# Ansible Vault tries to Decode Irrelevant Files

**URL:** <https://forum.ansible.com/t/ansible-vault-tries-to-decode-irrelevant-files/16792>\
**Category:** Ansible Project\
**Created:** [November 14, 2014, 6:12pm UTC](https://forum.ansible.com/t/ansible-vault-tries-to-decode-irrelevant-files/16792 "2014-11-14T18:12:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Firat\_Arig](https://avatars.discourse-cdn.com/v4/letter/f/ee7513/32.png) [@Firat\_Arig](https://forum.ansible.com/u/Firat_Arig)\
**Post date:** [November 14, 2014, 6:12pm UTC](https://forum.ansible.com/t/ansible-vault-tries-to-decode-irrelevant-files/16792/1 "2014-11-14T18:12:18Z")

</div>

Hello,

I recently updated our Ansible version at our Jenkins server from 1.6.6 to 1.7.2 and our unencrypted playbooks started requiring vault passes.

Two of our environments didn’t have any encryption on their group\_vars files, but the rest of them had.

Prior to the update, it would just work fine, but now my job working at “ **project\_qa** ” group would fail like:

> ERROR: A vault password must be specified to decrypt /var/lib/jenkins/jobs/XX/group\_vars/ **project\_prod**.yml

It only works as intended when there are absolutely no encrypted files within the group\_vars directory.

There are no custom patching on the ansible libraries, its a clean pip installation.

I’d rather not have my vault key distributed to every job.

Thanks,

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [November 17, 2014, 9:00pm UTC](https://forum.ansible.com/t/ansible-vault-tries-to-decode-irrelevant-files/16792/2 "2014-11-17T21:00:58Z")

</div>

Ansible doesn’t know what variables you are going to use in a template up front, so any group or host variable in the configuration will be loaded.

You may wish to move your secured files to something like (toplevel) production.yml and do a

ansible-playbook site.yml -e @production.yml

and reduce the number of vault files you have, and this way it would only load the production one.

Alternatively, keep your inventory in different directories

-i inventory/prod/inventory.ini, group\_vars, host\_vars  
-i inventory/dev/inventory.ini, group\_vars, host\_vars

To keep them isolated.