Vagrant up fails if vault.yml is encrypted

trellis
1

default: Running ansible-playbook…
ERROR! Decryption failed
Ansible failed to complete successfully. Any error output should be
visible above. Please fix these errors and try again.

I don’t see any errors above that.

  • .vault_pass in the same directory as ansible.cfg

  • I decrypted vault.yml using the password from .vault_pass

  • I ran vagrant up with vault.yml decrypted vagrant is bringing up the machine now.

2

I’ve ran into a few weird issues with both Vagrant + Vault and Vault in general.

Does it work when you do vagrant up --ask-vault-pass?

3

Thanks Ben. I discovered I forgot to add vault_password_file = .vault_pass in the ansible.cfg file

That seems to fix the decrypt error. I am still getting an one error Do not run Composer as root/super user! Edit: The solution to the composer issue is in fullyint’s answer here

vagrant up --ask-vault-pass returns an error for me

An invalid option was specified. The help for this command
is available below.

Usage: vagrant up [options] [name|id]

Options:

    --[no-]provision             Enable or disable provisioning
    --provision-with x,y,z       Enable only certain provisioners, by type or by name.
    --[no-]destroy-on-error      Destroy machine if any fatal error happens (default to true)
    --[no-]parallel              Enable or disable parallelism if provider supports it
    --provider PROVIDER          Back the machine with a specific provider
    --[no-]install-provider      If possible, install the provider if it isn't installed
-h, --help                       Print this help
4

If you wanted to manually prompt for the vault password, I think you would run the command as part of your playbook after a vagrant up

You would need to remove vault_password_file = .vault_pass from your ansible.cfg file. Your vagrant up would then fail at the decryption and you can run ansible-playbook dev.yml --ask-vault-pass which will prompt you to enter the password.

However, if vault_password_file = .vault_pass isn’t working, it’s likely a configuration or password issue that entering the password manually wouldn’t solve.

1 Like
5

This topic is old, but for some reason I just recently got this error and was searching for ways to fix it. I did pull in some updates from trellis so maybe that did it. I wanted to update for anyone else who might get this error as well.

I am avoiding having a file with the vault password, so I use --ask-vault-pass on all my ansible commands. vagrant up fails with permission denied because it could not decrypt the vault.

For me, adding ansible.ask_vault_pass = true in Vagrantfile worked. So, lines 106 and 107 in Vagrantfile now look like this:

ansible.playbook = File.join(provisioning_path, 'dev.yml')
ansible.ask_vault_pass = true

Nothing else mentioned in the thread worked for me, probably because I’m using --ask-vault-pass rather than a vault password file. I always hate finding the issue talked about but no solution posted, so I wanted to post this update here for those who may also have this issue because of this.

2 Likes
6

I am getting this same issue. Thinking this is an update side-effect of some kind, as I haven’t touched this project in a minute. I am on Ansible 2.2.1.0

7

Just to follow up with my own post here – I was having an issue with vault pass. Chalk it up to user error :slight_smile: