I'm using the gcp\_compute inventory plugin in Ansible 2.9.13 and everything is working OK using `auth_kind: serviceaccount` and `service_account_file: <somefile>.json`

My issue is that I don't want to store the service account file in plaintext. If I encrypt it with ansible-vault, the plugin does not seem able to read the file and it fails with the standard "stuffs broken, fail in a weird way" that inventory modules seem to do:

```
$ ansible-inventory -i inventory/ --graph --ask-vault-pass
Vault password:
[WARNING]:  * Failed to parse <rootpath-redacted>/inventory/hosts_gcp_compute.yaml with auto plugin: Expecting value: line 1 column 1 (char 0)
[WARNING]:  * Failed to parse <rootpath-redacted>/inventory/hosts_gcp_compute.yaml with yaml plugin: Plugin configuration YAML file, not YAML inventory
[WARNING]:  * Failed to parse <rootpath-redacted>/inventory/hosts_gcp_compute.yaml with ini plugin: Invalid host pattern 'plugin:' supplied, ending in
':' is not allowed, this character is reserved to provide a port.
[WARNING]: Unable to parse <rootpath-redacted>/inventory/hosts_gcp_compute.yaml as an inventory source
@all:
...<list of other inventory items excluding gcp_compute ones>

```

If I change nothing else other than decrypt the file referenced with `service_account_file` then the command runs fine and I get a full list of inventory.

Is there a way to get the gcp\_compute inventory plugin to read the service account file via ansible vault? I can't find any documentation that shows storing the file encrypted, or a way to load it into a variable and pass that to the script or anything - I can't work out if there just isn't a way, or if I am trying to do things the "wrong" way.

The plan is for our ansible setup to be running in a docker container, which might be on any cloud provider's platform (gcp, aws etc) or on a dev's machine, so I can't assume that I'll have the GCE Metadata server providing a service account already, I'll need to provide one somehow. I would also rather avoid having a separate script running to do the decryption first, but if that's the only way then that's probably the path I'll take.