Issue 1:
I've seen other similar posts, but I they seem not to apply to me. The role in question worked fine in 2.2.

ISSUE TYPE

Bug Report

COMPONENT NAME

Loop

ANSIBLE VERSION

ansible 2.3.0.0
config file = /etc/ansible/ansible.cfg
configured module search path = Default w/o overrides
python version = 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609]

CONFIGURATION

[defaults]

host_key_checking = False
ansible_managed = DO NOT MODIFY by hand. This file is under control of Ansible on {host}.
vault_password_file = /var/lib/semaphore/.vpf

OS / ENVIRONMENT

N/A

SUMMARY

When trying to create a list of users, it throws the an error about an invalid value error.

STEPS TO REPRODUCE

I am running this task

This is the task I am trying to run.

- name: create user
user:
name: "{{ item.username }}"
password: "{{ item.password|default(omit) }}"
shell: /bin/bash
become: true
with_items: '{{ users }}'
no_log: true

This is the users variable. I have truncated the vault values for brevity.

users:
- username: ptadmin
password: !vault-encrypted |
$ANSIBLE_VAULT;1.1;AES256
...
use_sudo: true
use_ssh: false

- username: ansibleremote
password: "{{ petra_ansibleremote_password }}"
use_sudo: true
use_ssh: true
public_key: !vault-encrypted |
$ANSIBLE_VAULT;1.1;AES256
...

- username: semaphore
password: "{{ petra_ansibleremote_password }}"
use_sudo: true
use_ssh: true

- username: frosty
password: !vault-encrypted |
$ANSIBLE_VAULT;1.1;AES256
...
use_sudo: true
use_ssh: true
public_key: !vault-encrypted |
$ANSIBLE_VAULT;1.1;AES256
...

- username: thebeardedone
password: !vault-encrypted |
$ANSIBLE_VAULT;1.1;AES256
...
use_sudo: true
use_ssh: true
public_key: !vault-encrypted |
$ANSIBLE_VAULT;1.1;AES256
...

- username: senanufc
password: !vault-encrypted |
$ANSIBLE_VAULT;1.1;AES256
...
use_sudo: true
use_ssh: true
public_key: !vault-encrypted |
$ANSIBLE_VAULT;1.1;AES256
...

I tried a debug before it and the results are in this gist.

I also tried with below and the same thing happens

- name: test loop
debug:
msg: "{{ item.username }}"
with_items: "{{ users }}"

EXPECTED RESULTS

Users created

ACTUAL RESULTS

fatal: [petra-hq-dev-master]: FAILED! => {"failed": true, "msg": "the field 'args' has an invalid value, which appears to include a variable that is undefined. The error was: 'ansible.vars.unsafe_proxy.AnsibleUnsafeText object' has no attribute 'username'\n\nThe error appears to have been in '/etc/ansible/roles/thedumbtechguy.manage-users/tasks/create_users.yml': line 6, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: create user\n ^ here\n"}
to retry, use: --limit @/var/lib/semaphore/repository_1/playbooks/setup_new_hosts.retry

Issue 2:
ISSUE TYPE

Bug Report

COMPONENT NAME

ansible-vault or jinja

ANSIBLE VERSION

ansible 2.3.0.0
config file = /etc/ansible/ansible.cfg
configured module search path = Default w/o overrides
python version = 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609]

CONFIGURATION

No special configuration

OS / ENVIRONMENT

Ubuntu 16.04

SUMMARY

When using the newly introduced single encrypted variables in lists or dictionaries these cannot be looped like expected with with_items or with_dict. The list or dictionary is somehow treated as one object and not as a "loopable" object.

STEPS TO REPRODUCE

Simple playbook containing a single encrypted variable vaulted in the list test_with_vaulted_variable. The vault password is "test" (without quotes) and the vaulted variable content is "vaulted variable".

