Issue 1:
ISSUE TYPE

Bug Report

COMPONENT NAME

ansible-vault

ANSIBLE VERSION

ansible 2.3.0.0
config file =
configured module search path = Default w/o overrides
python version = 2.7.13 (default, Dec 18 2016, 07:03:39) [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.42.1)]

CONFIGURATION

n/a

OS / ENVIRONMENT

Have reproduced this on latest OS X and CentOS 6.8 Docker image

SUMMARY

ansible-vault is no longer using the - argument for --output. Based on the output, it seems like it thinks the - is the literal name of the output file.

STEPS TO REPRODUCE

echo myPassword | ansible-vault encrypt --output=-

EXPECTED RESULTS

On < 2.3, the following output is seen:

Vault password:
$ANSIBLE_VAULT;1.1;AES256
32663537353138656134386139666466306466316530653432353734386632343531663132636539
3635303239373734303161613630663163613264303730350a633466376433363934356534326464
32663736393037313830316336363339633235383464313030653264613833386664346130363934
3234346139656432300a633738383737623162313930663462636665353332376265633361356336
6565
Encryption successful

ACTUAL RESULTS

On 2.3, the following output is seen:

New Vault password:
Confirm New Vault password:
ERROR! [Errno 2] No such file or directory: '/Users/rchsu/cwd/-'

Issue 2:
ISSUE TYPE

Bug Report

COMPONENT NAME

ansible-vault

ANSIBLE VERSION

→ ansible --version
ansible 2.2.1.0
config file =
configured module search path = Default w/o overrides

CONFIGURATION

I have no unique configuration

OS / ENVIRONMENT

OS X El Capitan 10.11.6

SUMMARY

If the first/only file I encrypt via ansible-vault is a json file (the json credentails downloaded from GCE for a service account), then ansible-playbook will not prompt for a vault password and --ask-vault-pass is not required to run a playbook successfully.

STEPS TO REPRODUCE

I imagine this could work similar with anything that involves a json file, but here is what I did.

Download a GCE credentials .json file (I imagine this would work with aws or anything that uses json?).

Move it to be group_vars/devboxes/credentials.json

Create the create_vm.yml playbook below and the group_vars/devboxes/vars.yml listed below.

Run the playbook at least once successfully ansible-playbook create_vm.yml before encrypting.

When I tried this on another machine, it failed until I ran the playbook once with a decrypted creds.json, but then after encrypting the below behavior still occurred)

ansible-vault encrypt group_vars/devboxes/credentials.json

Run the playbook again the same as in step 4

Note that --ask-vault-pass was not required, but the decryption still occurred.

(Optional) If you modify the credentials.json file (after decrypting it) and then re-encrypt it, the playbook will fail. So it doesn't seem to be storing a cached file anywhere, it just does not seem to recognize this playbook as requiring a password.

# create_vm.yml playbook
- hosts: localhost
connection: local
vars_files:
- "group_vars/devboxes/vars.yml"
gather_facts: False
tasks:
- name: "Creating virtual machine"
gce:
instance_names: my-test-instance1
zone: us-central1-a
machine_type: g1-small
image: debian-8
state: present
service_account_email: "{{ gce_service_account_email }}"
credentials_file: "{{ gce_credentials_file }}"
project_id: "{{ gce_project_id }}"
register: gce

# group_vars/devboxes/vars.yml
devboxes_gce_project_id: <GCE_PROJECT_ID>
devboxes_gce_service_account_email: <GCE_SERVICE_EMAIL>
devboxes_gce_credentials_file: "{{ playbook_dir }}/group_vars/devboxes/credentials.json"

EXPECTED RESULTS

I expected to ansible to give me a warning that a file was not decrypted, and require a password prompt or password file.

ACTUAL RESULTS

I was not prompted for a password and the play completed successfully.

→ ansible-vault encrypt group_vars/devboxes/creds.json
Vault password:
Encryption successful

→ ansible-playbook create_vm.yml

PLAY [localhost] ***************************************************************

TASK [Actually creating machine] ***********************************************
changed: [localhost]

PLAY RECAP *********************************************************************
localhost : ok=1 changed=1 unreachable=0 failed=0