Ansible Vault tries to Decode Irrelevant Files

Archives Ansible Project
1

Hello,

I recently updated our Ansible version at our Jenkins server from 1.6.6 to 1.7.2 and our unencrypted playbooks started requiring vault passes.

Two of our environments didn’t have any encryption on their group_vars files, but the rest of them had.

Prior to the update, it would just work fine, but now my job working at “project_qa” group would fail like:

ERROR: A vault password must be specified to decrypt /var/lib/jenkins/jobs/XX/group_vars/project_prod.yml

It only works as intended when there are absolutely no encrypted files within the group_vars directory.

There are no custom patching on the ansible libraries, its a clean pip installation.

I’d rather not have my vault key distributed to every job.

Thanks,

2

Ansible doesn’t know what variables you are going to use in a template up front, so any group or host variable in the configuration will be loaded.

You may wish to move your secured files to something like (toplevel) production.yml and do a

ansible-playbook site.yml -e @production.yml

and reduce the number of vault files you have, and this way it would only load the production one.

Alternatively, keep your inventory in different directories

-i inventory/prod/inventory.ini, group_vars, host_vars
-i inventory/dev/inventory.ini, group_vars, host_vars

To keep them isolated.