ansible vault加密字符串

Question

我正在尝试加密一些密码，但想加密部分字符串而不是整个文件。因此有一个命令ansible-vault encrypt_string，它为您提供加密输出，但是当我将它添加到我的.yaml playbook时，它无法解密。

用于加密简单密码的命令：

ansible-vault encrypt_string'Test123！' --name'ansible_password'

结果：

ansible_password：！vault | $ ANSIBLE_VAULT; 1.1; AES256 30333733643939646130396638646138636338636162316536313236666334656338306634353434 3132326265313639623039653261336265343733383730340a663565323932636138633365386332 36363534326263326633623238653464376637646632363839313464333830363436643561626534 6338613837393539350a383962663766373466376138376666393639373631313861663866333663 6137加密成功

^

格式对于长字符串有点笨拙

所以我试图把这个值放到我的剧本中：

---
- name: Copy needed files to target machine
  hosts: prod
  vars:
          ansible_user: test_admin
          ansible_password: !vault $ANSIBLE_VAULT;1.1;AES256;303337336439396461303966386461386363386361623165363132366663346563383066343534343132326265313639623039653261336265343733383730340a663565323932636138633365386332363635343262633266336232386534643766376466323638393134643338303634366435616265346338613837393539350a3839626637663734663761383766663936393736313138616638663336636137
          ansible_connection: winrm
          ansible_winrm_transport: credssp
          ansible_winrm_server_cert_validation: ignore


  tasks:
  - name: Copy test
    win_copy:
       src: /etc/winmachines/hosts
       dest: C:\test\

然后我想用命令执行playbook：

ansible-playbook copy.yaml -i hosts.ini

结果：

PLAY [Copy needed files to target machine] ********************************************************************************************************

TASK [Gathering Facts] ****************************************************************************************************************************
fatal: [10.5.17.5]: FAILED! => {"msg": "Attempting to decrypt but no vault secrets found"}
        to retry, use: --limit @deleted

PLAY RECAP ****************************************************************************************************************************************
10.5.17.5                  : ok=0    changed=0    unreachable=0    failed=1

当我用参数--ask-vault-password运行playbook时：

ansible-playbook copy.yaml -i hosts.ini --ask-vault-pass

PLAY [Copy needed files to target machine] ********************************************************************************************************

TASK [Gathering Facts] ****************************************************************************************************************************
 [WARNING]: There was a vault format error: Vault vaulttext format error: need more than 1 value to unpack

fatal: [10.5.17.5]: FAILED! => {"msg": "Vault vaulttext format error: need more than 1 value to unpack"}
        to retry, use: --limit @deleted

PLAY RECAP ****************************************************************************************************************************************
10.5.17.5                  : ok=0    changed=0    unreachable=0    failed=1

我试图以各种方式输出加密输出，但每次由于此问题或语法问题而失败。

当从输出传递的方式我得到这样的语法错误：

ERROR! Syntax Error while loading YAML.
  could not find expected ':'

The error appears to have been in : line 8, column 11, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:

          $ANSIBLE_VAULT;1.1;AES256
          34323264326266303364656561616663306566356636616238623931613032343131643839336338
          ^ here

当一切都在同一行中删除“|”得到了这个错误：

TASK [Gathering Facts] ****************************************************************************************************************************
fatal: [10.5.17.5]: FAILED! => {"msg": "AES256 343232643262663033646565616166633065663566366162386239316130323431316438393363383331346231343361386432666461646639386135666335380a373862336531613034393262653432313038303432636536313139353932356637343139393938666536383061383233613136643063353761386339323562640a3963306632393865613237666364386566623938356465336363613163646338 cipher could not be found"}

有任何想法吗？

Answer 1

您的格式不正确。 ansible-vault encrypt_string 'Test123!' --name 'ansible_password'给出的格式是你应该使用的。

供参考，https://github.com/ansible/ansible/blob/devel/lib/ansible/parsing/vault/init.py#L153。保险库解析器正在寻找$ANSIBLE_VAULT;1.1;AES256（或类似的; vaulttext_envelope）在splitlines（）确定的第一行。删除换行符打破了这种期望。

在encrypt_string的输出中，语法完全正确粘贴到您的剧本中。 |（管道字符）在yaml中具有特殊含义。它是一个保留换行符的多行块。它应该是该行的最后一个字符。使用多行块时保持一致的缩进。因为join上的余数是https://github.com/ansible/ansible/blob/devel/lib/ansible/parsing/vault/init.py#L165ed，所以你不需要在密文本身中保留新的行。

这意味着以下任何一项都应该有效：

ansible_password: !vault |
    $ANSIBLE_VAULT;1.1;AES256
    30333733643939646130396638646138636338636162316536313236666334656338306634353434
    3132326265313639623039653261336265343733383730340a663565323932636138633365386332
    36363534326263326633623238653464376637646632363839313464333830363436643561626534
    6338613837393539350a383962663766373466376138376666393639373631313861663866333663
    6137

ansible_password: !vault |
    $ANSIBLE_VAULT;1.1;AES256
    303337336439396461303966386461386363386361623165363132366663346563383066343534343132326265313639623039653261336265343733383730340a663565323932636138633365386332363635343262633266336232386534643766376466323638393134643338303634366435616265346338613837393539350a3839626637663734663761383766663936393736313138616638663336636137

ansible_password: !vault "$ANSIBLE_VAULT;1.1;AES256\r\n303337336439396461303966386461386363386361623165363132366663346563383066343534343132326265313639623039653261336265343733383730340a663565323932636138633365386332363635343262633266336232386534643766376466323638393134643338303634366435616265346338613837393539350a3839626637663734663761383766663936393736313138616638663336636137"

请注意，在上一个示例中，我没有使用管道和\r\n作为换行符。

另请参考：https://yaml-multiline.info/

为清晰起见添加完整示例：

---
- name: Copy needed files to target machine
  hosts: prod
  vars:
    ansible_user: test_admin
    ansible_password: !vault |
      $ANSIBLE_VAULT;1.1;AES256;
      30333733643939646130396638646138636338636162316536313236666334656338306634353434
      30333733643939646130396638646138636338636162316536313236666334656338306634353434
      3132326265313639623039653261336265343733383730340a663565323932636138633365386332
      36363534326263326633623238653464376637646632363839313464333830363436643561626534
      6338613837393539350a383962663766373466376138376666393639373631313861663866333663
      6137

    ## Notice indentation above
    ## the block started with | will end when indentation changes.
    ansible_connection: winrm
    ansible_winrm_transport: credssp
    ansible_winrm_server_cert_validation: ignore

另外，选择制表符或空格但使用两者。我建议一般使用空格，但是对于python和yaml来说更是如此。如果你的编辑器/ ide不进行语法高亮，你应该切换到一个。得到某种yaml linter。 yamllint.com将在短期内运行，但从长远来看，你应该自动获得一些东西并内置到你的编辑器中。祝好运！