使用Hashicorp Vault与Ansible - 插件设置

Question

使用Hashicorp Vault与Ansible - 插件设置

ansiblehashicorp-vault

5

我希望使用Hashicorp Vault和Ansible一起获取用户名/密码，然后在Ansible playbook中使用。

Vault已经设置好了 - 我创建了一个密钥。如何集成两个工具？关于插件的文档并不是很好。我尝试使用ansible中的文件查找，这也可以工作，但如何使用第三方插件呢？有人能帮助我提供步骤吗？

Install the plugin, pip install ansible-modules-hashivault
What is the difference with https://github.com/jhaals/ansible-vault
2.a The environment variables (VAULT ADDR & VAULT TOKEN) I put where?
Change ansible.cfg to point to vault.py which is located in "plugin" folder of my Ansible Project

To test basic integration, can I use the following playbook? https://pypi.python.org/pypi/ansible-modules-hashivault

- hosts: localhost
    -tasks:
       - hashivault_status:
         register: 'vault_status'

尝试了这个，但我得到了以下结果：

An exception occurred during task execution. The full traceback is:
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/ansible/executor/task_executor.py", line 119, in run
    res = self._execute()
  File "/usr/lib/python2.7/site-packages/ansible/executor/task_executor.py", line 431, in _execute
    self._task.post_validate(templar=templar)
  File "/usr/lib/python2.7/site-packages/ansible/playbook/task.py", line 248, in post_validate
    super(Task, self).post_validate(templar)
  File "/usr/lib/python2.7/site-packages/ansible/playbook/base.py", line 371, in post_validate
    value = templar.template(getattr(self, name))
  File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 359, in template
    d[k] = self.template(variable[k], preserve_trailing_newlines=preserve_trailing_newlines, fail_on_undefined=fail_on_undefined, overrides=overrides)
  File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 331, in template
    result = self._do_template(variable, preserve_trailing_newlines=preserve_trailing_newlines, escape_backslashes=escape_backslashes, fail_on_undefined=fail_on_undefined, overrides=overrides)
  File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 507, in _do_template
    res = j2_concat(rf)
  File "<template>", line 8, in root
  File "/usr/lib/python2.7/site-packages/jinja2/runtime.py", line 193, in call
    return __obj(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 420, in _lookup
    instance = self._lookup_loader.get(name.lower(), loader=self._loader, templar=self)
  File "/usr/lib/python2.7/site-packages/ansible/plugins/__init__.py", line 339, in get
    self._module_cache[path] = self._load_module_source('.'.join([self.package, name]), path)
  File "/usr/lib/python2.7/site-packages/ansible/plugins/__init__.py", line 324, in _load_module_source
    module = imp.load_source(name, path, module_file)
  File "/etc/ansible/ProjectA/lookup_plugins/vault.py", line 5
    <!DOCTYPE html>
    ^
SyntaxError: invalid syntax

fatal: [win01]: FAILED! => {
    "failed": true,
    "msg": "Unexpected failure during module execution.",
    "stdout": ""

- RedAnsible

1

你介意先修复playbook的语法吗？缩进有问题，而且tasks是一个键，不是另一个项目。 - techraf

Vault提供了一个简单的REST API - 你甚至可以使用uri模块。Ansible有令人惊讶的多个查找插件，尽管它应该很简单，但在所有插件中找到一个可用的插件却是出奇的困难 - 你已经找到的那个是可行的。 - techraf

我并不真正理解你在这里问什么。该插件的README非常清晰，并且提供了很好的示例。你是在问什么是环境变量吗？ - techraf

1个回答

网页内容由stack overflow 提供, 点击上面的

可以查看英文原文，
原文链接

- techraf · Accepted Answer

由于您在帖子中提出了这么多问题，我不知道问题的实质是什么，因此在这里为您提供一些关于本地查找插件和 jhaals/ansible-vault 的信息，希望对您有所帮助。

您可以在当前目录下创建 lookup_plugins 并将 vault.py 保存在其中；
环境变量 VAULT_ADDR 和 VAULT_TOKEN 跟脚本中所示相同；

下面是 Bash 脚本（它使用 screen 和 jq，您可能需要先安装它们），运行 Vault 以开发模式启动，设置密钥，然后运行 Ansible playbook，使用两个查找插件查询密钥：

#!/bin/bash
set -euo pipefail

export VAULT_ADDR=http://127.0.0.1:8200

if [[ ! $(pgrep -f "vault server -dev") ]]; then
    echo \"vault server -dev\" not running, starting...
    screen -S vault -d -m vault server -dev
    printf "sleeping for 3 seconds\n"
    sleep 3
else
    echo \"vault server -dev\" already running, leaving as is...
fi

vault write secret/hello value=world excited=yes
export VAULT_TOKEN=$(vault token-create -format=json | jq -r .auth.client_token)
ansible-playbook playbook.yml --extra-vars="vault_token=${VAULT_TOKEN}"

以及playbook.yml：

---
- hosts: localhost
  connection: local
  tasks:
    - name: Retrieve secret/hello using native hashi_vault plugin
      debug: msg="{{ lookup('hashi_vault', 'secret=secret/hello token={{ vault_token }} url=http://127.0.0.1:8200') }}"

    - name: Retrieve secret/hello using jhaals vault lookup
      debug: msg="{{ lookup('vault', 'secret/hello') }}"

最终您应该得到：

在最后，您应该得到：

TASK [Retrieve secret/hello using native hashi_vault plugin] *******************
ok: [localhost] => {
    "msg": "world"
}

TASK [Retrieve secret/hello using jhaals vault lookup] *************************
ok: [localhost] => {
    "msg": {
        "excited": "yes",
        "value": "world"
    }
}

从Vault中获取了单词world。