# When variable is vaulted, to\_nice\_yaml renders output differently

**URL:** <https://forum.ansible.com/t/when-variable-is-vaulted-to-nice-yaml-renders-output-differently/45007>\
**Category:** Get Help\
**Tags:** yaml, ansible-core\
**Created:** [December 18, 2025, 12:48pm UTC](https://forum.ansible.com/t/when-variable-is-vaulted-to-nice-yaml-renders-output-differently/45007 "2025-12-18T12:48:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![spike](https://avatars.discourse-cdn.com/v4/letter/s/8797f3/32.png) [@spike](https://forum.ansible.com/u/spike)\
**Post date:** [December 18, 2025, 12:48pm UTC](https://forum.ansible.com/t/when-variable-is-vaulted-to-nice-yaml-renders-output-differently/45007/1 "2025-12-18T12:48:34Z")

</div>

Hi everyone, 👋

I’m a bit puzzled and would appreciate some input.

I’ve got a variable (`network_key`) containing a list of integers (nested in a dictionary, but that shouldn’t matter). This is eventually piped through the `to_nice_yaml` filter to create a yaml file on the target host.

If I vault `network_key`, the `to_nice_yaml` filter renders this as a string. If I do not vault `network_key`, it’s rendered as list of integers.

Here’s a (hopefully) minimal example:

```auto
- name: MVCE
  hosts: localhost
  gather_facts: false
  vars:
    instances_plain:
      - name: foo
        configuration:
          advanced:
            network_key: [1, 2, 3, 4, 5, 6]
    instances_vaulted:
      - name: foo
        configuration:
          advanced:
            network_key: !vault |
              $ANSIBLE_VAULT;1.1;AES256
              34666637333931303435643035393963386164323635663163343166643766653962613562376632
              3532363434356235383538666230373937353032653734610a383235393263386330626434356533
              35376239373131396465633838396562616335386263653233626566303432353434386139333666
              3835633961386332640a376463643737653031383031633136386264363161373665316366306363
              35653131663264633431643637313165336263623832373434353534666533663737
  tasks:
    - copy:
        content: "{{ item.configuration | to_nice_yaml }}"
        dest: /tmp/instances_plain.yml
      loop: "{{ instances_plain }}"

    - copy:
        content: "{{ item.configuration | to_nice_yaml }}"
        dest: /tmp/instances_vaulted.yml
      loop: "{{ instances_vaulted }}"

```

```auto
$ ansible-playbook test.yml 
PLAY [MVCE] *******************************************************************************************************

TASK [copy] *******************************************************************************************************
changed: [localhost] => (item={'name': 'foo', 'configuration': {'advanced': {'network_key': [1, 2, 3, 4, 5, 6]}}})

TASK [copy] *******************************************************************************************************
changed: [localhost] => (item={'name': 'foo', 'configuration': {'advanced': {'network_key': '[1, 2, 3, 4, 5, 6]'}}})

PLAY RECAP ********************************************************************************************************
localhost : ok=2 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 

$ cat /tmp/instances_plain.yml 
advanced:
    network_key:
    - 1
    - 2
    - 3
    - 4
    - 5
    - 6

$ cat /tmp/instances_vaulted.yml 
advanced:
    network_key: '[1, 2, 3, 4, 5, 6]'

```

`network_key` does not contain any quotes (i.e. it’s not a string, it’s a list of integers):

```auto
$ yq ".[0].vars.instances_vaulted[0].configuration.advanced.network_key" test.yml | ansible-vault decrypt 
Decryption successful
[1, 2, 3, 4, 5, 6]

```

The vault password is `123456` in case you want to reproduce this.

I’d like to know if (and how) I can make the `to_nice_yaml` treat variable the same, not matter if it’s are vaulted or not.  
But I’m also curious what the cause for the behaviour is. I’m pretty sure I’m overlooking something quite obvious.

Cheers!

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [December 18, 2025, 5:06pm UTC](https://forum.ansible.com/t/when-variable-is-vaulted-to-nice-yaml-renders-output-differently/45007/2 "2025-12-18T17:06:53Z")

</div>

All vaults are assumed to be strings, if you want a specific type you should cast in the template `varname|int`

---

<div class="post-metadata">

**Author:** ![spike](https://avatars.discourse-cdn.com/v4/letter/s/8797f3/32.png) [@spike](https://forum.ansible.com/u/spike)\
**Post date:** [December 18, 2025, 5:51pm UTC](https://forum.ansible.com/t/when-variable-is-vaulted-to-nice-yaml-renders-output-differently/45007/3 "2025-12-18T17:51:15Z")

</div>

> [@bcoca](#):
>
> All vaults are assumed to be strings

That’s what I figured, thanks for the clarification!

I’ve confused myself with

```auto
- name: MVCE
  hosts: localhost
  gather_facts: false
  vars:
    instances_vaulted:
      - name: foo
        configuration:
          advanced:
            network_key: !vault |
              $ANSIBLE_VAULT;1.1;AES256
              34666637333931303435643035393963386164323635663163343166643766653962613562376632
              3532363434356235383538666230373937353032653734610a383235393263386330626434356533
              35376239373131396465633838396562616335386263653233626566303432353434386139333666
              3835633961386332640a376463643737653031383031633136386264363161373665316366306363
              35653131663264633431643637313165336263623832373434353534666533663737
  tasks:
    - copy:
        content: |
          network_key: {{ instances_vaulted[0].configuration.advanced.network_key }}
        dest: /tmp/single_var.yml

```

resulting in

```auto
$ cat /tmp/single_var.yml 
network_key: [1, 2, 3, 4, 5, 6]

```

But the fact that there are not quotes around `[1, 2, 3, 4, 5, 6]` does not imply that it’s no a string. It’s just more obvious when using `to_nice_yaml` since it implicitly adds quotes.

Thanks again for your help!

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [December 18, 2025, 6:14pm UTC](https://forum.ansible.com/t/when-variable-is-vaulted-to-nice-yaml-renders-output-differently/45007/4 "2025-12-18T18:14:42Z")

</div>

`type_debug` is your friend when it comes to figuring out what the ‘real’ type is. Also note that \>= 2.19 versions of core are a LOT better at preserving intended types and avoid much stringification. Vaults still are assumed to be strings.

---

<div class="post-metadata">

**Author:** ![spike](https://avatars.discourse-cdn.com/v4/letter/s/8797f3/32.png) [@spike](https://forum.ansible.com/u/spike)\
**Post date:** [December 18, 2025, 8:13pm UTC](https://forum.ansible.com/t/when-variable-is-vaulted-to-nice-yaml-renders-output-differently/45007/5 "2025-12-18T20:13:57Z")

</div>

Very much appreciated. Thanks a bunch for your input!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [January 17, 2026, 8:14pm UTC](https://forum.ansible.com/t/when-variable-is-vaulted-to-nice-yaml-renders-output-differently/45007/6 "2026-01-17T20:14:39Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.