Keep a user's password in an encrypted variables file, use it to create the user, change the vault password, and run the playbook with ansible-navigator, with a password file and at the prompt.

Before you start

This VM is the control node. The lab creates the user greg (password Lab-Pass-1) with an SSH key, and installs ansible-core and ansible-navigator. Work as greg, in /home/greg/ansible: its ansible.cfg reads the inventory inventory, logs in as devops and becomes root. Its ansible-navigator.yml turns execution environments off, so ansible-navigator runs this VM's own ansible-playbook and pulls no container image.

The managed node node1 (10.99.1.11) is an AlmaLinux 10 container reached over SSH by name, where devops has greg's key and passwordless sudo. For a root shell on it, sudo podman exec -it node1 bash.

Tasks

In /home/greg/ansible, store the vault password RedhatVault in vault-pass.txt (mode 600), and create the encrypted variables file secret.yml with user_password set to a password of your choosing. Write vault.yml, which uses secret.yml to create the user vaultuser on node1 with that password, and run it.
Change the vault password of secret.yml, and put the new one in vault-pass.txt. Then ansible-vault view works with the new password and fails with RedhatVault.
Run vault.yml with ansible-navigator, first with --vault-password-file vault-pass.txt, then with --ask-vault-pass. Set ansible-navigator.yml up so the prompt works: stdout mode, and playbook artifacts off.

Hints

ansible-vault create, encrypt, view, rekey (--new-vault-password-file).
vars_files: [secret.yml], and password: "{{ user_password | password_hash('sha512', 'vaultsalt') }}" with update_password: on_create.
In ansible-navigator.yml: mode: stdout and playbook-artifact: with enable: false, beside the execution-environment setting. With artifacts on, --ask-vault-pass shows no prompt and waits.