jinja2_native & ansible-vault encrypted strings

inventory.yaml

---
ungrouped:
  hosts:
    localhost:
      ansible_connection: local
      ansible_python_interpreter: /usr/bin/python2

jinja2native_with_vaulted.playbook.yaml

---
- name: Test a vaulted var with the group module
  hosts: localhost
  vars:
    # identity is cognifloyd
    # pass is cognifloyd
    # users_group_name = users
    users_group_name: !vault |
      $ANSIBLE_VAULT;1.2;AES256;cognifloyd
      65643139313136626331386265313132376530366636653337643834636634313261333133666631
      3362633463373636613431363564633563376532396335390a306239626564653965353062396332
      35393663316536313761663033663063323337636262316331346137626363316639353730666537
      6364353137643034350a316261383766316235303634346164343730633539323331346362656363
      6463
  tasks:
    - debug:
        msg: "{{ users_group_name | type_debug }}|{{ users_group_name }}"
    
    - name: echo the string
      shell: "echo {{ users_group_name }}"
    
    - name: Add a group where the name comes from an inline vault encrypted string
      become: yes
      group:
        name: "{{ users_group_name }}"

no_native_passes_ansible.cfg

[inventory]
enable_plugins = host_list,yaml

[defaults]
inventory=inventory.yaml
vault_identity_list = cognifloyd@prompt
host_key_checking = False
jinja2_native = False

no_native_passes_output

$ ansible-playbook jinja2native_with_vaulted.playbook.yaml --ask-become-pass -vvv
ansible-playbook 2.7.1
  config file = /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/ansible.cfg
  configured module search path = [u'/home/cognifloyd/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible
  executable location = /home/cognifloyd/v/st2/bin/ansible-playbook
  python version = 2.7.15 (default, Sep 30 2018, 15:08:44) [GCC 6.4.0]
Using /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/ansible.cfg as config file
SUDO password: 
Vault password (cognifloyd): 
/home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/inventory.yaml did not meet host_list requirements, check plugin documentation if this is unexpected
Parsed /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/inventory.yaml inventory source with yaml plugin
 ___________________________________________________ 
< PLAYBOOK: jinja2native_with_vaulted.playbook.yaml >
 --------------------------------------------------- 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

1 plays in jinja2native_with_vaulted.playbook.yaml
 _________________________________________________ 
< PLAY [Test a vaulted var with the group module] >
 ------------------------------------------------- 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

 ________________________ 
< TASK [Gathering Facts] >
 ------------------------ 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

task path: /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/jinja2native_with_vaulted.playbook.yaml:2
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: cognifloyd
<localhost> EXEC /bin/sh -c 'echo ~cognifloyd && sleep 0'
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739188.19-54366659803067 `" && echo ansible-tmp-1542739188.19-54366659803067="` echo /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739188.19-54366659803067 `" ) && sleep 0'
Using module file /home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible/modules/system/setup.py
<localhost> PUT /home/cognifloyd/.ansible/tmp/ansible-local-5853Kiq8yK/tmpF8N3Hj TO /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739188.19-54366659803067/AnsiballZ_setup.py
<localhost> EXEC /bin/sh -c 'chmod u+x /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739188.19-54366659803067/ /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739188.19-54366659803067/AnsiballZ_setup.py && sleep 0'
<localhost> EXEC /bin/sh -c '/usr/bin/python2 /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739188.19-54366659803067/AnsiballZ_setup.py && sleep 0'
<localhost> EXEC /bin/sh -c 'rm -f -r /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739188.19-54366659803067/ > /dev/null 2>&1 && sleep 0'
ok: [localhost]
META: ran handlers
 ______________ 
< TASK [debug] >
 -------------- 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

task path: /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/jinja2native_with_vaulted.playbook.yaml:16
ok: [localhost] => {
    "msg": "AnsibleVaultEncryptedUnicode|users"
}
 ________________________ 
< TASK [echo the string] >
 ------------------------ 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

task path: /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/jinja2native_with_vaulted.playbook.yaml:19
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: cognifloyd
<localhost> EXEC /bin/sh -c 'echo ~cognifloyd && sleep 0'
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739189.94-72986395716374 `" && echo ansible-tmp-1542739189.94-72986395716374="` echo /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739189.94-72986395716374 `" ) && sleep 0'
Using module file /home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible/modules/commands/command.py
<localhost> PUT /home/cognifloyd/.ansible/tmp/ansible-local-5853Kiq8yK/tmpSgulwj TO /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739189.94-72986395716374/AnsiballZ_command.py
<localhost> EXEC /bin/sh -c 'chmod u+x /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739189.94-72986395716374/ /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739189.94-72986395716374/AnsiballZ_command.py && sleep 0'
<localhost> EXEC /bin/sh -c '/usr/bin/python2 /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739189.94-72986395716374/AnsiballZ_command.py && sleep 0'
<localhost> EXEC /bin/sh -c 'rm -f -r /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739189.94-72986395716374/ > /dev/null 2>&1 && sleep 0'
changed: [localhost] => {
    "changed": true, 
    "cmd": "echo users", 
    "delta": "0:00:00.002896", 
    "end": "2018-11-20 12:39:50.197524", 
    "invocation": {
        "module_args": {
            "_raw_params": "echo users", 
            "_uses_shell": true, 
            "argv": null, 
            "chdir": null, 
            "creates": null, 
            "executable": null, 
            "removes": null, 
            "stdin": null, 
            "warn": true
        }
    }, 
    "rc": 0, 
    "start": "2018-11-20 12:39:50.194628", 
    "stderr": "", 
    "stderr_lines": [], 
    "stdout": "users", 
    "stdout_lines": [
        "users"
    ]
}
 _____________________________________________________________ 
/ TASK [Add a group where the name comes from an inline vault \
\ encrypted string]                                           /
 ------------------------------------------------------------- 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

