How can I ignore failures to decrypt a vaulted file?

Question

I have two roles, one of which has a group_vars file that is vaulted, and another that is not. I would like to run the role that does not require any vaulted information, but ansible prompts me for a vault password anyway:

$ tree
├── deploy-home-secure.yml
├── deploy-home.yml
├── group_vars
│   ├── home
│   │   └── unvaulted
│   └── home-secure
│       ├── unvaulted
│       └── vaulted
├── hosts
└── roles
    ├── home
    │   └── tasks
    │       └── main.yaml
    └── home-secure
        └── tasks
            └── main.yaml

$ ansible-playbook --version
ansible-playbook 1.8.2
  configured module search path = None

$ ansible-playbook -i hosts deploy-home.yml
ERROR: A vault password must be specified to decrypt vaulttest/group_vars/home-secure/vaulted

$ ansible-playbook --vault-password-file=/dev/null -i hosts deploy-home.yml
ERROR: Decryption failed

Answer 1

I have something like this to solve this kind of problem (mine was not different roles, but different hosts, but I think the same principle applies):

This is the simplified file structure:

group_vars
  development_vars
  staging_vars 
vaulted_vars
  production_vars

This allows you to deploy development or staging without Ansible asking you to decrypt production_vars.

And then, the production playbook goes like this:

hosts: production
roles:
  - role...
vars_files:
  - vaulted_vars/production_vars

The vars_files line where you specify the path to the vaulted var is the key.