Issue 1:
ISSUE TYPE

Bug Report

COMPONENT NAME

vault

ANSIBLE VERSION

ansible 2.4.2.0

CONFIGURATION

Default

OS / ENVIRONMENT

Ubuntu 16.04

SUMMARY

Passing encrypted variables through to_yaml results in variable not being decrypted.

... through to_json results in

"msg": "Unexpected templating type error occurred on ({{ encrypted_var | to_json }}): 'decrypted_secret' is not JSON serializable"

STEPS TO REPRODUCE

See tests added here: paulbovbel@25a3ee9

EXPECTED RESULTS

Expected tests to pass.

ACTUAL RESULTS

# ansible-test integration vault

TASK [test_vault_embedded : Assert that a embedded vault of a string with no newline works with to_yaml] **************************************************
fatal: [testhost]: FAILED! => {
"assertion": "\"!vault |\n $ANSIBLE_VAULT;1.1;AES256\n 33363965326261303234626463623963633531343539616138316433353830356566396130353436\n 3562643163366231316662386565383735653432386435610a306664636137376132643732393835\n 63383038383730306639353234326630666539346233376330303938323639306661313032396437\n 6233623062366136310a633866373936313238333730653739323461656662303864663666653563\n 3138\n\" == \"Setec Astronomy\n...\n\"",
"changed": false,
"evaluated_to": false
}
...ignoring

TASK [test_vault_embedded : Assert that a multi line embedded vault works with to_yaml, including new line] ***********************************************
fatal: [testhost]: FAILED! => {
"assertion": "vault_encrypted_var | to_yaml == decrypted_var | to_yaml",
"changed": false,
"evaluated_to": false
}
...ignoring

TASK [test_vault_embedded : Assert that a embedded vault of a string with no newline works with to_yaml] **************************************************
fatal: [testhost]: FAILED! => {"msg": "Unexpected templating type error occurred on (\"{{ vault_encrypted_one_line_var | to_json }}\" == \"{{ decrypted_one_line_var | to_json }}\"): u'Setec Astronomy' is not JSON serializable"}
...ignoring

TASK [test_vault_embedded : Assert that a multi line embedded vault works with to_yaml, including new line] ***********************************************
fatal: [testhost]: FAILED! => {
"assertion": "vault_encrypted_var == decrypted_var | to_json",
"changed": false,
"evaluated_to": false
}

Issue 2:
ISSUE TYPE

Bug Report

COMPONENT NAME

vault

ANSIBLE VERSION

devel

CONFIGURATION

OS / ENVIRONMENT

SUMMARY

A single vault encrypted value does not get decrypted in a jinja2 pipeline.

STEPS TO REPRODUCE

Don't worry the below vault data is just useless strings.

---
- hosts: localhost
gather_facts: false
vars:
the_password: !vault |
$ANSIBLE_VAULT;1.1;AES256
66653436353263336535316333313533666563386463623562396234313064643430323066626538
3234393066313964393861613431313832306439383633340a653361636537303033313137613933
33653333633139353736636332333237613761636430356665383839663164363739323337643333
6466313434306462370a663539346162623836626165343830666536646631616165636438646639
6134
tasks:
- command: 'echo {{ the_password|string|type_debug }}'

This outputs:

"stdout": "AnsibleVaultEncryptedUnicode"

This is a little bit of a contrived example, but what it shows, is that if you want to do something like:

- command: "some_command {{ the_password|quote }}"

You will end up with the $ANSIBLE_VAULT;... string instead of the decrypted value

EXPECTED RESULTS

ACTUAL RESULTS