5

我想使用 Hashicorp Vault 和 Ansible 来检索我将在 Ansible playbook 中使用的用户名/密码。

保险柜已设置 - 我创建了一个秘密。整合两者的步骤是什么？关于插件的文档不是很好。我尝试了从 ansible 查找文件，这可行，但是如何使用 3rd 方插件？有人可以帮助我遵循以下步骤吗？

  1. 安装插件，pip install ansible-modules-hashivault
  2. 与https://github.com/jhaals/ansible-vault 2.a有什么区别
    我把环境变量（VAULT ADDR & VAULT TOKEN）放在哪里？
  3. 更改ansible.cfg为指向vault.py位于我的 Ansible 项目的“插件”文件夹中的点

  4. 要测试基本集成，我可以使用以下剧本吗？ https://pypi.python.org/pypi/ansible-modules-hashivault

    - hosts: localhost
    -tasks:
       - hashivault_status:
         register: 'vault_status'

试过这个，但我得到：

An exception occurred during task execution. The full traceback is:
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/ansible/executor/task_executor.py", line 119, in run
    res = self._execute()
  File "/usr/lib/python2.7/site-packages/ansible/executor/task_executor.py", line 431, in _execute
    self._task.post_validate(templar=templar)
  File "/usr/lib/python2.7/site-packages/ansible/playbook/task.py", line 248, in post_validate
    super(Task, self).post_validate(templar)
  File "/usr/lib/python2.7/site-packages/ansible/playbook/base.py", line 371, in post_validate
    value = templar.template(getattr(self, name))
  File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 359, in template
    d[k] = self.template(variable[k], preserve_trailing_newlines=preserve_trailing_newlines, fail_on_undefined=fail_on_undefined, overrides=overrides)
  File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 331, in template
    result = self._do_template(variable, preserve_trailing_newlines=preserve_trailing_newlines, escape_backslashes=escape_backslashes, fail_on_undefined=fail_on_undefined, overrides=overrides)
  File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 507, in _do_template
    res = j2_concat(rf)
  File "<template>", line 8, in root
  File "/usr/lib/python2.7/site-packages/jinja2/runtime.py", line 193, in call
    return __obj(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 420, in _lookup
    instance = self._lookup_loader.get(name.lower(), loader=self._loader, templar=self)
  File "/usr/lib/python2.7/site-packages/ansible/plugins/__init__.py", line 339, in get
    self._module_cache[path] = self._load_module_source('.'.join([self.package, name]), path)
  File "/usr/lib/python2.7/site-packages/ansible/plugins/__init__.py", line 324, in _load_module_source
    module = imp.load_source(name, path, module_file)
  File "/etc/ansible/ProjectA/lookup_plugins/vault.py", line 5
    <!DOCTYPE html>
    ^
SyntaxError: invalid syntax

fatal: [win01]: FAILED! => {
    "failed": true,
    "msg": "Unexpected failure during module execution.",
    "stdout": ""
4

1 回答 1

6

既然你在帖子里放了这么多鸡蛋，我不知道这个问题到底是关于什么的，这里有一些东西可以让你使用本机查找插件和jhaals/ansible-vault.

  • 您可以lookup_plugins在当前目录中创建并保存vault.py在里面；

  • 和环境变量与您在脚本中看到的一样VAULT_ADDR；VAULT_TOKEN

下面的 Bash 脚本（它使用screen和jq，您可能需要安装它们）在开发模式下运行 Vault，设置密码，然后运行 ​​Ansible playbook，该手册使用两个查找插件查询密码：

#!/bin/bash
set -euo pipefail

export VAULT_ADDR=http://127.0.0.1:8200

if [[ ! $(pgrep -f "vault server -dev") ]]; then
    echo \"vault server -dev\" not running, starting...
    screen -S vault -d -m vault server -dev
    printf "sleeping for 3 seconds\n"
    sleep 3
else
    echo \"vault server -dev\" already running, leaving as is...
fi

vault write secret/hello value=world excited=yes
export VAULT_TOKEN=$(vault token-create -format=json | jq -r .auth.client_token)
ansible-playbook playbook.yml --extra-vars="vault_token=${VAULT_TOKEN}"

和playbook.yml：

---
- hosts: localhost
  connection: local
  tasks:
    - name: Retrieve secret/hello using native hashi_vault plugin
      debug: msg="{{ lookup('hashi_vault', 'secret=secret/hello token={{ vault_token }} url=http://127.0.0.1:8200') }}"

    - name: Retrieve secret/hello using jhaals vault lookup
      debug: msg="{{ lookup('vault', 'secret/hello') }}"

最后你应该得到：

TASK [Retrieve secret/hello using native hashi_vault plugin] *******************
ok: [localhost] => {
    "msg": "world"
}

TASK [Retrieve secret/hello using jhaals vault lookup] *************************
ok: [localhost] => {
    "msg": {
        "excited": "yes",
        "value": "world"
    }
}

这个词world是从 Vault 中获取的。

于 2016-12-29T13:13:27.353 回答