<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Feature Idea</li>
</ul>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.1.0.0
  config file = /home/soar/ansible2/ansible.cfg
  configured module search path = Default w/o overrides"><pre class="notranslate"><code class="notranslate">ansible 2.1.0.0
  config file = /home/soar/ansible2/ansible.cfg
  configured module search path = Default w/o overrides
</code></pre></div>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">When I build new project with Ansible, I place all sensitive information to vault-encrypted files. I follow KISS principles and this files are included as <code class="notranslate">group_vars</code> (or <code class="notranslate">host_vars</code>). All works perfectly. So I have files like:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="├── ansible.cfg
├── inventory
│   └── projectname
│       ├── group_vars
│       │   ├── hosts.yml
│       │   ├── somegroup.yml
│       │   └── somegroup-encrypted.yml
│       └── projectname
├── playbooks
│   ├── deploy-something.yml
│   └── test.yml
└── roles
    ├── somerole
    │   ├── defaults
    │   │   └── main.yml"><pre class="notranslate"><code class="notranslate">├── ansible.cfg
├── inventory
│   └── projectname
│       ├── group_vars
│       │   ├── hosts.yml
│       │   ├── somegroup.yml
│       │   └── somegroup-encrypted.yml
│       └── projectname
├── playbooks
│   ├── deploy-something.yml
│   └── test.yml
└── roles
    ├── somerole
    │   ├── defaults
    │   │   └── main.yml
</code></pre></div>
<p dir="auto">But recently I started to use automated tests for my Ansible projects. So after commiting to repository, I run something like:</p>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="ansible-playbook -vvv --syntax-check playbooks/test.yml
ansible-playbook -vvv --connection=local --sudo playbooks/test.yml"><pre class="notranslate">ansible-playbook -vvv --syntax-check playbooks/test.yml
ansible-playbook -vvv --connection=local --sudo playbooks/test.yml</pre></div>
<p dir="auto">And check output. I want to run this tests without my encrypted data, and all variables are defined with default values in <code class="notranslate">rolename/defaults/main.yml</code>. But... I get only <code class="notranslate">ERROR! Decryption failed</code>.</p>
<p dir="auto">I think, there should be some command-line switch, to run playbook without decryption for test purposes.</p>
<p dir="auto">I know, that I can use <code class="notranslate">vars_files</code> or <code class="notranslate">-e</code> command-line switch, but then I should type them on every run. And I think encrypted files should be places in <code class="notranslate">inventory</code> with appropriate hosts, and not in playbooks directory.</p>
<p dir="auto">And, of course, please don't forget about <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="137563299" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible/issues/14721" data-hovercard-type="issue" data-hovercard-url="/ansible/ansible/issues/14721/hovercard" href="https://github.com/ansible/ansible/issues/14721">#14721</a></p>
<p dir="auto">In some cases diff users might want to use the same play with different access levels, being able to change vault failure to decrypt to a warning or something else allows for this.</p>