task path: /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/jinja2native_with_vaulted.playbook.yaml:22
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: cognifloyd
<localhost> EXEC /bin/sh -c 'echo ~cognifloyd && sleep 0'
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739190.42-123423391923394 `" && echo ansible-tmp-1542739190.42-123423391923394="` echo /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739190.42-123423391923394 `" ) && sleep 0'
Using module file /home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible/modules/system/group.py
<localhost> PUT /home/cognifloyd/.ansible/tmp/ansible-local-5853Kiq8yK/tmp1oiV9n TO /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739190.42-123423391923394/AnsiballZ_group.py
<localhost> EXEC /bin/sh -c 'chmod u+x /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739190.42-123423391923394/ /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739190.42-123423391923394/AnsiballZ_group.py && sleep 0'
<localhost> EXEC /bin/sh -c 'sudo -H -S  -p "[sudo via ansible, key=jxnshrrcovbmkilvinuazcqhmrgfiyie] password: " -u root /bin/sh -c '"'"'echo BECOME-SUCCESS-jxnshrrcovbmkilvinuazcqhmrgfiyie; /usr/bin/python2 /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739190.42-123423391923394/AnsiballZ_group.py'"'"' && sleep 0'
<localhost> EXEC /bin/sh -c 'rm -f -r /home/cognifloyd/.ansible/tmp/ansible-tmp-1542739190.42-123423391923394/ > /dev/null 2>&1 && sleep 0'
ok: [localhost] => {
    "changed": false, 
    "gid": 100, 
    "invocation": {
        "module_args": {
            "gid": null, 
            "local": false, 
            "name": "users", 
            "state": "present", 
            "system": false
        }
    }, 
    "name": "users", 
    "state": "present", 
    "system": false
}
META: ran handlers
META: ran handlers
 ____________ 
< PLAY RECAP >
 ------------ 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

localhost                  : ok=4    changed=1    unreachable=0    failed=0   

with_native_fails_ansible.cfg

[inventory]
enable_plugins = host_list,yaml

[defaults]
inventory=inventory.yaml
vault_identity_list = cognifloyd@prompt
host_key_checking = False
jinja2_native = True

with_native_fails_output

$ ansible-playbook jinja2native_with_vaulted.playbook.yaml --ask-become-pass -vvv
ansible-playbook 2.7.1
  config file = /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/ansible.cfg
  configured module search path = [u'/home/cognifloyd/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible
  executable location = /home/cognifloyd/v/st2/bin/ansible-playbook
  python version = 2.7.15 (default, Sep 30 2018, 15:08:44) [GCC 6.4.0]
Using /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/ansible.cfg as config file
SUDO password: 
Vault password (cognifloyd): 
/home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/inventory.yaml did not meet host_list requirements, check plugin documentation if this is unexpected
Parsed /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/inventory.yaml inventory source with yaml plugin
 ___________________________________________________ 
< PLAYBOOK: jinja2native_with_vaulted.playbook.yaml >
 --------------------------------------------------- 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

1 plays in jinja2native_with_vaulted.playbook.yaml
 _________________________________________________ 
< PLAY [Test a vaulted var with the group module] >
 ------------------------------------------------- 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

 ________________________ 
< TASK [Gathering Facts] >
 ------------------------ 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

task path: /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/jinja2native_with_vaulted.playbook.yaml:2
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: cognifloyd
<localhost> EXEC /bin/sh -c 'echo ~cognifloyd && sleep 0'
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738689.12-184851584127715 `" && echo ansible-tmp-1542738689.12-184851584127715="` echo /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738689.12-184851584127715 `" ) && sleep 0'
Using module file /home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible/modules/system/setup.py
<localhost> PUT /home/cognifloyd/.ansible/tmp/ansible-local-3531zIiM2G/tmp8q5jhm TO /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738689.12-184851584127715/AnsiballZ_setup.py
<localhost> EXEC /bin/sh -c 'chmod u+x /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738689.12-184851584127715/ /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738689.12-184851584127715/AnsiballZ_setup.py && sleep 0'
<localhost> EXEC /bin/sh -c '/usr/bin/python2 /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738689.12-184851584127715/AnsiballZ_setup.py && sleep 0'
<localhost> EXEC /bin/sh -c 'rm -f -r /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738689.12-184851584127715/ > /dev/null 2>&1 && sleep 0'
ok: [localhost]
META: ran handlers
 ______________ 
< TASK [debug] >
 -------------- 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

