Follow-up to this Q&A.
According to this and this documentation it should be possible to define a default vault password file by specifying
vault_password_file = ~/.vault_pass.txt in one of the following files:
* ANSIBLE_CONFIG (an environment variable) * ansible.cfg (in the current directory) * .ansible.cfg (in the home directory) * /etc/ansible/ansible.cfg
Although the password file exists and the log indicates that the ansible.cfg is used that contains the definition, the decryption fails:
user@host$ Using /etc/ansible/ansible.cfg as config file ERROR! Decryption failed on /path/to/ansible/group_vars/production/vault
Is the pass correct for this vault?
Yes. When ansible is run using
--vault-password-file=~/.vault_pass.txt the decryption succeeds.
Just so that we're clear - the name of the environment variable is
No. When this variable is used it works, but the aim is to set it in the ansible.cfg by setting
What Ansible version is used?
user@host:/dir$ ansible --version ansible 22.214.171.124 config file = /etc/ansible/ansible.cfg configured module search path = Default w/o overrides
Does using a full path in the config works?
The decryption failes as well when the full path instead of
/home/user/.vault_pass.txt was specified.