使用Hashicorp Vault with Ansible - 插件安裝

我想用Ansible的Hashicorp Vault來檢索我將在Ansible playbook中使用的用戶名/密碼。使用Hashicorp Vault with Ansible - 插件安裝

保險櫃設置 - 我創建了一個祕密。整合兩者的步驟是什麼？圍繞插件的文檔並不是那麼好。我嘗試從ansible和這個作品的文件查找，但如何使用第三方插件？有人可以幫助我遵循以下步驟嗎？

安裝插件，pip install ansible-modules-hashivault
有什麼用https://github.com/jhaals/ansible-vault
2.a的環境變量（VAULT ADDR & VAULT TOKEN）我把區別在哪裏？
變化ansible.cfg指向vault.py這是位於我Ansible項目
的「插件」文件夾，測試基本的整合，我可以使用下面的劇本？ https://pypi.python.org/pypi/ansible-modules-hashivault
```
- hosts: localhost 
    -tasks: 
     - hashivault_status: 
     register: 'vault_status' 
```

試過，但我得到：

An exception occurred during task execution. The full traceback is: 
Traceback (most recent call last): 
    File "/usr/lib/python2.7/site-packages/ansible/executor/task_executor.py", line 119, in run 
    res = self._execute() 
    File "/usr/lib/python2.7/site-packages/ansible/executor/task_executor.py", line 431, in _execute 
    self._task.post_validate(templar=templar) 
    File "/usr/lib/python2.7/site-packages/ansible/playbook/task.py", line 248, in post_validate 
    super(Task, self).post_validate(templar) 
    File "/usr/lib/python2.7/site-packages/ansible/playbook/base.py", line 371, in post_validate 
    value = templar.template(getattr(self, name)) 
    File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 359, in template 
    d[k] = self.template(variable[k], preserve_trailing_newlines=preserve_trailing_newlines, fail_on_undefined=fail_on_undefined, overrides=overrides) 
    File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 331, in template 
    result = self._do_template(variable, preserve_trailing_newlines=preserve_trailing_newlines, escape_backslashes=escape_backslashes, fail_on_undefined=fail_on_undefined, overrides=overrides) 
    File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 507, in _do_template 
    res = j2_concat(rf) 
    File "<template>", line 8, in root 
    File "/usr/lib/python2.7/site-packages/jinja2/runtime.py", line 193, in call 
    return __obj(*args, **kwargs) 
    File "/usr/lib/python2.7/site-packages/ansible/template/__init__.py", line 420, in _lookup 
    instance = self._lookup_loader.get(name.lower(), loader=self._loader, templar=self) 
    File "/usr/lib/python2.7/site-packages/ansible/plugins/__init__.py", line 339, in get 
    self._module_cache[path] = self._load_module_source('.'.join([self.package, name]), path) 
    File "/usr/lib/python2.7/site-packages/ansible/plugins/__init__.py", line 324, in _load_module_source 
    module = imp.load_source(name, path, module_file) 
    File "/etc/ansible/ProjectA/lookup_plugins/vault.py", line 5 
    <!DOCTYPE html> 
    ^
SyntaxError: invalid syntax 

fatal: [win01]: FAILED! => { 
    "failed": true, 
    "msg": "Unexpected failure during module execution.", 
    "stdout": ""

來源

2016-12-29 RedAnsible

你介意先修復你的劇本的語法嗎？縮進被打破，「任務」是一個關鍵，而不是另一個項目。 – techraf

Vault提供了一個簡單的REST API - 您甚至可以使用[uri]（https://docs.ansible.com/ansible/uri_module.html）模塊。令人驚訝的是Ansible提供了許多查找插件，儘管它應該很簡單，但找到一個適用於所有這些插件的工具卻非常困難 - [您已經找到的那個插件]（https://github.com/jhaals/ansible-vault）作品。 – techraf

我真的不明白你在這裏問的問題。該插件的README非常清晰，並提供了很好的示例。你問什麼[環境變量]（https://en.wikipedia.org/wiki/Environment_variablehttps://en.wikipedia.org/wiki/Environment_variable）是什麼？ – techraf

既然你把這麼多雞蛋進入後，我不知道這個問題是關於什麼的，這裏的東西讓你用本機查找插件和jhaals/ansible-vault。

，你可以在當前目錄下創建lookup_plugins並保存vault.py內;
VAULT_ADDR和VAULT_TOKEN環境變量如同您在腳本中看到的那樣;

以下（它使用screen和jq，你可能需要安裝它們）運行庫的開發模式下，bash腳本設置了祕密，並運行Ansible劇本與兩個查找插件查詢祕密：

#!/bin/bash 
set -euo pipefail 

export VAULT_ADDR=http://127.0.0.1:8200 

if [[ ! $(pgrep -f "vault server -dev") ]]; then 
    echo \"vault server -dev\" not running, starting... 
    screen -S vault -d -m vault server -dev 
    printf "sleeping for 3 seconds\n" 
    sleep 3 
else 
    echo \"vault server -dev\" already running, leaving as is... 
fi 

vault write secret/hello value=world excited=yes 
export VAULT_TOKEN=$(vault token-create -format=json | jq -r .auth.client_token) 
ansible-playbook playbook.yml --extra-vars="vault_token=${VAULT_TOKEN}"

和playbook.yml：

--- 
- hosts: localhost 
    connection: local 
    tasks: 
    - name: Retrieve secret/hello using native hashi_vault plugin 
     debug: msg="{{ lookup('hashi_vault', 'secret=secret/hello token={{ vault_token }} url=http://127.0.0.1:8200') }}" 

    - name: Retrieve secret/hello using jhaals vault lookup 
     debug: msg="{{ lookup('vault', 'secret/hello') }}"

你到底應該得到：

TASK [Retrieve secret/hello using native hashi_vault plugin] ******************* 
ok: [localhost] => { 
    "msg": "world" 
} 

TASK [Retrieve secret/hello using jhaals vault lookup] ************************* 
ok: [localhost] => { 
    "msg": { 
     "excited": "yes", 
     "value": "world" 
    } 
}

單詞world是從保險櫃中提取的。

來源

2016-12-29 13:13:27 techraf

Thx techraf，我現在就得到了兩個插件和運行！ – RedAnsible

使用Hashicorp Vault with Ansible - 插件安裝

回答

相關問題