Unable to retrieve vault secrets in Ansible

I have trouble to read the secrets from vault using the VMware dynamic inventory files.

Inventory:
https://github.com/ansible/ansible/blob/devel/contrib/inventory/vmware_inventory.ini (using it as vmware.yml in my Ansible directory structure)
https://github.com/ansible/ansible/blob/devel/contrib/inventory/vmware_inventory.py

Updated few lines in the dynamic inventory script (vmware_inventory.py -#L213) to read the vars -

'ini_path': os.path.join(os.path.dirname(__file__), '../group_vars/vmware/vmware.yml'),

Ansible directory structure:

ansible/
  inventory/
    vmware_inventory.py
  group_vars/
    all_vars.yml                 
    vmware/
     vmware.yml
     vault.yml                    
  roles/

I can able to ping all hosts in using - ansible all -i vmware_inventory.py -m ping

Trial A:
Encrypt the password value using ansible-vault encrypt_string password123 --name 'password' --ask-vault-pass. Update the vmware.yml with encrypted password .

cat vmware.yml

server: vcsa.lab
port: 443
username: devuser
password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          62616231653730653366633966626531383362323165643034336533356165626166313466396462
          3866363332663963366231636230646465363530666366320a346539343366663135353639646234
          65363163386136636662356534343430663133313865333731336230373437663230356361373363
          3434633132343731370a393139383464306432626638633837333030623539653462343230373562
          6433
validate_certs: False

Error:

vmware_inventory.py) had an execution error: Unable to connect to ESXi server due to (vim.fault.InvalidLogin) { dynamicType = , dynamicProperty = (vmodl.DynamicProperty) [], msg = 'Cannot complete login due to an incorrect user name or password.', faultCause = , faultMessage = (vmodl.LocalizableMessage) [] }

Trial B: Following this link
Create ansible vault file (ansible-vault create ../group_vars/vmware/vault) and add as a plain text and read that value in the vmware.yml

cat vmware.yml

server: vcsa.lab
port: 443
username: dev
password: "{{ vault_password}}"
validate_certs: False

still fails with same error

Cannot complete login due to an incorrect user name or password.

But I can able to run the same command with plain text without encrypting the password using vault.

Env:

 ansible 2.7.0
      python version = 3.6.0 (v3.6.0:41df79263a11, Dec 22 2016, 17:23:13) [GCC 4.2.1 (Apple Inc. build 5666) (dot 3)]

Anyone can able to help to find where it's going wrong? really appreciate your help!

Solution

If I read it correctly, you are using a vaulted file in group_vars and you also have some variables defined in your inventory file. If that is the case, in ansible, inventory file vars are above group_vars in precedence and chances are that your vaulted variable gets overridden by the value in Inventory. Here is a link with the correct order

Best practice is to always set variable names as unique so that you don't run into conflicting scenarios.

You could troubleshoot by using a debug task to see what is the value of that var.

ansible <name-of-your-target-host> -i vmware_inventory.py -m debug -a "msg={{ password }}"

You should run the above on target host so that group_vars/host_vars are taken into account.

Hope it helps!