Question

我正在尝试加密一些密码，但只想加密一部分字符串而不是整个文件。因此，有一个ansible-vault crypto_string命令可以为您提供加密的输出，但是当我将其添加到.yaml剧本时，它无法解密。

用于输入简单密码的命令：

ansible-vault crypto_string'Test123！' --name'ansible_password'

结果：

ansible_password：！vault | $ ANSIBLE_VAULT; 1.1; AES256 30333733643939646130396638646138636338636162316536313236666334656338306634353434 3132326265313639623039653261336265343733383730340a663565323932636636633633386332 36363534326263326633623238653464376637646632363839313464333830363436643561626534 6338613837393539350a383962663766373466376138376666393639373631313861663866333663 6137加密成功

^

长字符串格式有点笨拙

所以我试图像这样将这个值放入我的剧本：

---
- name: Copy needed files to target machine
  hosts: prod
  vars:
          ansible_user: test_admin
          ansible_password: !vault $ANSIBLE_VAULT;1.1;AES256;303337336439396461303966386461386363386361623165363132366663346563383066343534343132326265313639623039653261336265343733383730340a663565323932636138633365386332363635343262633266336232386534643766376466323638393134643338303634366435616265346338613837393539350a3839626637663734663761383766663936393736313138616638663336636137
          ansible_connection: winrm
          ansible_winrm_transport: credssp
          ansible_winrm_server_cert_validation: ignore


  tasks:
  - name: Copy test
    win_copy:
       src: /etc/winmachines/hosts
       dest: C:\test\

然后我要使用命令执行剧本：

ansible-playbook copy.yaml -i hosts.ini

结果：

PLAY [Copy needed files to target machine] ********************************************************************************************************

TASK [Gathering Facts] ****************************************************************************************************************************
fatal: [10.5.17.5]: FAILED! => {"msg": "Attempting to decrypt but no vault secrets found"}
        to retry, use: --limit @deleted

PLAY RECAP ****************************************************************************************************************************************
10.5.17.5                  : ok=0    changed=0    unreachable=0    failed=1

当我使用参数--ask-vault-password运行剧本时：

ansible-playbook copy.yaml -i hosts.ini --ask-vault-pass

PLAY [Copy needed files to target machine] ********************************************************************************************************

TASK [Gathering Facts] ****************************************************************************************************************************
 [WARNING]: There was a vault format error: Vault vaulttext format error: need more than 1 value to unpack

fatal: [10.5.17.5]: FAILED! => {"msg": "Vault vaulttext format error: need more than 1 value to unpack"}
        to retry, use: --limit @deleted

PLAY RECAP ****************************************************************************************************************************************
10.5.17.5                  : ok=0    changed=0    unreachable=0    failed=1

我试图以各种方式放置加密输出，但是每次由于此问题或语法问题而导致输出失败时。

从输出交付时，出现这样的语法错误：

ERROR! Syntax Error while loading YAML.
  could not find expected ':'

The error appears to have been in : line 8, column 11, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:

          $ANSIBLE_VAULT;1.1;AES256
          34323264326266303364656561616663306566356636616238623931613032343131643839336338
          ^ here

当所有内容都在同一行中时，删除“ |”出现此错误：

TASK [Gathering Facts] ****************************************************************************************************************************
fatal: [10.5.17.5]: FAILED! => {"msg": "AES256 343232643262663033646565616166633065663566366162386239316130323431316438393363383331346231343361386432666461646639386135666335380a373862336531613034393262653432313038303432636536313139353932356637343139393938666536383061383233613136643063353761386339323562640a3963306632393865613237666364386566623938356465336363613163646338 cipher could not be found"}

有什么想法吗？

Answer 1

您的格式不正确。 ansible-vault encrypt_string 'Test123!' --name 'ansible_password'给出的格式是您应使用的格式。

供参考， https://github.com/ansible/ansible/blob/devel/lib/ansible/parsing/vault/init.py#L153。保管库解析器正在寻找$ANSIBLE_VAULT;1.1;AES256（或类似名称； vaulttext_envelope）在由splitlines（）确定的第一行上。删除换行符会破坏这种期望。

在encrypt_string的输出中，将语法正确粘贴到您的剧本中是正确的。 |（竖线字符）在yaml中具有特殊含义。它是一个多行块，保留换行符。它应该是该行的最后一个字符。使用多行块时，请保持一致的缩进。由于其余部分是在https://github.com/ansible/ansible/blob/devel/lib/ansible/parsing/vault/init.py#L165上join进行的，因此您不需要在密文本身中保留新行。

这意味着以下任何一项都可以工作：

ansible_password: !vault |
    $ANSIBLE_VAULT;1.1;AES256
    30333733643939646130396638646138636338636162316536313236666334656338306634353434
    3132326265313639623039653261336265343733383730340a663565323932636138633365386332
    36363534326263326633623238653464376637646632363839313464333830363436643561626534
    6338613837393539350a383962663766373466376138376666393639373631313861663866333663
    6137

ansible_password: !vault |
    $ANSIBLE_VAULT;1.1;AES256
    303337336439396461303966386461386363386361623165363132366663346563383066343534343132326265313639623039653261336265343733383730340a663565323932636138633365386332363635343262633266336232386534643766376466323638393134643338303634366435616265346338613837393539350a3839626637663734663761383766663936393736313138616638663336636137

ansible_password: !vault "$ANSIBLE_VAULT;1.1;AES256\r\n303337336439396461303966386461386363386361623165363132366663346563383066343534343132326265313639623039653261336265343733383730340a663565323932636138633365386332363635343262633266336232386534643766376466323638393134643338303634366435616265346338613837393539350a3839626637663734663761383766663936393736313138616638663336636137"

请注意，在上一个示例中，我没有使用任何管道，而\r\n是换行符。

另请参考：https://yaml-multiline.info/

为清楚起见添加了完整示例：

---
- name: Copy needed files to target machine
  hosts: prod
  vars:
    ansible_user: test_admin
    ansible_password: !vault |
      $ANSIBLE_VAULT;1.1;AES256;
      30333733643939646130396638646138636338636162316536313236666334656338306634353434
      30333733643939646130396638646138636338636162316536313236666334656338306634353434
      3132326265313639623039653261336265343733383730340a663565323932636138633365386332
      36363534326263326633623238653464376637646632363839313464333830363436643561626534
      6338613837393539350a383962663766373466376138376666393639373631313861663866333663
      6137

    ## Notice indentation above
    ## the block started with | will end when indentation changes.
    ansible_connection: winrm
    ansible_winrm_transport: credssp
    ansible_winrm_server_cert_validation: ignore

顺便说一句，选择制表符或空格，但请同时使用。我通常建议使用空格，但是对于python和yaml来说则建议加倍。如果您的编辑器/ ide不执行语法突出显示，则应切换到执行该操作。并获得某种yaml短绒。 yamllint.com将在短期内运行，但从长远来看，您应该可以自动获取内容并将其内置到编辑器中。祝你好运！

Ansible Vault加密字符串

1 个答案: