Ansible playbook Vault 加密

Ansible playbook Vault 加密詳解與使用案例

主機規劃

主機名稱	操作系統版本	內網IP	外網IP(模擬)	安裝軟件
ansi-manager	CentOS7.5	172.16.1.180	10.0.0.180	ansible
ansi-haproxy01	CentOS7.5	172.16.1.181	10.0.0.181
ansi-haproxy02	CentOS7.5	172.16.1.182	10.0.0.182
ansi-web01	CentOS7.5	172.16.1.183	10.0.0.183
ansi-web02	CentOS7.5	172.16.1.184	10.0.0.184
ansi-web03	CentOS7.5	172.16.1.185	10.0.0.185

添加用戶賬號

說明：

1、 運維人員使用的登錄賬號；

2、 所有的業務都放在 /app/ 下「yun用戶的家目錄」，避免業務數據亂放；

3、 該用戶也被 ansible 使用，因爲幾乎所有的生產環境都是禁止 root 遠程登錄的（因此該 yun 用戶也進行了 sudo 提權）。

# 使用一個專門的用戶，避免直接使用root用戶
# 添加用戶、指定家目錄並指定用戶密碼
# sudo提權
# 讓其它普通用戶可以進入該目錄查看信息
useradd -u 1050 -d /app yun && echo '123456' | /usr/bin/passwd --stdin yun
echo "yun  ALL=(ALL)       NOPASSWD: ALL" >>  /etc/sudoers
chmod 755 /app/

Ansible 配置清單Inventory

之後文章都是如下主機配置清單

[yun@ansi-manager ansible_info]$ pwd
/app/ansible_info
[yun@ansi-manager ansible_info]$ cat hosts_key 
# 方式1、主機 + 端口 + 密鑰
[manageservers]
172.16.1.180:22

[proxyservers]
172.16.1.18[1:2]:22

# 方式2：別名 + 主機 + 端口 + 密碼
[webservers]
web01 ansible_ssh_host=172.16.1.183 ansible_ssh_port=22
web02 ansible_ssh_host=172.16.1.184 ansible_ssh_port=22
web03 ansible_ssh_host=172.16.1.185 ansible_ssh_port=22

Ansible Vault 概述

當我們寫的 playbook 中涉及敏感信息，如：數據庫賬號密碼；MQ賬號密碼；主機賬號密碼。這時爲了防止這些敏感信息泄露，就可以使用 vault 進行加密。

[yun@ansi-manager ~]$ ansible-vault -h
Usage: ansible-vault [create|decrypt|edit|encrypt|encrypt_string|rekey|view] [options] [vaultfile.yml]

Options:
  --ask-vault-pass      ask for vault password
  -h, --help            show this help message and exit
  --new-vault-id=NEW_VAULT_ID
                        the new vault identity to use for rekey
  --new-vault-password-file=NEW_VAULT_PASSWORD_FILE
                        new vault password file for rekey
  --vault-id=VAULT_IDS  the vault identity to use
  --vault-password-file=VAULT_PASSWORD_FILES
                        vault password file
  -v, --verbose         verbose mode (-vvv for more, -vvvv to enable
                        connection debugging)
  --version             show program's version number, config file location,
                        configured module search path, module location,
                        executable location and exit

 See 'ansible-vault <command> --help' for more information on a specific
command.

參數說明

create：創建一個加密文件，在創建時會首先要求輸入 Vault 密碼，之後才能進入文件中編輯。

decrypt：對 vault 加密的文件進行解密。

edit：對 vault 加密文件進行編輯。

encrypt：對提供的文件，進行 vault 加密。

encrypt_string：對提供的字符串進行 vault 加密。

rekey：對已 vault 加密的文件進行免密更改，需要提供之前的密碼。

view：查看已加密的文件，需要提供密碼。

Ansible Vault 交互式

創建加密文件

[yun@ansi-manager object06]$ pwd
/app/ansible_info/object06
[yun@ansi-manager object06]$ ansible-vault create test_vault.yml
New Vault password: # 輸入密碼
Confirm New Vault password: # 確認密碼
---
# vault test
- hosts: proxyservers

  tasks:
    - name: "touch file"
      file:
        path: /tmp/with_itemstestfile
        state: touch

[yun@ansi-manager object06]$ cat test_vault.yml   # 加密後查看
$ANSIBLE_VAULT;1.1;AES256
33663239636530353564393731363161623462386266613165326235353762343465653235396639
6138353833366637383066366662666236666338333237610a303263336234303866623834663361
39343633646434353334396162643063613964333337343336373232653266613264626564346566
6262633334353036620a633136313364383536323531373164346436663739663631353166663434
38663962363032643163333266633662376538383134333862373961313166656536353734363537
30626261366138383864653834336637393230363466336662306138323032373361656566663231
65363039393736326266316261383065363739633861646464373733643966333233343436303731
37366130363064366337393837396664356335363738663130333436656238666233396466393137
33306434343262313961393661313536386338383233303230613962663732323630663638313531
3236636438646166643937613761396564373033623637636166

對已加密的文件進行解密

[yun@ansi-manager object06]$ ansible-vault decrypt test_vault.yml
Vault password: 
Decryption successful
[yun@ansi-manager object06]$ 
[yun@ansi-manager object06]$ cat test_vault.yml  # 解密後查看
---
# vault test
- hosts: proxyservers

  tasks:
    - name: "touch file"
      file:
        path: /tmp/with_itemstestfile
        state: touch

對已存在文件進行加密

[yun@ansi-manager object06]$ ansible-vault encrypt test_vault.yml
New Vault password: 
Confirm New Vault password: 
Encryption successful
[yun@ansi-manager object06]$ cat test_vault.yml 
$ANSIBLE_VAULT;1.1;AES256
37313964663164613434656666323265376465303433633438613032303733363136316235623066
3930343836396537343333336432363732343936323937370a363239356233333634303464633539
61613264363037313833363738623866643762666662646165646561343631646434383864373338
6334333162616332320a353033323538643566666562646334623630343938646264663561316566
35633939653166326631303635363533613338326561666663623238396464383363613738323464
37306163663933323836316165666532336664353038303036383564346436633235373166663834
62383464373632373839323562306163666366313738663234656139346130373031626265613830
38373135616261616137326337633566306633343338306264646139396230613665356264353134
37376636646266626236323663376230313964323034623133333539393131333065323964303030
3139366661353732333961323764613332316535323334343939

對已加密的文件進行編輯

[yun@ansi-manager object06]$ ansible-vault edit test_vault.yml
Vault password: 
---
# vault test  ==
- hosts: proxyservers

  tasks:
    - name: "touch file"
      file:
        path: /tmp/with_itemstestfile
        state: touch

對已加密文件更改密碼

[yun@ansi-manager object06]$ ansible-vault rekey test_vault.yml
Vault password: 
New Vault password: 
Confirm New Vault password: 
Rekey successful

對已加密文件進行查看

[yun@ansi-manager object06]$ ansible-vault view test_vault.yml
Vault password: 
---
# vault test  ==
- hosts: proxyservers

  tasks:
    - name: "touch file"
      file:
        path: /tmp/with_itemstestfile
        state: touch

對提供的字符串進行加密

[yun@ansi-manager object06]$ ansible-vault encrypt_string "111 222 333"
New Vault password: 
Confirm New Vault password: 
!vault |
          $ANSIBLE_VAULT;1.1;AES256
          61343332386237363437623939633334626231613539353566313336306562373538633937363566
          6537336166356466666431663037623835643964366137340a336439313066356265666636383430
          36613661393232613134333961643936646164396130613663656237393837366566356631353061
          3034326337303932610a303232643464633239383563393836306565353835666431363132303835
          3635
Encryption successful

Ansible Vault 非交互式

創建密碼文件

安全使用，記得使用 400 或 600 權限。

[yun@ansi-manager object06]$ echo "111111" > vault_pwd
[yun@ansi-manager object06]$ echo "123456" > vault_pwd2
[yun@ansi-manager object06]$ ll vault_pwd*  # 權限 400
-r-------- 1 yun yun 7 Aug 30 10:35 vault_pwd
-r-------- 1 yun yun 7 Aug 30 10:39 vault_pwd2

創建加密文件

[yun@ansi-manager object06]$ ansible-vault create test_vault02.yml --vault-password-file=vault_pwd
---
# vault test 2
[yun@ansi-manager object06]$ cat test_vault02.yml 
$ANSIBLE_VAULT;1.1;AES256
34356364613864656136616365383361386635316332363861656334643230366136313333376366
6638666536306162366263333037323231386365316238390a383139623435363738663832623533
34666539393036383365333062333039643832616233623764613132303966396534616633326366
6131313833383761620a383534363564393836306238666135656137623036386531653931623362
30613036333161613235393539633233663136653566366266353232386230383434

對已加密的文件進行解密

[yun@ansi-manager object06]$ ansible-vault decrypt test_vault02.yml --vault-password-file=vault_pwd
Decryption successful
[yun@ansi-manager object06]$ cat test_vault02.yml 
---
# vault test 2

對已存在文件進行加密

[yun@ansi-manager object06]$ ansible-vault encrypt test_vault02.yml --vault-password-file=vault_pwd
Encryption successful
[yun@ansi-manager object06]$ 
[yun@ansi-manager object06]$ cat test_vault02.yml 
$ANSIBLE_VAULT;1.1;AES256
65653035393230366365363637343137636337663638346463303532623139353137366162396536
3533393766313339393665386463613831323366623962650a643365653833636663653938613966
39323037396635333236663239316431343461346562393731363537313865623534396533653931
3638363937626635390a303962653366353138373139623237356637656230386565663364626438
31613837383338323065346634323632396339323635323766386236623038616233

對已加密的文件進行編輯

[yun@ansi-manager object06]$ ansible-vault edit test_vault02.yml --vault-password-file=vault_pwd
---
# vault test 2  ##

對已加密文件更改密碼

[yun@ansi-manager object06]$ ansible-vault rekey test_vault02.yml --vault-password-file=vault_pwd --new-vault-password-file=vault_pwd2
Rekey successful

對已加密文件進行查看

[yun@ansi-manager object06]$ ansible-vault view test_vault02.yml --vault-password-file=vault_pwd2
---
# vault test 2  ##

對提供的字符串進行加密

[yun@ansi-manager object06]$ ansible-vault encrypt_string "test info" --vault-password-file=vault_pwd2
!vault |
          $ANSIBLE_VAULT;1.1;AES256
          30313766613263363963316663623664353862623032323331356563626636646239636666343766
          6633363733303334373831303732326435396566313066630a373562633530333832613335393835
          34396161313862656466353433313835643030633966383032656561343331616234373831623233
          6636396135306436640a313531373835663633383665396139343464613861313034386365393137
          6133
Encryption successful

Playbook 使用 vault 文件

# 其中 test_vault.yml 的 vault 密碼爲 vault_pwd 中的信息
[yun@ansi-manager object06]$ ansible-vault view test_vault.yml --vault-password-file=vault_pwd
---
# vault test  ==
- hosts: proxyservers

  tasks:
    - name: "touch file"
      file:
        path: /tmp/with_itemstestfile
        state: touch

[yun@ansi-manager object06]$ ansible-playbook -b -i ../hosts_key --syntax-check test_vault.yml --vault-password-file=vault_pwd  # 語法檢測
[yun@ansi-manager object06]$ ansible-playbook -b -i ../hosts_key -C test_vault.yml --vault-password-file=vault_pwd  # 預執行，測試執行
[yun@ansi-manager object06]$ ansible-playbook -b -i ../hosts_key test_vault.yml --vault-password-file=vault_pwd  # 執行

---

———END——— 如果覺得不錯就關注下唄 (-^O^-) ！