Ansible Vault tries to Decode Irrelevant Files

[Firat Arig]

Hello,

I recently updated our Ansible version at our Jenkins server from 1.6.6 to 1.7.2 and our unencrypted playbooks started requiring vault passes.

Two of our environments didn't have any encryption on their group_vars files, but the rest of them had.

Prior to the update, it would just work fine, but now my job working at "project_qa" group would fail like:

ERROR: A vault password must be specified to decrypt /var/lib/jenkins/jobs/XX/group_vars/project_prod.yml  

It only works as intended when there are absolutely no encrypted files within the group_vars directory.

There are no custom patching on the ansible libraries, its a clean pip installation.

I'd rather not have my vault key distributed to every job. 

Thanks,

[Michael DeHaan]

Ansible doesn't know what variables you are going to use in a template up front, so any group or host variable in the configuration will be loaded.

You may wish to move your secured files to something like (toplevel) production.yml and do a

ansible-playbook site.yml -e @production.yml

and reduce the number of vault files you have, and this way it would only load the production one.

Alternatively, keep your inventory in different directories

-i inventory/prod/inventory.ini, group_vars, host_vars

-i inventory/dev/inventory.ini, group_vars, host_vars

To keep them isolated.

--
You received this message because you are subscribed to the Google Groups "Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com.
To post to this group, send email to ansible...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/10287050-b5e9-4f0a-aa42-ec660e4c8a10%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.