Ansiblle become fails with vault

Question

I've created an encrypted credent.yml file with this content:

sudo_password: whatever

I can decrypt with ansible-vault view credent.yml, however I cannot use it with this playbook:

---
- name: "Ansible test localhost"
  hosts: 127.0.0.1
  connection: local
  tasks:
    - name: check file existance
      ansible.builtin.stat: path=/tmp/err
      register: result

    - name: Print error if file does not exist
      ansible.builtin.fail:
        msg: "The file or directory does not exists"
      when: not result.stat.exists

    - name: Print debug message if it exists
      ansible.builtin.debug:
        msg: "The file or directory exists"
      when: result.stat.exists

      become: yes
      vars: 
        ansible_become_password: '{{ sudo_password }}'

This is the output:

ansible-playbook --ask-vault-pass --extra-vars '@credent.yml' checkfile.yml 
Vault password: 
ERROR! We were unable to read either as JSON nor YAML, these are the errors we got from each:
JSON: No JSON object could be decoded

Syntax Error while loading YAML.
  did not find expected node content

The error appears to be in '/root/test-ansible/credent.yml': line 1, column 16, but may
be elsewhere in the file depending on the exact syntax problem.

Ansible version:

ansible 2.9.18
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/dist-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.13 (default, Aug 22 2020, 10:03:02) [GCC 6.3.0 20170516]

Note: If I set ansible_python_interpreter: /usr/bin/python3 in playbook it fails either

What did I do wrong?

You obviously have a problem in your unencrypted yaml file. What do you have at line 1 char 16 ? I suspect `h` is not the actual content. Are you sure you don't need to quote your password / escape special chars... ? My 2 cent: reverse with `ansible-vault decrypt `, `yamllint` the file, find and fix the error, test it unencrypted, then encrypt it again. Side note: you have a typo in your var files that will prevent escalation: `sudo_passwod` => `sudo_passwo` **r** `d` — Zeitounator, Mar 11 '21 at 16:50
@Zeitounator it was a typo in the post (sudo_password) but not in the file. — sebelk, Mar 11 '21 at 17:55

score 0 · Accepted Answer · answered Mar 11 '21 at 18:06

0

I've checked credent.yml and run

yamllint credent.yml

That show me the syntax errors.

I've added --- at the top of file and escaped special chars.

Doing that the playbook runs fine.

answered Mar 11 '21 at 18:06

sebelk

565
1
6
16

Ansiblle become fails with vault

1 Answers1