Hello! I’ve been making extensive use of vault encrypted strings like this
test: !vault |
$ANSIBLE_VAULT;1.1;AES256
32313565333766366161623238333866356334363961326362336537666336643564383363316664
6365663430383564623464386338623536363465393962320a386130306665653734316432316265
62393235353362393334383862393538646134393735393434613862323139333732353333366136
3563613331393237310a626362373031646265386461616537386232336234363361363361333533
363
I provide the password file via the ANSIBLE_VAULT_PASSWORD_FILE
environment variable.
On 2.18.8 this works all fine, however on 2.19 the strings are now placed as they are into the templates and are no longer being decrypted.
I could find nothing in the changelog that would indicate that this feature was changed.
For completeness I use this script to encrypt
#! /bin/bash
# Switch to script dir
cd "$(dirname "${BASH_SOURCE[0]}")" || exit 1
if [[ ! ( -n "$ANSIBLE_VAULT_PASSWORD_FILE" && -f "$ANSIBLE_VAULT_PASSWORD_FILE" ) ]]; then
echo "Vault Password File not found."
echo "Make sure the environment variable ANSIBLE_VAULT_PASSWORD_FILE is set to the password file"
exit 1
fi
# Ansible is fussy about that
chmod 600 "$ANSIBLE_VAULT_PASSWORD_FILE"
variable="${1:-variable}"
if [ $# -ge 2 ]; then
value="$2"
else
read -r -p "Enter value for the variable \"$variable\": " value
fi
ansible-vault \
encrypt_string \
"--vault-password-file=$ANSIBLE_VAULT_PASSWORD_FILE" \
--encrypt-vault-id default \
--name "$variable" \
"$value"
and no flags related to the vault on the actual ansible CLI.
As an important note, I do need this to continue to work on both versions unfortunately.