1

I have a playbook where I want to copy a vault-encrypted json file (and unencrypt on the way) to a raspberry. I encrypted the file using

ansible-vault encrypt secrets.json

Viewing and decrypting works, also running the playbook with --ask-vault-pass. I tried this a couple of times yesterday and it does what it should, but after a while the error mentioned in the title seems to pop up, no matter if I run the playbook or try to explicitly decrypt/view the file. It seems to "forget" it is a correctly encrypted file. This happened with a few encryption attempts, always after a certain amount of time (~1h). I did not change anything in the meantime as git confirms.

The copy command in the playbook:

    - name: copy secrets.json
      copy:
        src: ../secrets.json
        dest: raspberry/secrets.json
        decrypt: yes
        owner: pi
        mode: '0700'
        group: pi

I installed ansible via pipx:

pipx install --include-deps ansible

ansible --version
ansible [core 2.13.2]
  config file = None
  configured module search path = ['/home/michael/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/michael/.local/pipx/venvs/ansible/lib/python3.10/site-packages/ansible
  ansible collection location = /home/michael/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/michael/.local/bin/ansible
  python version = 3.10.2 (main, Feb 16 2022, 01:19:40) [GCC 9.3.0]
  jinja version = 3.1.2
  libyaml = True

My password contains only alphanumeric characters.

telegott
  • 196
  • 1
  • 10
  • That's odd, but since the encryption algorithm is AES256 with a salt, maybe a time misconfiguration could cause that? Try to check the time of your nodes and their corresponding NTP configuration, maybe? – β.εηοιτ.βε Aug 01 '22 at 19:09
  • 1
    You'll want to pay especial attention to the [MCVE](https://stackoverflow.com/help/mcve) section since as written no one can possibly **guess** what you're running. MCVE still applies even with cryptographic questions as the example can include fake secrets and hard-coded passwords. The posted question doesn't have to _consistently_ fail, cause I hear you about the nondeterministic behavior, but meet us half way with _something_. Good luck – mdaniel Aug 01 '22 at 19:16

0 Answers0