Answers: <p>Just ran into the same problem myself. Turns out, the error message is dead on: I made a copy-paste error.</p>
  <p>And sure enough, in the OP's case, the variable <code>email</code> has an odd number of chars. I think this gets across better when piped through <code>xxd</code>:</p>
  <pre><code>$ cat &gt; odd.txt
  64336666396139636636386536373531343133303964646631346135633033356162626562333561
  3338336534333236613330336532353861393265613766380a376632616665366463313237656166
  30633135303431336138303535343962663965363536616139393631626534353432313466633064
  3466363063666663360a343233376333643931323738356435643930623765306537313437356638
  3332396164356236663133613432313063373130653632323432643230646237366
  $
  $ xxd odd.txt | tail -3
  00000160: 3331 3330 3633 3337 3331 3330 3635 3336  3130633731306536
  00000170: 3332 3332 3334 3332 3634 3332 3330 3634  3232343264323064
  00000180: 3632 3337 3336 360a                      6237366.
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2022-06-19T12:40:09.350Z
Answers: 2022-06-19T12:40:09.350Z
Answers: Stefan van den Akker
Answers: <p>Robuster and more practical solution is an encrypted file. For example,</p>
  <pre class="lang-yaml prettyprint-override"><code>shell&gt; cat vault1.yml
  my_email: admin@example.com
  my_tag: tag123
  </code></pre>
  <pre class="lang-bash prettyprint-override"><code>shell&gt; ansible-vault encrypt vault1.yml
  Encryption successful
  </code></pre>
  <pre class="lang-bash prettyprint-override"><code>shell&gt; cat vault1.yml
  $ANSIBLE_VAULT;1.1;AES256
  33376431383930313965356364356136306338383238303032363165633962636366663939373237
  3433383262306631643431346236653534316331643466660a326562663633346662656233353733
  63373561636432653535666437656537326635363935366261666237353136313939323535336665
  3333666466656664610a633430313138393238653065623231393165383162656262646139353730
  63653231363465643237666465613631646539366262656537323932346530386364353132326234
  3230623232393630396361333462343862323231323733376665
  </code></pre>
  <p>Then the encrypted file can be used in various <a href="https://docs.ansible.com/ansible/latest/user_guide/playbooks_variables.html#variable-precedence-where-should-i-put-a-variable" rel="nofollow noreferrer">places</a>. For example,</p>
  <pre class="lang-yaml prettyprint-override"><code>shell&gt; cat playbook.yml
  - hosts: localhost
    tasks:
      - include_vars: vault1.yml
      - debug:
          msg: &quot;email: {{ my_email }} tag: {{ my_tag }}&quot;
  </code></pre>
  <p>gives</p>
  <pre class="lang-yaml prettyprint-override"><code>    &quot;msg&quot;: &quot;email: admin@example.com tag: tag123&quot;
  </code></pre>
  <p><strong>Including vault-encrypted variables in a task</strong></p>
  <p>It's possible to limit the scope of the variables to a task. This limits the exposure of the sensitive variables and makes the solution safer. For example, the task below gives the same result.</p>
  <pre class="lang-yaml prettyprint-override"><code>    - debug:
          msg: &quot;email: {{ my_vault.my_email }} tag: {{ my_vault.my_tag }}&quot;
        vars:
          my_vault: &quot;{{ lookup('file', 'vault1.yml')|from_yaml }}&quot;
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2020-02-26T08:08:45.590Z
Answers: Makes sense. Thanks!
Answers: Lucky The Rabbit
Answers: CC BY-SA 4.0
Answers: 2020-02-29T05:22:06.330Z
Answers: Just wanted to come back and say that I had a chance to try out this solution and it worked perfectly. Thanks again!
Answers: Lucky The Rabbit
Answers: CC BY-SA 4.0
Answers: 2020-02-25T04:53:55.173Z
Answers: 2023-01-26T12:43:31.177Z
Answers: 2023-01-26T12:43:31.177Z
Answers: Vladimir Botka
Body: <p>I just recently started to use Ansible, and am trying to deploy a configuration file that contains a secret key and email (for credentials to use with an API). I encrypted them with <code>ansible-vault encrypt_string ...</code>, and added them to playbook:</p>
  
  <pre><code>- name: generate dehydrated dns-hook config file
    template:
      src: etc/dehydrated/dns-hook.sh.j2
      dest: /etc/dehydrated/dns-hook.sh.j2
    vars:
      token: !vault |
                $ANSIBLE_VAULT;1.2;AES256;dns-hook
                66326635666264386238316238373135626233393437633937626534623931636365336231363462
                6131333637663337363162653561393962626661313762300a383633303136633564346366383935
                65333265306162386564363937636531346265633635656536646533393961343935313161643262
                6132336430373235380a313364323438393765613131356535373862306337306434653237316566
                34333965356663626231626533656661663364313737663036343161663638373836366235643730
                3965323463643231666361356330343663653536306634646438
      email: !vault |
                $ANSIBLE_VAULT;1.2;AES256;dns-hook
                64336666396139636636386536373531343133303964646631346135633033356162626562333561
                3338336534333236613330336532353861393265613766380a376632616665366463313237656166
                30633135303431336138303535343962663965363536616139393631626534353432313466633064
                3466363063666663360a343233376333643931323738356435643930623765306537313437356638
                3332396164356236663133613432313063373130653632323432643230646237366
  </code></pre>
  
  <p>However, whenever I run the playbook, I get the following error:</p>
  
  <pre><code>TASK [generate dehydrated dns-hook config file] *****************************************************
  [WARNING]: There was a vault format error: Vault format unhexlify error: Odd-length string
  
  fatal: [sherlock.server.com]: FAILED! =&gt; {"changed": false, "msg": "AnsibleVaultFormatError: Vault format unhexlify error: Odd-length string"}
  </code></pre>
  
