ansible/test/integration/targets/ansible-vault/invalid_format/broken-group-vars-tasks.yml

---
- hosts: broken-group-vars
  gather_facts: false
  tasks:
    - name: EXPECTED FAILURE
      debug:
        msg: "some_var_that_fails: {{ some_var_that_fails }}"

    - name: EXPECTED FAILURE Display hostvars
      debug:
        msg: "{{inventory_hostname}} hostvars: {{ hostvars[inventory_hostname] }}"


# ansible-vault --vault-password-file=vault-secret encrypt_string test
# !vault |
#           $ANSIBLE_VAULT;1.1;AES256
#           64323332393930623633306662363165386332376638653035356132646165663632616263653366
#           6233383362313531623238613461323861376137656265380a366464663835633065616361636231
#           39653230653538366165623664326661653135306132313730393232343432333635326536373935
#           3366323866663763660a323766383531396433663861656532373663373134376263383263316261
#           3137

# $ ansible-playbook -i inventory --vault-password-file=vault-secret tasks.yml
Better handling of malformed vault data envelope (#32515) * Better handling of malformed vault data envelope If an embedded vaulted variable ('!vault' in yaml) had an invalid format, it would eventually cause an error for seemingly unrelated reasons. "Invalid" meaning not valid hexlify (extra chars, non-hex chars, etc). For ex, if a host_vars file had invalid vault format variables, on py2, it would cause an error like: 'ansible.vars.hostvars.HostVars object' has no attribute u'broken.example.com' Depending on where the invalid vault is, it could also cause "VARIABLE IS NOT DEFINED!". The behavior can also change if ansible-playbook is py2 or py3. Root cause is errors from binascii.unhexlify() not being handled consistently. Fix is to add a AnsibleVaultFormatError exception and raise it on any unhexlify() errors and to handle it properly elsewhere. Add a _unhexlify() that try/excepts around a binascii.unhexlify() and raises an AnsibleVaultFormatError on invalid vault data. This is so the same exception type is always raised for this case. Previous it was different between py2 and py3. binascii.unhexlify() raises a binascii.Error if the hexlified blobs in a vault data blob are invalid. On py2, binascii.Error is a subclass of Exception. On py3, binascii.Error is a subclass of TypeError When decrypting content of vault encrypted variables, if a binascii.Error is raised it propagates up to playbook.base.Base.post_validate(). post_validate() handles exceptions for TypeErrors but not for base Exception subclasses (like py2 binascii.Error). * Add a display.warning on vault format errors * Unit tests for _unhexlify, parse_vaulttext* * Add intg test cases for invalid vault formats Fixes #28038 7 years ago			`---`
			`- hosts: broken-group-vars`
			`gather_facts: false`
			`tasks:`
			`- name: EXPECTED FAILURE`
			`debug:`
			`msg: "some_var_that_fails: {{ some_var_that_fails }}"`

			`- name: EXPECTED FAILURE Display hostvars`
			`debug:`
			`msg: "{{inventory_hostname}} hostvars: {{ hostvars[inventory_hostname] }}"`


			`# ansible-vault --vault-password-file=vault-secret encrypt_string test`
			`# !vault \|`
			`# $ANSIBLE_VAULT;1.1;AES256`
			`# 64323332393930623633306662363165386332376638653035356132646165663632616263653366`
			`# 6233383362313531623238613461323861376137656265380a366464663835633065616361636231`
			`# 39653230653538366165623664326661653135306132313730393232343432333635326536373935`
			`# 3366323866663763660a323766383531396433663861656532373663373134376263383263316261`
			`# 3137`

			`# $ ansible-playbook -i inventory --vault-password-file=vault-secret tasks.yml`