allow user to control vault decrypt is error

[bcoca]

new config item avoids requiring vault secret for all encrypted files, user is still responsible for play failing/doing the wrong thing if the data was actually required.

ISSUE TYPE

• Feature Pull Request

[AlanCoding]

Not working for intended use case at

https://github.com/AlanCoding/Ansible-inventory-file-examples/tree/master/vault/file_vars

ANSIBLE_VAULT_DECRYPT_IS_ERROR=false ansible-inventory -i vault/file_vars/inventory.ini --list --export
[WARNING]: You are running the development version of Ansible. You should only run Ansible from "devel" if you are modifying the Ansible
engine, or trying out features under development. This is a rapidly changing source of code and can become unstable at any point.
ERROR! Attempting to decrypt but no vault secrets found

the encrypted file at issue is https://github.com/AlanCoding/Ansible-inventory-file-examples/blob/master/vault/file_vars/group_vars/raleigh

[bcoca]

i did decryption errors, which require a secret ,missed the 'no secrets provided' one

[bcoca]

thinking if i should narrow it down to 'no secrets provided'? and keep decryption errors as hard error?

is there a case to pass secrets, decrypt parts but not other parts?

[AlanCoding]

I re-tested and got this:

$ ANSIBLE_VAULT_DECRYPT_IS_ERROR=false ansible-inventory -i vault/file_vars/inventory.ini --list --export -vvv
[WARNING]: You are running the development version of Ansible. You should only run Ansible from "devel" if you are modifying the Ansible
engine, or trying out features under development. This is a rapidly changing source of code and can become unstable at any point.
ansible-inventory [core 2.17.0.dev0] (detached HEAD 6578dc67e8) last updated 2023/10/10 10:18:24 (GMT -400)
  config file = None
  configured module search path = ['/home/alancoding/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/alancoding/repos/ansible/lib/ansible
  ansible collection location = /home/alancoding/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/alancoding/repos/awx/env/bin/ansible-inventory
  python version = 3.11.5 (main, Aug 28 2023, 00:00:00) [GCC 12.3.1 20230508 (Red Hat 12.3.1-1)] (/home/alancoding/repos/awx/env/bin/python)
  jinja version = 3.1.2
  libyaml = True
No config file found; using defaults
host_list declined parsing /home/alancoding/repos/Ansible-inventory-file-examples/vault/file_vars/inventory.ini as it did not pass its verify_file() method
script declined parsing /home/alancoding/repos/Ansible-inventory-file-examples/vault/file_vars/inventory.ini as it did not pass its verify_file() method
auto declined parsing /home/alancoding/repos/Ansible-inventory-file-examples/vault/file_vars/inventory.ini as it did not pass its verify_file() method
yaml declined parsing /home/alancoding/repos/Ansible-inventory-file-examples/vault/file_vars/inventory.ini as it did not pass its verify_file() method
Parsed /home/alancoding/repos/Ansible-inventory-file-examples/vault/file_vars/inventory.ini inventory source with ini plugin
[WARNING]: Attempting to decrypt but no vault secrets found
ERROR! failed to combine variables, expected dicts but got a 'dict' and a 'AnsibleUnicode': 
{}
"$ANSIBLE_VAULT;1.1;AES256 35393165633131383065363835633362313035366437646664663733613535333662313837653562 6263623665306663653833303363326364643464623233640a303132393531313037333639313665 64643533623166663033623832333630323462303935343832613434646562383632323534343734 3263353063313433390a376237366230643130333864623263393461613365313962356632643739 32346634623462326164633162646564343365643962336432626531396631636438"

With the -vvv I feel like I should get a traceback here?

[bcoca]

issues is that while im ignoring the error, im still returning the vaulted text (should be empty dict) .. no clue why no traceback

[bcoca]

Error:

#$  ANSIBLE_VAULT_DECRYPT_IS_ERROR=true ansible-inventory -i ~/work/inventories/test.ini --list --export -vvv
ansible-inventory [core 2.17.0.dev0] (warn_devault f10ecd529f) last updated 2023/10/10 13:20:55 (GMT -400)
  config file = None
  configured module search path = ['/home/bcoca/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/bcoca/work/ansible/lib/ansible
  ansible collection location = /home/bcoca/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/bcoca/work/ansible/bin/ansible-inventory
  python version = 3.10.12 (main, Jun 11 2023, 05:26:28) [GCC 11.4.0] (/usr/bin/python3)
  jinja version = 3.0.3
  libyaml = True
No config file found; using defaults
host_list declined parsing /home/bcoca/work/inventories/test.ini as it did not pass its verify_file() method
script declined parsing /home/bcoca/work/inventories/test.ini as it did not pass its verify_file() method
auto declined parsing /home/bcoca/work/inventories/test.ini as it did not pass its verify_file() method
yaml declined parsing /home/bcoca/work/inventories/test.ini as it did not pass its verify_file() method
Parsed /home/bcoca/work/inventories/test.ini inventory source with ini plugin
ERROR! Attempted to decrypt (b'/home/bcoca/work/inventories/group_vars/all/fullvault.yml') but no vault secrets found

Warning:

#$  ANSIBLE_VAULT_DECRYPT_IS_ERROR=false ansible-inventory -i ~/work/inventories/test.ini --list --export -vvv
ansible-inventory [core 2.17.0.dev0] (warn_devault f10ecd529f) last updated 2023/10/10 13:20:55 (GMT -400)
  config file = None
  configured module search path = ['/home/bcoca/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/bcoca/work/ansible/lib/ansible
  ansible collection location = /home/bcoca/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/bcoca/work/ansible/bin/ansible-inventory
  python version = 3.10.12 (main, Jun 11 2023, 05:26:28) [GCC 11.4.0] (/usr/bin/python3)
  jinja version = 3.0.3
  libyaml = True
No config file found; using defaults
host_list declined parsing /home/bcoca/work/inventories/test.ini as it did not pass its verify_file() method
script declined parsing /home/bcoca/work/inventories/test.ini as it did not pass its verify_file() method
auto declined parsing /home/bcoca/work/inventories/test.ini as it did not pass its verify_file() method
yaml declined parsing /home/bcoca/work/inventories/test.ini as it did not pass its verify_file() method
Parsed /home/bcoca/work/inventories/test.ini inventory source with ini plugin
[WARNING]: Attempted to decrypt (b'/home/bcoca/work/inventories/group_vars/all/fullvault.yml') but no vault secrets found. Skipped
{
    "_meta": {
        "hostvars": {
 ...

[AlanCoding]

With current branch I get this

$ ANSIBLE_VAULT_DECRYPT_IS_ERROR=false ansible-inventory -i vault/file_vars/inventory.ini --list --export -vvv
[WARNING]: You are running the development version of Ansible. You should only run Ansible from "devel" if you are modifying the Ansible
engine, or trying out features under development. This is a rapidly changing source of code and can become unstable at any point.
ansible-inventory [core 2.17.0.dev0] (detached HEAD 17325b189a) last updated 2023/10/13 09:47:11 (GMT -400)
  config file = None
  configured module search path = ['/home/alancoding/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/alancoding/repos/ansible/lib/ansible
  ansible collection location = /home/alancoding/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/alancoding/repos/awx/env/bin/ansible-inventory
  python version = 3.11.5 (main, Aug 28 2023, 00:00:00) [GCC 12.3.1 20230508 (Red Hat 12.3.1-1)] (/home/alancoding/repos/awx/env/bin/python)
  jinja version = 3.1.2
  libyaml = True
No config file found; using defaults
host_list declined parsing /home/alancoding/repos/Ansible-inventory-file-examples/vault/file_vars/inventory.ini as it did not pass its verify_file() method
script declined parsing /home/alancoding/repos/Ansible-inventory-file-examples/vault/file_vars/inventory.ini as it did not pass its verify_file() method
auto declined parsing /home/alancoding/repos/Ansible-inventory-file-examples/vault/file_vars/inventory.ini as it did not pass its verify_file() method
yaml declined parsing /home/alancoding/repos/Ansible-inventory-file-examples/vault/file_vars/inventory.ini as it did not pass its verify_file() method
Parsed /home/alancoding/repos/Ansible-inventory-file-examples/vault/file_vars/inventory.ini inventory source with ini plugin
ERROR! Attempted to decrypt (b'/home/alancoding/repos/Ansible-inventory-file-examples/vault/file_vars/group_vars/raleigh') but no vault secrets found

Just to show it here quickly, we have:

$ cat vault/file_vars/group_vars/raleigh
$ANSIBLE_VAULT;1.1;AES256
35393165633131383065363835633362313035366437646664663733613535333662313837653562
6263623665306663653833303363326364643464623233640a303132393531313037333639313665
64643533623166663033623832333630323462303935343832613434646562383632323534343734
3263353063313433390a376237366230643130333864623263393461613365313962356632643739
32346634623462326164633162646564343365643962336432626531396631636438

This is the issue that I'm interested in - ignoring an encrypted file that can't be decrypted. Since it's a vars file, it should contain a key-value mapping when decrypted. The request is to ignore the file, so that any group variables that would have been included if secrets were available are simply not included.

[bcoca]

@AlanCoding you might have not noticed, I changed the setting and config option names as we changed the scope of what it affects, use ANSIBLE_VAULT_DECRYPT_VARSFILE_FAIL now.

[AlanCoding]

Thanks, that does seem to be working, and also manages to not interfere with other types of encrypted variables.

$ ANSIBLE_VAULT_DECRYPT_VARSFILE_FAIL=false ansible-inventory -i vault/file_vars/inventory.ini --list --export
[WARNING]: You are running the development version of Ansible. You should only run Ansible from "devel" if you are modifying the Ansible
engine, or trying out features under development. This is a rapidly changing source of code and can become unstable at any point.
[WARNING]: Attempted to decrypt (b'/home/alancoding/repos/Ansible-inventory-file-examples/vault/file_vars/group_vars/raleigh') but no
vault secrets found. Skipped
{
    "_meta": {
        "hostvars": {}
    },
    "all": {
        "children": [

[ansibot]

The test ansible-test sanity --test pep8 [explain] failed with 1 error:

lib/ansible/utils/display.py:573:5: E303: too many blank lines (2)

click here for bot help