我正在尝试加密一些密码，但只想加密部分字符串而不是整个文件。所以有一个命令 ansible-vault encrypt_string 为您提供加密的输出，但是当我将它添加到我的 .yaml 剧本时，它无法解密。
用于加密简单密码的命令：
ansible-vault encrypt_string 'Test123!' --name 'ansible_password'
结果：
ansible_password: !vault | $ANSIBLE_VAULT;1.1;AES256 30333733643939646130396638646138636338636162316536313236666334656338306634353434 3132326265313639623039653261336265343733383730340a663565323932636138633365386332 36363534326263326633623238653464376637646632363839313464333830363436643561626534 6338613837393539350a383962663766373466376138376666393639373631313861663866333663 6137 Encryption successful
^
长字符串的格式有点笨拙
所以我试图将这个值放入我的剧本中，如下所示：
---
- name: Copy needed files to target machine
hosts: prod
vars:
ansible_user: test_admin
ansible_password: !vault $ANSIBLE_VAULT;1.1;AES256;303337336439396461303966386461386363386361623165363132366663346563383066343534343132326265313639623039653261336265343733383730340a663565323932636138633365386332363635343262633266336232386534643766376466323638393134643338303634366435616265346338613837393539350a3839626637663734663761383766663936393736313138616638663336636137
ansible_connection: winrm
ansible_winrm_transport: credssp
ansible_winrm_server_cert_validation: ignore
tasks:
- name: Copy test
win_copy:
src: /etc/winmachines/hosts
dest: C:\test\
然后我想用命令执行剧本：
ansible-playbook copy.yaml -i hosts.ini
结果：
PLAY [Copy needed files to target machine] ********************************************************************************************************
TASK [Gathering Facts] ****************************************************************************************************************************
fatal: [10.5.17.5]: FAILED! => {"msg": "Attempting to decrypt but no vault secrets found"}
to retry, use: --limit @deleted
PLAY RECAP ****************************************************************************************************************************************
10.5.17.5 : ok=0 changed=0 unreachable=0 failed=1
当我使用参数--ask-vault-password 运行剧本时：
ansible-playbook copy.yaml -i hosts.ini --ask-vault-pass
PLAY [Copy needed files to target machine] ********************************************************************************************************
TASK [Gathering Facts] ****************************************************************************************************************************
[WARNING]: There was a vault format error: Vault vaulttext format error: need more than 1 value to unpack
fatal: [10.5.17.5]: FAILED! => {"msg": "Vault vaulttext format error: need more than 1 value to unpack"}
to retry, use: --limit @deleted
PLAY RECAP ****************************************************************************************************************************************
10.5.17.5 : ok=0 changed=0 unreachable=0 failed=1
我试图以各种方式将输出加密，但每次由于此问题或语法问题而失败。
当从输出传递的方式输入时，我收到如下语法错误：
ERROR! Syntax Error while loading YAML.
could not find expected ':'
The error appears to have been in : line 8, column 11, but may
be elsewhere in the file depending on the exact syntax problem.
The offending line appears to be:
$ANSIBLE_VAULT;1.1;AES256
34323264326266303364656561616663306566356636616238623931613032343131643839336338
^ here
当所有内容都在同一行时，删除“|” 得到这个错误：
TASK [Gathering Facts] ****************************************************************************************************************************
fatal: [10.5.17.5]: FAILED! => {"msg": "AES256 343232643262663033646565616166633065663566366162386239316130323431316438393363383331346231343361386432666461646639386135666335380a373862336531613034393262653432313038303432636536313139353932356637343139393938666536383061383233613136643063353761386339323562640a3963306632393865613237666364386566623938356465336363613163646338 cipher could not be found"}
有任何想法吗？