Ansible Molecule pass multiple vault-ids

Question

How do I pass multiple ansible vault-ids to molecule? Passing multiple vault-ids as options in molecule.yml will not work because the last vault-id entry will win.

Example:

 provisioner:
   name: ansible
   options:
     vault-id: labelA@./fileA.vault
     vault-id: labelB@./fileB.vault

The labelA will be overridden by lableB.

Different teams own those password files, so they are separate creds in CI and AWX.

Answer 1

Set vault_identity_list in ansible.cfg via provisioner config_options:

provisioner:
  name: ansible
  config_options:
    defaults:
      vault_identity_list: ${MOLECULE_PROJECT_DIRECTORY}/a.vault,${MOLECULE_PROJECT_DIRECTORY}/b.vault

Answer 2

Try with this:

---
dependency:
  name: galaxy
driver:
  name: docker
platforms:
  - name: instance
    image: quay.io/centos/centos:stream8
    pre_build_image: true
provisioner:
  log: True
  name: ansible
  lint:
    name: ansible-lint
  ansible_args:
    - --vault-id=../vaultpass-for-devs
    - --vault-id=../vaultpass-for-ops
verifier:
  name: ansible