overriding options in the ansible config

Question

In my previous question, I discovered that I can put options into a local ansible.cfg file. But can I override them?

I have an ansible.cfg file that contains

[defaults]
vault_password_file = /home/hymie/ansible/foo

And I can use this file automatically:

$ echo "hi there" |  ansible-vault encrypt_string
Reading plaintext input from stdin. (ctrl-d to end input)
!vault |
          $ANSIBLE_VAULT;1.1;AES256
          64386133613865366565336365333166623538613239636464303931646330323061376239363639
          3136376163613132613130306630626365643133366664310a353030303434346336396233616363
          62323464313737663135303636646264373737393930326132386231363561653865646436313439
          3231353132643364340a316431626332626633646135613064353133633038356434323537326633
          3035
Encryption successful

But now, I am unable to use/select a different password:

$ echo "hi there" |  ansible-vault encrypt_string --ask-vault-pass
New Vault password:
Confirm New Vault password:
ERROR! Only one --vault-id can be used for encryption. This includes passwords from configuration and cli.

$ echo "hi there" |  ansible-vault encrypt_string --vault-password-file=/tmp/foo
ERROR! Only one --vault-id can be used for encryption. This includes passwords from configuration and cli.

$ echo "hi there" |  ansible-vault encrypt_string --vault-id=@prompt
New vault password (default):
Confirm vew vault password (default):
ERROR! Only one --vault-id can be used for encryption. This includes passwords from configuration and cli.

This seems like the Wrong Behavior.

Why isn't my command-line option (either to prompt for a password or to select a different password file) overriding the configuration-file option to use a specific predefined password file? Am I doing something wrong? Or is ansible just like this, no overriding configuration file variables?

Answer 1

I had a similar issue yesterday with the same error thrown and your configuration.

Apparently that error was thrown because my ansible.cfg from CWD was poiting to a vault_password_file and I was also passing the --vault-password-file in the CLI as argument, so referencing the Vault Password File twice throws that error: ERROR! Only one --vault-id can be used for encryption. This includes passwords from configuration and cli.

Which is exactly what the error says, the fact that you're passing that param twice, but in a different way.

So, a way to fix this is either remove the vault_password_file= reference from ansible.cfg and only pass it through the cli --vault-password-file, or just leave it in the ansible.cfg thus avoiding to type --vault-password-file in the cli again, it's up to you.