Provide vault password with --ask-vault-password

[chylex]

In #115 (Lint vault files) the resolution seems to be that Ansible must be configured to automatically decrypt vaults for ansible-lint to work on playbooks that have a vault.

The problem is that I don't have the password in any file that Ansible would (or should) be able to decrypt automatically. I use ansible-playbook --ask-vault-password and have a password manager provide it when asked. If I try to lint a playbook that has a vault, I get:

internal-error: Unexpected error code 1 from execution of: ansible-playbook --syntax-check -i localhost, playbook.yaml
playbook.yaml:1 ERROR! Attempting to decrypt but no vault secrets found

If I run the syntax check manually with ansible-playbook --ask-vault-password --syntax-check playbook.yaml, it asks me for the password and then checks the syntax as expected.

It looks like I cannot do the same with ansible-lint --ask-vault-password playbook.yaml. Can this feature please be added for parity?

[sidneygijzen]

I agree it would be nice if the --ask-vault-password option would be added to ansible-lint. I ran into the same issue recently. Eventually I was able to get it working by including ask_vault_pass = True in ansible.cfg. With that option set, ansible-lint asks me for the password when run on a playbook with a vault.

[lurwas]

I agree.
A work around would be to

1. Create a temporary vault with some dummy values.
2. Create a vault-password-file with an known dummy password.
3. Copy the actual vault to a backup location.
4. Temporary copy over the regular vault with the temporary vault.
5. Encrypt the vault with the dummy vault password file.
6. Modify ansible.cfg and point out the vault password file (vault_password_file = dummy-password-file)
7. Execute ansible-lint
8. Restore the back up of the actual, original vault.

[Darkdragon84]

may I ask why the vault needs to be decrypted for mere linting in the first place?

[bfoersterling]

Adding the --vault-pass-file option would also be nice.

This is a workaround:

ANSIBLE_VAULT_PASSWORD_FILE=vault_pass.txt ansible-lint

Under the hood ansible-playbook --syntax-check is being used which accepts this env var.

Workaround for --ask-vault-pass:

ANSIBLE_ASK_VAULT_PASS=true ansible-lint

Or using a ansible.cfg in the project dir that only has one of those options.
But then your global ansible.cfg will be ignored which is probably not what you want.