Any hints or tricks to use ansible-vault data in config-contexts (when using the nb_inventory for ansible)?

[dameonwagner]

Hi,

We're in the process of moving to use netbox as an inventory source for ansible (and AWX), and are 99% of the way to completing the migration.

I've stumbled on a snag though, which is ansible-vault objects in sourced from config-contexts as part of the inventory data. With the native filebased ansible inventory we've got vaulted variables in the (YAML) form:

vault_test2: !vault |
          $ANSIBLE_VAULT;1.2;AES256;asdf
          34383.....

Which when translated into JSON (using the output of ansible-inventory as inspiration) this becomes:

{
    "vault_test2": {
        "__ansible_vault": "$ANSIBLE_VAULT;1.2;AES256;asdf\n34383.....\n"
    }
}

So far all good, running ansible-inventory against netbox provides identical data from the config-contexts (and all the extra good stuff netbox brings for free), but for some reason running playbook tasks against this inventory doesn't decrypt the "vault_test2" key, and just outputs it verbatim, as a dictionary. A test task I have in a playbook looks like this:

  - name: Vault Test 2
    debug:
      msg: "Test2 is {{ vault_test2 }}"

When running ansible-playbook with netbox as the inventory, this outputs something like:

"msg": "Test2 is {'__ansible_vault': '$ANSIBLE_VAULT;1.2;AES256;asdf\\n34383...\\n'}"

However, if I collect the output of ansible-inventory with netbox as the source, and feed it back into ansible-playbook (basically pointing -i at a small bash script to just cat the output back) it all works!

"msg": "Test2 is this_is_vault_test2"

So the data is good and well-formed. Which is where I get rather confused...

Are there any known issues, or formatting tips, to make this mechanism work?

Thanks in advance.

Dameon.

[dameonwagner]

Just in case someone else hits this issue and finds this page while googling for answers:

I've not yet found where the internal inconsistency is, but a simple work around is to have a stupidly simple script, and use that script as the Inventory source for ansible or ansible-playbook. It can be as simple as:

#/bin/bash
ansible-inventory -i netbox_inventory.yml --list 2> /dev/null

which basically fetches the inventory data and hands it directly to ansible-playbook like a hot potato. Why that works, and using ansible-playbook -i netbox_inventory.yml doesn't is still a mystery.

Thankfully, because AWX caches it's inventory, and doesn't fetch it on the fly like when running jobs, it seems unaffected by this oddity.

While it's only a workaround (which leaves me feeling somewhat unsatisfied, as I'd like to get to the bottom of it), I'd say this discussion can be put out to pasture.