Repository: ansible/ansible

Issue:
2.3.1.0: vault files with .vault extension are ignored
##### ISSUE TYPE
 - Bug Report

##### COMPONENT NAME
vault

##### ANSIBLE VERSION
<!--- Paste verbatim output from “ansible --version” between quotes below -->
```
ansible 2.3.1.0
  config file = /home/me/ansible/ansible.cfg
  configured module search path = Default w/o overrides
  python version = 2.7.13 (default, Jan 18 2017, 13:55:35) [GCC 6.3.0 20161229]
```

##### CONFIGURATION
 - ```vault_password_file = path-to-vault-key```

##### OS / ENVIRONMENT
Debian Stretch

##### SUMMARY
Vault files with the extension ```.vault``` are no longer picked up. This worked on 2.3.0.0 and earlier versions.

##### STEPS TO REPRODUCE
* Create the following directory hierachy:
```
host_vars/hostname
├── vars.yml
└── vars.yml.vault
```
* The file ```vars.yml``` contains public configuration bits and references secret configuration bits in ```vars.yml.vault```.
* Running with ansible 2.3.1.0 leads to an **AnsibleUndefinedVariable**
* Running with ansible 2.3.0.0 works

Renaming ```vars.yml.vault``` to ```vault.yml``` works on 2.3.1.0.

##### EXPECTED RESULTS
Ansible 2.3.1.0 should pick up the content in the file ```vars.yml.vault``` just as 2.3.0.0 and earlier versions did.

##### ACTUAL RESULTS
The content of the vault file is not read and leads to an **AnsibleUndefinedVariable** error.



Discussion:
This is probably consequence of a bug fix, There was always a filter to determine 'valid YAML files', but it was incorrectly taking 'any' extension, the list went from :
```
YAML_FILENAME_EXTENSIONS = ["", ".yml", ".yaml", ".json"]
```
to
```
YAML_FILENAME_EXTENSIONS = [".yml", ".yaml", ".json"]
```
As the 'empty' entry matched 'any/all' extensions, now we specifically check for 'no extension' instead, `.vault` was never meant to be an 'allowed extension'.

> As the 'empty' entry matched 'any/all' extensions, now we specifically check for 'no extension' instead, .vault was never meant to be an 'allowed extension'.

Thanks a lot for the explanation. I'd like to somehow distinguish a vault file from a valid YAML file and using the extension '.vault' worked for me. There are at least two reasons why I'd like to distinguish them:
* Vault files are no YAML files, thus the YAML extension is misleading.
* Non-YAML files automatically get ignored by linters such as yamllint.
This issue just bit us as well. :) I agree with @nblock that encrypted yaml variable files are not "yaml" files and a non "yml/yaml" extension makes sense. We have setup vault file git diffing and need a way to distinguish between a vault encrypted file and a normal yaml file.

Something like: https://selivan.github.io/2016/11/29/ansible-human-readable-git-diff-for-vault.html
A work around could be to use an extension like ".vault.yml" as per the blog post I linked to.

Resolving patch:
diff --git a/lib/ansible/constants.py b/lib/ansible/constants.py
--- a/lib/ansible/constants.py
+++ b/lib/ansible/constants.py
@@ -76,4 +76,3 @@ def mk_boolean(value):
 TREE_DIR = None
 VAULT_VERSION_MIN = 1.0
 VAULT_VERSION_MAX = 1.0
-YAML_FILENAME_EXTENSIONS = [".yml", ".yaml", ".json"]  # check all of these extensions when looking for 'variable' files which should be YAML or JSON.


Test patch: