In my hosts file, I have GroupA and GroupB. Configuration for GroupB includes some sensitive data, and therefore I created group_vars/GroupB.yml and encrypted it with Ansible Vault.

I have a playbook with hosts: GroupA. When I run the playbook, Ansible fails because I didn't provide the password for group_vars/GroupB.yml. But GroupB was never invoked anywhere, so why would it try to decrypt that file? What might I be overlooking or misunderstanding - or is this in fact the intended behavior?

  • 3
    Ansible isn't very smart about this. If you specify --ask-vault-pass then it will always ask for the vault password, even if it's not needed. And if you don't specify it, then it will die ungracefully if you have any encrypted files, even if they aren't needed. – Michael Hampton Aug 3 '15 at 20:10
  • That is exactly it - I'm getting the "die ungracefully" response. I can understand the scenario where I want to run a certain role on GroupB, and that role doesn't need the encrypted data. Ansible can't know that there's no relevant variable in there, unless it decrypts and reads the file. But in my case I'm not doing anything with GroupB. – sfuqua Aug 3 '15 at 20:55

Ansible reads the entire inventory and group vars before execution, so even if no hosts are in GroupB, the vars still need to be decrypted.

If you don't like typing the vault pass you can pass a file path with it in.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.