I managed to create this workaround (but there's seem to be an issue with 'register' and 'changed_when' in OpenBSD specific 'user' module task). It pre-encrypts passwords via preceding task.
Any comments? j. ~~~ --- - name: Testing adding users on OpenBSD and Linux with vault hosts: all become: True vars_files: - secret.yml tasks: - name: Pre-encrypt passwords using Blowfish hashing command: encrypt -b a {{ item.password }} with_items: "{{ users }}" register: encpassword no_log: True changed_when: "encpassword.rc != 0" when: ansible_distribution == "OpenBSD" tags: openbsd # - debug: var=encpassword # - debug: msg="item.item.name={{item.item.name}}, item.stdout={{item.stdout}}" # with_items: "{{encpassword.results}}" - name: Create users from secret.yml on OpenBSD user: name: "{{ item.item.name }}" comment: "{{ item.item.name }} (ansible managed)" password: "{{ item.stdout }}" with_items: "{{ encpassword.results }}" when: ansible_distribution == "OpenBSD" no_log: True # XXX bug? # register: createusers # changed_when: "createusers.rc != 0" tags: openbsd - name: Create users from secret.yml user: name: "{{ item.name }}" comment: "{{ item.name }} (ansible managed)" password: "{{ item.password | password_hash('sha512') }}" no_log: True with_items: "{{ users }}" when: ansible_distribution != "OpenBSD" tags: linux ~~~ ~~~ $ ansible-playbook -i inventory --ask-vault-pass -l test_host test.yml Vault password: PLAY [Testing adding users on OpenBSD and Linux with vault] ******************** TASK [setup] ******************************************************************* ok: [192.168.2.1] TASK [Pre-encrypt passwords using Blowfish hashing] **************************** ok: [192.168.2.1] => (item=(censored due to no_log)) ok: [192.168.2.1] => (item=(censored due to no_log)) TASK [Create users from secret.yml on OpenBSD] ********************************* changed: [192.168.2.1] => (item=(censored due to no_log)) changed: [192.168.2.1] => (item=(censored due to no_log)) TASK [Create users from secret.yml] ******************************************** skipping: [192.168.2.1] => (item=(censored due to no_log)) skipping: [192.168.2.1] => (item=(censored due to no_log)) PLAY RECAP ********************************************************************* 192.168.2.1 : ok=3 changed=1 unreachable=0 failed=0 ~~~