, the binary looking output is a little bit fishy.

8

I stand corrected. Following my father-in-law’s declaration: “Often wrong; never in doubt.”