Unable to load inventory nodes due to vault parsing error

[diginote]

Since the update from Rundeck v5.2.0 to v5.5.0, nodes cannot be loaded because reading vault files fails:

...
rundeck-app    | [2024-08-15T13:40:11,128] ERROR resources.ExceptionCatchingResourceModelSource - [ResourceModelSource: 1.source (com.batix.rundeck.plugins.AnsibleResourceModelSourceFactory), project: App-Test]
rundeck-app    | com.dtolabs.rundeck.core.resources.ResourceModelSourceException: Cannot load yaml data coming from Ansible: could not determine a constructor for the tag !vault
rundeck-app    |  in 'string', line 33, column 37:
rundeck-app    |               vault_app_admin_pw: !vault |
rundeck-app    |                                         ^
rundeck-app    |
...
rundeck-app    |        at java.lang.Thread.run(Thread.java:829) [?:?]
rundeck-app    | Caused by: org.yaml.snakeyaml.constructor.ConstructorException: could not determine a constructor for the tag !vault
rundeck-app    |  in 'string', line 33, column 37:
rundeck-app    |               vault_app_admin_pw: !vault |
rundeck-app    |                                         ^
...

Running the playbook without rundeck works as expected (same host as rundeck).

[diginote]

addition infromation:

this is the screenshot in rundeck, when inventory is loaded:

When downgrading to rundeck v5.2.0 everything works as expected.

[psykotox]

Same problem here 😬

[diginote]

no change with the current Rundeck version v5.6.0 :(

[diginote]

Unfortunately, the problem still exists with the current plugin version v4.0.6.

[PianaJava]

So,

Is there any workaround for this?
Any solution in plan or shall I just roll back to a previous version?

[diginote]

As far as I understand it, the snake yaml parser (used to read the inventory yaml file) must be made aware of the !vault tag. This should be done via a constructor. This would enable the snake yaml parser to decrypt the values with the ansible vault password as soon as they are read in. However, I have no idea how or where to start in order to fix this error. Does anyone have any ideas could solve the problem?

[diginote]

I tested the current version v4.0.8 of the ansible plugin. Unfortunately, the error mentioned above is still present.

[kedar9696]

I tested the current version v4.0.8 of the ansible plugin. Unfortunately, the error mentioned above is still present.

@diginote , I have found that the issue was introduced with Rundeck version 5.5.0.20240808-1 and persists up to the latest version 5.12.0.20250512-1. In Rundeck version 5.4.0, the ansible-plugin version is 4.0.1 and everything works fine. However, starting from Rundeck version 5.5.0, the ansible-plugin is upgraded to 4.4.0, and this is when the issue began.

[diginote]

Does anyone have any ideas on how to solve this issue? As far as I can see, the issue has not been resolved in the current version. Is there a workaround or an alternative solution available? For me, removing vault entries from variables referenced in the inventory is not a practical alternative.

[diginote]

In case it helps anyone... I have now found the following workaround for myself. If the “Gather Facts” option is set to true in the Ansible Resource Model Source, Rundeck lets Ansible handle the inventory resolution directly and does not attempt to parse the YAML itself. This allows you to currently avoid the collision with encrypted vault variables in Rundeck. However, considering that this bug has been reported several times and there has been no movement in this regard for over a year, it would probably be advisable to look for possible alternatives in the medium term.