Error with Vault single-variable encryption

[bootswithdefer]

Issue Type

• Bug report

Ansible and Ansible Lint details

ansible-ansible 2.3.0.0
config file = /home/jldefer/ansible/ansible.cfg
configured module search path = [u'/usr/share/ansible']
python version = 2.7.13 (default, Jan 12 2017, 17:59:37) [GCC 6.3.1 20161221 (Red Hat 6.3.1-1)]

ansible-lint 3.4.12

• ansible installation method: pip
• ansible-lint installation method: pip

Desired Behaviour

No error

Actual Behaviour (Bug report only)

When run against new vault string encryption (https://docs.ansible.com/ansible/playbooks_vault.html#single-encrypted-variable) files it fails with a YAML syntax error:

$ ansible-lint test.yml 
Syntax Error while loading YAML.


The error appears to have been in '/home/user/test.yml': line 2, column 15, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:

---
vault_string: !vault |
              ^ here

test.yml:

vault_string: !vault |
              $ANSIBLE_VAULT;1.1;AES256
              646637383932633933266643636373936936373964366536636639643136646530666531663365
              64653765356234396336133343937386276664353861640a303730366362366266303864346235
plain_string: test

[willthames]

I'll need to look into this works in Ansible. If anyone already knows and wants to fix this, just let me know.

[kouk]

@willthames I added a fix upon your minimal-vault branch in order to use it here: https://github.com/kouk/ansible-lint/tree/minimal-vault
feel free to use it.
if I find time I would also like to work on #115. Using ansible 2.3 here.

[deekayen]

I found when I put the vault string into Tower using the JSON formatter, that it converted the output YAML format as follows, which ansible-review approves of.

vault_string: >-
              !vault | $ANSIBLE_VAULT;1.1;AES256
              646637383932633933266643636373936936373964366536636639643136646530666531663365
              64653765356234396336133343937386276664353861640a303730366362366266303864346235
plain_string: test

[willthames]

@deekayen I think it's that we use Ansible's YAML parser properly now, so both ansible-lint and ansible-review should now handle !vault better than previously. Good to know it works though.

[deekayen]

Yeah, disregard my comment from yesterday. I ran it today and it inserts the literal vault string into the template output instead of the parsed value. I upgraded to 3.5.0rc1 instead.