"Attempting to decrypt but no vault secrets found" for group_vars/all variables pointing to vault loaded with vars_files

[d1nuc0m]

Summary

I have some variables that should be visible to all groups and be encrypted, following tips about variable visibility, I placed auxiliary variables like my_variable: "{{ vault_my_variable }}" in group_vars/all and loaded a vault with vars_files in the playbook. It works, but the linter fails with error "Attempting to decrypt but no vault secrets found".

Issue Type

• Bug Report

OS / ENVIRONMENT

ansible-lint 24 using ansible-core:2.16.12 ansible-compat:24.9.0 ruamel-yaml:0.18.6 ruamel-yaml-clib:0.2.12

• ansible installation method: OS package
• ansible-lint installation method: OS package

STEPS TO REPRODUCE

Minimal reproducible example

group_vars/all

ssh_pubkey: "{{ vault_ssh_pubkey }}"

group_vars/all_vault.yml

vault_ssh_pubkey:  "ssh-rsa lorem-ipsum"

roles/ssh/tasks/main.yaml

- name: Set authorized key
  ansible.posix.authorized_key:
    user: d1nuc0m
    state: present
    key: {{ ssh_pubkey }}"

playbook.yaml

- name: Host 1
  hosts: host1.example.com
  vars_files:
    - group_vars/all_vault.yml
  roles:
    - ssh
    - (other roles here)
- name: Host 2
  hosts: host2.example.com
  vars_files:
    - group_vars/all_vault.yml
  roles:
    - ssh
    - (other different roles here)

Desired Behavior

If I try to run the playbook with ansible-playbook -i inventory.yaml --vault-id @prompt playbook.yaml it works, so I would expect the linter not to fail as the variables are defined. If this is not the correct solution on variable management please let me know

Actual Behavior

$ ansible-lint playbook.yaml
WARNING  Listing 1 violation(s) that are fatal
internal-error: Unexpected error code 1 from execution of: ansible-playbook -i localhost, --syntax-check playbook.yaml
playbook.yaml:1 ERROR! Attempting to decrypt but no vault secrets found


Read documentation for instructions on how to ignore specific rule violations.

              Rule Violation Summary               
 count tag            profile rule associated tags 
     1 internal-error min     core