Eventually I just got rid of the group_vars all together.
I specified a new role that includes several other roles with 'include_role:' and added the vars directly to those roles with inline-vault variables:
- name: include ipaclient
my_password: !vault |
I found an issue with Ansible/Python causing a failure to decrypt.
Specifically, Ansible 2.7.10 and 2.7.13 under Python 3.6.8 on Ubuntu 18.04 would not decrypt (using ansible-vault edit -vvvvv) a vault file that was identical to file that decrypted OK on macOS 10.13 using Python 3.7.2 with same Ansible versions.
Upgrading to Python 3.7.3 on Ubuntu (using ...