task path: /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/jinja2native_with_vaulted.playbook.yaml:16
ok: [localhost] => {
    "msg": "AnsibleVaultEncryptedUnicode|users"
}
 ________________________ 
< TASK [echo the string] >
 ------------------------ 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

task path: /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/jinja2native_with_vaulted.playbook.yaml:19
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: cognifloyd
<localhost> EXEC /bin/sh -c 'echo ~cognifloyd && sleep 0'
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738691.36-1813479650254 `" && echo ansible-tmp-1542738691.36-1813479650254="` echo /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738691.36-1813479650254 `" ) && sleep 0'
Using module file /home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible/modules/commands/command.py
<localhost> PUT /home/cognifloyd/.ansible/tmp/ansible-local-3531zIiM2G/tmpTxVdDW TO /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738691.36-1813479650254/AnsiballZ_command.py
<localhost> EXEC /bin/sh -c 'chmod u+x /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738691.36-1813479650254/ /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738691.36-1813479650254/AnsiballZ_command.py && sleep 0'
<localhost> EXEC /bin/sh -c '/usr/bin/python2 /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738691.36-1813479650254/AnsiballZ_command.py && sleep 0'
<localhost> EXEC /bin/sh -c 'rm -f -r /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738691.36-1813479650254/ > /dev/null 2>&1 && sleep 0'
changed: [localhost] => {
    "changed": true, 
    "cmd": "echo users", 
    "delta": "0:00:00.003285", 
    "end": "2018-11-20 12:31:31.612473", 
    "invocation": {
        "module_args": {
            "_raw_params": "echo users", 
            "_uses_shell": true, 
            "argv": null, 
            "chdir": null, 
            "creates": null, 
            "executable": null, 
            "removes": null, 
            "stdin": null, 
            "warn": true
        }
    }, 
    "rc": 0, 
    "start": "2018-11-20 12:31:31.609188", 
    "stderr": "", 
    "stderr_lines": [], 
    "stdout": "users", 
    "stdout_lines": [
        "users"
    ]
}
 _____________________________________________________________ 
/ TASK [Add a group where the name comes from an inline vault \
\ encrypted string]                                           /
 ------------------------------------------------------------- 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

task path: /home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/jinja2native_with_vaulted.playbook.yaml:22
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: cognifloyd
<localhost> EXEC /bin/sh -c 'echo ~cognifloyd && sleep 0'
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738691.82-173184760675465 `" && echo ansible-tmp-1542738691.82-173184760675465="` echo /home/cognifloyd/.ansible/tmp/ansible-tmp-1542738691.82-173184760675465 `" ) && sleep 0'
The full traceback is:
Traceback (most recent call last):
  File "/home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible/executor/task_executor.py", line 139, in run
    res = self._execute()
  File "/home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible/executor/task_executor.py", line 603, in _execute
    result = self._handler.run(task_vars=variables)
  File "/home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible/plugins/action/normal.py", line 46, in run
    result = merge_hash(result, self._execute_module(task_vars=task_vars, wrap_async=wrap_async))
  File "/home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible/plugins/action/__init__.py", line 738, in _execute_module
    (module_style, shebang, module_data, module_path) = self._configure_module(module_name=module_name, module_args=module_args, task_vars=task_vars)
  File "/home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible/plugins/action/__init__.py", line 177, in _configure_module
    environment=final_environment)
  File "/home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible/executor/module_common.py", line 972, in modify_module
    environment=environment)
  File "/home/cognifloyd/v/st2/lib/python2.7/site-packages/ansible/executor/module_common.py", line 742, in _find_module_utils
    python_repred_params = repr(json.dumps(params))
  File "/usr/lib64/python2.7/json/__init__.py", line 244, in dumps
    return _default_encoder.encode(obj)
  File "/usr/lib64/python2.7/json/encoder.py", line 207, in encode
    chunks = self.iterencode(o, _one_shot=True)
  File "/usr/lib64/python2.7/json/encoder.py", line 270, in iterencode
    return _iterencode(o, 0)
  File "/usr/lib64/python2.7/json/encoder.py", line 184, in default
    raise TypeError(repr(o) + " is not JSON serializable")
TypeError: u'users' is not JSON serializable

fatal: [localhost]: FAILED! => {
    "msg": "Unexpected failure during module execution.", 
    "stdout": ""
}
        to retry, use: --limit @/home/cognifloyd/p/theatro-ansiblehost/ansible-playbooks.git/test/vault-test-case/jinja2native_with_vaulted.playbook.retry
 ____________ 
< PLAY RECAP >
 ------------ 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

localhost                  : ok=3    changed=1    unreachable=0    failed=1