---
- hosts: all
vars:
test_without_vaulted_variable:
- not_vaulted: not vaulted variable
- another_standard_variable: standard
test_with_vaulted_variable:
- not_vaulted: not vaulted variable
- vaulted: !vault |
$ANSIBLE_VAULT;1.1;AES256
66376230363937306331353166333731633037326166626530393462636666346630366463313134
6635313236366537346339313338633539643665313931390a373264326437663530616630623734
31666136343232666235323865653838393830613432343561633465333837633531643564343064
3237353766313835310a643963313163663632623064313034363531356330653131303833646138
65366139376134396231353864383662623832376239336433623630383464303161
tasks:
- debug: var=test_without_vaulted_variable
- debug: var=test_with_vaulted_variable
- debug:
with_items: "{{ test_without_vaulted_variable }}"
- debug:
with_items: "{{ test_with_vaulted_variable }}"

Start the play with (and enter the vault pass "test")

ansible-playbook -i 'lavego-test,' vault-with-items.yml --ask-vault-pass

EXPECTED RESULTS

The list processing should be the same for the lists test_without_vaulted_variableand test_with_vaulted_variable: The loops should output each element of each list.

ACTUAL RESULTS

The list containing the vaulted variable is not looped like expected. In the last debug statement: Note that there is only one "Hello world!" message printed instead of two, one for each element, for the list with no vaulted variable.

Note that also the normal debug output of the two lists differs (first and second debug statements) - the list containing the vaulted variable "has no structure".

$ ansible-playbook -i 'localhost,' vault-with-items.yml --ask-vault-pass
Vault password:

PLAY [all] *********************************************************************************************************************************************************************************************************

TASK [Gathering Facts] *********************************************************************************************************************************************************************************************
ok: [localhost]

TASK [debug] *******************************************************************************************************************************************************************************************************
ok: [localhost] => {
"changed": false,
"test_without_vaulted_variable": [
{
"not_vaulted": "not vaulted variable"
},
{
"another_standard_variable": "standard"
}
]
}

TASK [debug] *******************************************************************************************************************************************************************************************************
ok: [localhost] => {
"changed": false,
"test_with_vaulted_variable": "[{u'not_vaulted': u'not vaulted variable'}, {u'vaulted': AnsibleVaultEncryptedUnicode($ANSIBLE_VAULT;1.1;AES256\n66376230363937306331353166333731633037326166626530393462636666346630366463313134\n6635313236366537346339313338633539643665313931390a373264326437663530616630623734\n31666136343232666235323865653838393830613432343561633465333837633531643564343064\n3237353766313835310a643963313163663632623064313034363531356330653131303833646138\n65366139376134396231353864383662623832376239336433623630383464303161\n)}]"
}

TASK [debug] *******************************************************************************************************************************************************************************************************
ok: [localhost] => (item={u'not_vaulted': u'not vaulted variable'}) => {
"item": {
"not_vaulted": "not vaulted variable"
},
"msg": "Hello world!"
}
ok: [localhost] => (item={u'another_standard_variable': u'standard'}) => {
"item": {
"another_standard_variable": "standard"
},
"msg": "Hello world!"
}

TASK [debug] *******************************************************************************************************************************************************************************************************
ok: [localhost => (item=[{u'not_vaulted': u'not vaulted variable'}, {u'vaulted': AnsibleVaultEncryptedUnicode($ANSIBLE_VAULT;1.1;AES256
66376230363937306331353166333731633037326166626530393462636666346630366463313134
6635313236366537346339313338633539643665313931390a373264326437663530616630623734
31666136343232666235323865653838393830613432343561633465333837633531643564343064
3237353766313835310a643963313163663632623064313034363531356330653131303833646138
65366139376134396231353864383662623832376239336433623630383464303161
)}]) => {
"item": "[{u'not_vaulted': u'not vaulted variable'}, {u'vaulted': AnsibleVaultEncryptedUnicode($ANSIBLE_VAULT;1.1;AES256\n66376230363937306331353166333731633037326166626530393462636666346630366463313134\n6635313236366537346339313338633539643665313931390a373264326437663530616630623734\n31666136343232666235323865653838393830613432343561633465333837633531643564343064\n3237353766313835310a643963313163663632623064313034363531356330653131303833646138\n65366139376134396231353864383662623832376239336433623630383464303161\n)}]",
"msg": "Hello world!"
}

PLAY RECAP *********************************************************************************************************************************************************************************************************
localhost : ok=5 changed=0 unreachable=0 failed=0

Thank you for your help!