Question

我想使用Hashicorp Vault和Ansible来检索我将在Ansible playbook中使用的用户名/密码。

Vault已设置 - 我创建了一个秘密。整合两者的步骤是什么？关于插件的文档并不是很好。我尝试从ansible文件查找，但这有效，但如何使用第三方插件？有人可以帮助我遵循以下步骤吗？

安装插件pip install ansible-modules-hashivault
与https://github.com/jhaals/ansible-vault有什么不同 2.a环境变量（VAULT ADDR＆amp; VAULT TOKEN）我放在哪里？
将ansible.cfg更改为指向位于＆＃34;插件＆＃34;中的vault.py我的Ansible项目的文件夹
要测试基本集成，我可以使用以下playbook吗？ https://pypi.python.org/pypi/ansible-modules-hashivault
```
- hosts: localhost
    -tasks:
       - hashivault_status:
         register: 'vault_status'
```

试过这个，但我明白了：

An exception occurred during task execution. The full traceback is:
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/ansible/executor/task_executor.py", line 119, in run
    res = self._execute()
  File "/usr/lib/python2.7/site-packages/ansible/executor/task_executor.py", line 431, in _execute
    self._task.post_validate(templar=templar)
  File "/usr/lib/python2.7/site-packages/ansible/playbook/task.py", line 248, in post_validate
    super(Task, self).post_validate(templar)
  File "/usr/lib/python2.7/site-packages/ansible/playbook/base.py", line 371, in post_validate
    value = templar.template(getattr(self, name))
  File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 359, in template
    d[k] = self.template(variable[k], preserve_trailing_newlines=preserve_trailing_newlines, fail_on_undefined=fail_on_undefined, overrides=overrides)
  File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 331, in template
    result = self._do_template(variable, preserve_trailing_newlines=preserve_trailing_newlines, escape_backslashes=escape_backslashes, fail_on_undefined=fail_on_undefined, overrides=overrides)
  File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 507, in _do_template
    res = j2_concat(rf)
  File "<template>", line 8, in root
  File "/usr/lib/python2.7/site-packages/jinja2/runtime.py", line 193, in call
    return __obj(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 420, in _lookup
    instance = self._lookup_loader.get(name.lower(), loader=self._loader, templar=self)
  File "/usr/lib/python2.7/site-packages/ansible/plugins/__init__.py", line 339, in get
    self._module_cache[path] = self._load_module_source('.'.join([self.package, name]), path)
  File "/usr/lib/python2.7/site-packages/ansible/plugins/__init__.py", line 324, in _load_module_source
    module = imp.load_source(name, path, module_file)
  File "/etc/ansible/ProjectA/lookup_plugins/vault.py", line 5
    <!DOCTYPE html>
    ^
SyntaxError: invalid syntax

fatal: [win01]: FAILED! => {
    "failed": true,
    "msg": "Unexpected failure during module execution.",
    "stdout": ""

Answer 1

由于你在帖子中放了这么多鸡蛋，我不知道问题的真正含义，这里有一些东西可以让你使用原生查找插件和jhaals/ansible-vault。

您可以在当前目录中创建lookup_plugins并将vault.py保存在内部;
VAULT_ADDR和VAULT_TOKEN环境变量就像您在脚本中看到的那样;

下面的Bash脚本（它使用screen和jq，您可能需要安装它们）以开发模式运行Vault，设置机密，并运行Ansible playbook，通过两次查询查询机密插件：

#!/bin/bash
set -euo pipefail

export VAULT_ADDR=http://127.0.0.1:8200

if [[ ! $(pgrep -f "vault server -dev") ]]; then
    echo \"vault server -dev\" not running, starting...
    screen -S vault -d -m vault server -dev
    printf "sleeping for 3 seconds\n"
    sleep 3
else
    echo \"vault server -dev\" already running, leaving as is...
fi

vault write secret/hello value=world excited=yes
export VAULT_TOKEN=$(vault token-create -format=json | jq -r .auth.client_token)
ansible-playbook playbook.yml --extra-vars="vault_token=${VAULT_TOKEN}"

和playbook.yml：

---
- hosts: localhost
  connection: local
  tasks:
    - name: Retrieve secret/hello using native hashi_vault plugin
      debug: msg="{{ lookup('hashi_vault', 'secret=secret/hello token={{ vault_token }} url=http://127.0.0.1:8200') }}"

    - name: Retrieve secret/hello using jhaals vault lookup
      debug: msg="{{ lookup('vault', 'secret/hello') }}"

最后你应该得到：

TASK [Retrieve secret/hello using native hashi_vault plugin] *******************
ok: [localhost] => {
    "msg": "world"
}

TASK [Retrieve secret/hello using jhaals vault lookup] *************************
ok: [localhost] => {
    "msg": {
        "excited": "yes",
        "value": "world"
    }
}

{Vault}中提取了world这个词。

使用Hashicorp Vault和Ansible - 插件设置

1 个答案: