运行 Ansible playbook 时如何自动传递保管库密码？

Question

I have an Ansible playbook with vault, and I want to ask for vault password through the prompt box in my web interface and then pass the posted password when running ansible playbook. I tried to use:

echo $password | ansible-playbook test.yml --ask-vault-pass

to pass the password to the playbook, but it doesn't work, the error message is:

"msg": "Attempting to decrypt but no vault secrets found"

I don't want to store password in file for some resons and now I just want to try to automatically pass password to the playbook while running it. Is there any advice to me? The ansible version is 2.4.

Answer 1

You can use a script instead of providing the password through an interactive interface.

Here's an example for your use case:

1. Save path_to/vault_secret.sh file (add permissions to execute) with the following content:

    #!/bin/bash echo $password

2. Execute:

    ansible-playbook test.yml --vault-password-file path_to/vault_secret.sh

---

Alternatively:

2. Add to ansible.cfg :

    [defaults] vault_password_file=path_to/vault_secret.sh

3. Execute:

    ansible-playbook test.yml

Answer 2

您可以将--vault-password-file与文件描述符一起使用：

ansible-playbook test.yml --vault-password-file <(echo somepassword)

Answer 3

@All Make sure you are adding vault_password_file = into the [defaults] section of ansible.cfg file.

I was facing the same issue when I added vault_password_file = in another section which was resolved after moving it into [defaults]

try your luck if that helps.

Answer 4

Here's how I am doing things, and it works well. My command line looks like this:

[prompt/]$ansible-playbook -i <inventory>, /mnt/m/NetworkGetters/get_vpn_status.yml --extra-vars varsfilepath=/mnt/m/NetworkVars/host_vars/test-oci-test-vpn-config.yml

My sanitized passwords.yml (vault file) looks like this:

---
credentials:
  base: &base
    host: "{{ansible_host}}"
    timeout: 30
    transport: cli
  svc_rhelsystemrw:
    <<: *base
    username: svc_rhelsystemrw
    password: dWERE#@kds23

My playbooks follow this convention:

name: Set VPN Configuration
  hosts: all
  connection: local
  gather_facts: no
  vars_files:
    - "{{ varsfilepath }}"
    - "/etc/ansible/NetworkVars/passwords.yml"
  vars:
    # ssh_auth credentials come from ansible vault
    provider_rw:
      username:  "{{ credentials['svc_rhelsystemrw'].username }}"
      password:  "{{ credentials['svc_rhelsystemrw'].password }}"

  tasks:
  - name: Capture Pre-change Configuration
    ios_command:
      provider: "{{ provider_rw }}"    
      commands:
        - show running-config
    register: running_config_before
    tags: vpn 

  - debug:
      var: running_config_before.stdout
    tags: vpn