Issue 1:
ISSUE TYPE

Bug Report

COMPONENT NAME

core

(It concerns strings encrypted via ansible-vault.)

ANSIBLE VERSION

ansible 2.4.1.0
config file = /home/flaf/MesDocs/informatique/docs/mes_notes/git/ansible-tice/ansible.cfg
configured module search path = [u'/home/flaf/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python2.7/dist-packages/ansible
executable location = /usr/bin/ansible
python version = 2.7.13 (default, Jan 19 2017, 14:48:08) [GCC 6.3.0 20170118]

CONFIGURATION

ANSIBLE_NOCOWS(/home/flaf/MesDocs/informatique/docs/mes_notes/git/ansible-tice/ansible.cfg) = True
DEFAULT_BECOME(/home/flaf/MesDocs/informatique/docs/mes_notes/git/ansible-tice/ansible.cfg) = True
DEFAULT_HOST_LIST(/home/flaf/MesDocs/informatique/docs/mes_notes/git/ansible-tice/ansible.cfg) = [u'/home/flaf/MesDocs/informatique/docs/mes_n
DEFAULT_ROLES_PATH(/home/flaf/MesDocs/informatique/docs/mes_notes/git/ansible-tice/ansible.cfg) = [u'/home/flaf/MesDocs/informatique/docs/mes_

OS / ENVIRONMENT

~$ lsb_release -a
No LSB modules are available.
Distributor ID:	Debian
Description:	Debian GNU/Linux 9.2 (stretch)
Release:	9.2
Codename:	stretch

SUMMARY

If a string variable is encrypted via ansible-vault, its type is not string.

STEPS TO REPRODUCE

Here is the playbook to reproduce the problem:

---
- hosts: localhost
gather_facts: False
vars:
key1: 'abcdef'
# key2 is equal to 'abcdef' too but encrypted via `ansible-vault`.
key2: !vault |
$ANSIBLE_VAULT;1.1;AES256
65326230313463613961666434396131646432343565333835383433336436653661643835363336
3133653264363162376164373630343238353833383631370a616632303532666161643936383266
30623564373335633431323532313264366533313366626635303963303431383135633435303364
3036333436663037650a373336643666313761653564393963313162616339643436316463313938
3664
tasks:
- debug:
msg: 'value of key1 => {{ key1 }}'
- debug:
msg: 'value of key2 => {{ key2 }}'
- debug:
msg: 'result of the test [key1 is string] => {{ key1 is string }}'
- debug:
msg: 'result of the test [(key1 | length) > 0] => {{ (key1 | length) > 0 }}'
- debug:
msg: 'result of the test [key2 is string] => {{ key2 is string }}'
- debug:
msg: 'result of the test [(key2 | length) > 0] => {{ (key2 | length) > 0 }}'

EXPECTED RESULTS

According to me, the expected result should be:

### Warning this is not the real case. ###
~$ ansible-playbook --ask-vault-pass /tmp/playbook.yaml
Vault password:

PLAY [localhost] ****************************************************************

TASK [debug] ********************************************************************
ok: [localhost] => {
"msg": "value of key1 => abcdef"
}

TASK [debug] ********************************************************************
ok: [localhost] => {
"msg": "value of key2 => abcedf"
}

TASK [debug] ********************************************************************
ok: [localhost] => {
"msg": "result of the test [key1 is string] => True"
}

TASK [debug] ********************************************************************
ok: [localhost] => {
"msg": "result of the test [(key1 | length) > 0] => True"
}

TASK [debug] ********************************************************************
ok: [localhost] => {
"msg": "result of the test [key2 is string] => True" ### [1] ###
}

TASK [debug] ********************************************************************
ok: [localhost] => {
"msg": "result of the test [(key2 | length) > 0] => True" ### [2] ###
}

PLAY RECAP **********************************************************************
localhost : ok=6 changed=0 unreachable=0 failed=0

See carefully the tasks with the mention ### [1] ### and ### [2] ###. The result is different is the real case below.

ACTUAL RESULTS

But the result is:

### Here is the real case. ###
~$ ansible-playbook --ask-vault-pass /tmp/playbook.yaml
Vault password:

PLAY [localhost] ****************************************************************

TASK [debug] ********************************************************************
ok: [localhost] => {
"msg": "value of key1 => abcdef"
}

TASK [debug] ********************************************************************
ok: [localhost] => {
"msg": "value of key2 => abcedf"
}

TASK [debug] ********************************************************************
ok: [localhost] => {
"msg": "result of the test [key1 is string] => True"
}

TASK [debug] ********************************************************************
ok: [localhost] => {
"msg": "result of the test [(key1 | length) > 0] => True"
}

TASK [debug] ********************************************************************
ok: [localhost] => {
"msg": "result of the test [key2 is string] => False" ### [1] ###
}

TASK [debug] ********************************************************************
fatal: [localhost]: FAILED! => {"msg": "Unexpected templating type error occurred
on (result of the test [(key2 | length) > 0] => {{ (key2 | length) > 0 }}): object of type
'AnsibleVaultEncryptedUnicode' has no len()"}
to retry, use: --limit @/tmp/playbook.retry ### [2] ###

PLAY RECAP **********************************************************************
localhost : ok=5 changed=0 unreachable=0 failed=1

There are differences in the 2 last tasks.

Regards.

Issue 2:
ISSUE TYPE

Bug Report

COMPONENT NAME

vault

ANSIBLE VERSION

devel

CONFIGURATION

OS / ENVIRONMENT

SUMMARY

A single vault encrypted value does not get decrypted in a jinja2 pipeline.

STEPS TO REPRODUCE

Don't worry the below vault data is just useless strings.

---
- hosts: localhost
gather_facts: false
vars:
the_password: !vault |
$ANSIBLE_VAULT;1.1;AES256
66653436353263336535316333313533666563386463623562396234313064643430323066626538
3234393066313964393861613431313832306439383633340a653361636537303033313137613933
33653333633139353736636332333237613761636430356665383839663164363739323337643333
6466313434306462370a663539346162623836626165343830666536646631616165636438646639
6134
tasks:
- command: 'echo {{ the_password|string|type_debug }}'

This outputs:

"stdout": "AnsibleVaultEncryptedUnicode"

This is a little bit of a contrived example, but what it shows, is that if you want to do something like:

- command: "some_command {{ the_password|quote }}"

You will end up with the $ANSIBLE_VAULT;... string instead of the decrypted value

EXPECTED RESULTS

ACTUAL RESULTS