  <p>The only thing I can find about this error is that I might have newlines that end in <code>\r\n</code> instead of just <code>\n</code>, but I've verified that is not the case. Everything else I've seen online seems to imply that this format should work, but I'm unable to get it to run successfully.</p>
  
Tags: <ansible><ansible-vault>
Title: Including vault-encrypted variables in a task
UserDisplayName: Lucky The Rabbit
ThreadText: # Including vault-encrypted variables in a task
  
  (Asked by: username_0 on 2020-02-25)
  
  I just recently started to use Ansible, and am trying to deploy a configuration file that contains a secret key and email (for credentials to use with an API). I encrypted them with `ansible-vault encrypt_string ...`, and added them to playbook:
  
  ```
  - name: generate dehydrated dns-hook config file
    template:
      src: etc/dehydrated/dns-hook.sh.j2
      dest: /etc/dehydrated/dns-hook.sh.j2
    vars:
      token: !vault |
                $ANSIBLE_VAULT;1.2;AES256;dns-hook
                66326635666264386238316238373135626233393437633937626534623931636365336231363462
                6131333637663337363162653561393962626661313762300a383633303136633564346366383935
                65333265306162386564363937636531346265633635656536646533393961343935313161643262
                6132336430373235380a313364323438393765613131356535373862306337306434653237316566
                34333965356663626231626533656661663364313737663036343161663638373836366235643730
                3965323463643231666361356330343663653536306634646438
      email: !vault |
                $ANSIBLE_VAULT;1.2;AES256;dns-hook
                64336666396139636636386536373531343133303964646631346135633033356162626562333561
                3338336534333236613330336532353861393265613766380a376632616665366463313237656166
                30633135303431336138303535343962663965363536616139393631626534353432313466633064
                3466363063666663360a343233376333643931323738356435643930623765306537313437356638
                3332396164356236663133613432313063373130653632323432643230646237366
  
  ```
  
  However, whenever I run the playbook, I get the following error:
  
  ```
  TASK [generate dehydrated dns-hook config file] *****************************************************
  [WARNING]: There was a vault format error: Vault format unhexlify error: Odd-length string
  
  fatal: [sherlock.server.com]: FAILED! => {"changed": false, "msg": "AnsibleVaultFormatError: Vault format unhexlify error: Odd-length string"}
  
  ```
  
  The only thing I can find about this error is that I might have newlines that end in `\r\n` instead of just `\n`, but I've verified that is not the case. Everything else I've seen online seems to imply that this format should work, but I'm unable to get it to run successfully.
  
  **Tags:** ansible, ansible-vault
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2020-02-25. Score: 5 | Accepted answer
  
  Robuster and more practical solution is an encrypted file. For example,
  
  ```yaml
  shell> cat vault1.yml
  my_email: admin@example.com
  my_tag: tag123
  
  ```
  
  ```bash
  shell> ansible-vault encrypt vault1.yml
  Encryption successful
  
  ```
  
  ```bash
  shell> cat vault1.yml
  $ANSIBLE_VAULT;1.1;AES256
  33376431383930313965356364356136306338383238303032363165633962636366663939373237
  3433383262306631643431346236653534316331643466660a326562663633346662656233353733
  63373561636432653535666437656537326635363935366261666237353136313939323535336665
  3333666466656664610a633430313138393238653065623231393165383162656262646139353730
  63653231363465643237666465613631646539366262656537323932346530386364353132326234
  3230623232393630396361333462343862323231323733376665
  
  ```
  
  Then the encrypted file can be used in various [places](https://docs.ansible.com/ansible/latest/user_guide/playbooks_variables.html#variable-precedence-where-should-i-put-a-variable). For example,
  
  ```yaml
  shell> cat playbook.yml
  - hosts: localhost
    tasks:
      - include_vars: vault1.yml
      - debug:
          msg: "email: {{ my_email }} tag: {{ my_tag }}"
  
  ```
  
  gives
  
  ```yaml
      "msg": "email: admin@example.com tag: tag123"
  
  ```
  
  **Including vault-encrypted variables in a task**
  
  It's possible to limit the scope of the variables to a task. This limits the exposure of the sensitive variables and makes the solution safer. For example, the task below gives the same result.
  
  ```yaml
      - debug:
          msg: "email: {{ my_vault.my_email }} tag: {{ my_vault.my_tag }}"
        vars:
          my_vault: "{{ lookup('file', 'vault1.yml')|from_yaml }}"
  
  ```
  
  > **Comments:**
  > **username_0**: Makes sense. Thanks!  
  > **username_0**: Just wanted to come back and say that I had a chance to try out this solution and it worked perfectly. Thanks again!  
  
  ---
  
  ### Answer by username_1 on 2022-06-19. Score: 1
  
  Just ran into the same problem myself. Turns out, the error message is dead on: I made a copy-paste error.
  
  And sure enough, in the OP's case, the variable `email` has an odd number of chars. I think this gets across better when piped through `xxd`:
  
  ```
  $ cat > odd.txt
  64336666396139636636386536373531343133303964646631346135633033356162626562333561
  3338336534333236613330336532353861393265613766380a376632616665366463313237656166
  30633135303431336138303535343962663965363536616139393631626534353432313466633064
  3466363063666663360a343233376333643931323738356435643930623765306537313437356638
  3332396164356236663133613432313063373130653632323432643230646237366
  $
  $ xxd odd.txt | tail -3
  00000160: 3331 3330 3633 3337 3331 3330 3635 3336  3130633731306536
  00000170: 3332 3332 3334 3332 3634 3332 3330 3634  3232343264323064
  00000180: 3632 3337 3336 360a                      6237366.
  
  ```
  
  
  ---
  
  