# using lookup(csvfile) with and encrypted file with vault fails

**URL:** <https://forum.ansible.com/t/using-lookup-csvfile-with-and-encrypted-file-with-vault-fails/35131>\
**Category:** Ansible Project\
**Created:** [May 7, 2021, 8:53am UTC](https://forum.ansible.com/t/using-lookup-csvfile-with-and-encrypted-file-with-vault-fails/35131 "2021-05-07T08:53:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pabolito\_Garci](https://avatars.discourse-cdn.com/v4/letter/p/ac91a4/32.png) [@Pabolito\_Garci](https://forum.ansible.com/u/Pabolito_Garci)\
**Post date:** [May 7, 2021, 8:53am UTC](https://forum.ansible.com/t/using-lookup-csvfile-with-and-encrypted-file-with-vault-fails/35131/1 "2021-05-07T08:53:22Z")

</div>

Hello,

Using ansible 2.9.19 in a RHEL7.8 server  
python version = 2.7.5

I am trying to set facts from a lookup into a csv file. The playbook works but as the facts set are passwords, I need to encrypt the content to the file.

I did : ansible-vault encrypt " hpe\_sut\_security\_store .csv"

This is the task to set up the variables:

- name: read credentials from csv file  
set\_fact:  
hpe\_sut\_cred\_user: “{{ lookup(‘csvfile’, inventory\_hostname +’ file=hpe\_sut\_security\_store.csv delimiter=; col=1’) }}”  
hpe\_sut\_cred\_pwd: “{{ lookup(‘csvfile’, inventory\_hostname +’ file=hpe\_sut\_security\_store.csv delimiter=; col=2’) }}”

But set\_fact or the lookup(‘csvfile’) is not trying to decrypt the file! so the output is always an empty variable. It doesn’t matter if I don’t add the --ask-vault tags

ansible-playbook -vv play\_single\_prod.yml --ask-vault

ansible-playbook -vv play\_single\_prod.yml

gives the same result. I would expect not having the --ask-vault tag to fail the playbook what leads me to think, that the file is not seen as encrypted?

is there something wrong I am doing or it is expected behaviour that set\_fact or lookup(csvfile) wont see it as en encrypted file?

Just in case, file is properly encrypted:

head files/hpe\_sut\_credentials.csv  
**$ANSIBLE\_VAULT;1.1;AES256**  
32346262623864346531656630663766623162383631653932643762353131656132393438366239  
3962396438343938363439356330363964333431636433360a613630666666326139343763313163  
39323063383565333231373237376263393239393864303137343734356364343133303539393533  
3239636436363965620a653730383263663833653235666330636234353834663662326434666362

Thanks in advance  
Pablo Garcia

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [May 7, 2021, 9:28am UTC](https://forum.ansible.com/t/using-lookup-csvfile-with-and-encrypted-file-with-vault-fails/35131/2 "2021-05-07T09:28:35Z")

</div>

AFAIK the csvfile lookup does not support vaulted cvsfiles

---

<div class="post-metadata">

**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\
**Post date:** [May 7, 2021, 11:16am UTC](https://forum.ansible.com/t/using-lookup-csvfile-with-and-encrypted-file-with-vault-fails/35131/3 "2021-05-07T11:16:33Z")

</div>

Lookup \*file\* will decrypt it. Parse the file on your own and create  
a dictionary, e.g.

&nbsp;&nbsp;&nbsp;&nbsp;- set\_fact:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;hpe\_sut\_cred: "{{ hpe\_sut\_cred|default({})|  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;combine({\_arr.0: {'user': \_arr.1,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'pwd': \_arr.2}}) }}"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;loop: "{{ lookup('file', 'store.csv').splitlines() }}"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;vars:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\_arr: "{{ item.split(';') }}"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;run\_once: true

Then, use it to set the variables

&nbsp;&nbsp;&nbsp;&nbsp;- set\_fact:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;user: "{{ hpe\_sut\_cred[inventory\_hostname]['user'] }}"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;pwd: "{{ hpe\_sut\_cred[inventory\_hostname]['pwd'] }}"