{"id":42535,"date":"2022-12-08T00:29:35","date_gmt":"2023-06-12T23:16:45","guid":{"rendered":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/"},"modified":"2024-04-29T04:12:50","modified_gmt":"2024-04-28T20:12:50","slug":"%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/","title":{"rendered":"\u4f7f\u7528Ansible-Vault\u8fdb\u884c\u52a0\u5bc6"},"content":{"rendered":"<h2>\u5f15\u5165<\/h2>\n<p>\u4ee5\u524d\u6211\u5199\u8fc7\u4e00\u7bc7\u540d\u4e3a\u201c\u4f7f\u7528\u52a0\u5bc6\u5bc6\u7801\u751f\u6210\u7528\u6237\u201d\u7684\u6587\u7ae0\u3002<br \/>\n\u5f53\u65f6\u6211\u60f3\u8981\u52a0\u5bc6\u7684\u5e76\u4e0d\u662f\u6574\u4e2a\u6587\u4ef6\uff0c\u800c\u662f\u67d0\u4e2a\u53d8\u91cf\u7684\u4e00\u9879\uff0c\u6240\u4ee5\u6ca1\u6709\u4f7f\u7528ansible-vault\u3002<br \/>\n\u4e3a\u4e86\u4e0d\u60f3\u5728\u751f\u6210\u7528\u6237\u65f6\u5c06\u5bc6\u7801\u4ee5\u660e\u6587\u65b9\u5f0f\u663e\u793a\u51fa\u6765\uff0c\u6211\u5c06\u7528Python\u52a0\u5bc6\u540e\u7684\u5bc6\u7801\u76f4\u63a5\u7c98\u8d34\u5230\u4e86\u5267\u672c\u4e2d\u4f7f\u7528\u3002<br \/>\n\u7ed3\u679c\u5f88\u987a\u5229\uff0c\u5f53\u65f6\u6211\u89c9\u5f97\u505a\u5f97\u4e0d\u9519\uff0c\u4f46\u662f\u9700\u8981\u52a0\u5bc6\u7684\u9879\u76ee\u8d8a\u6765\u8d8a\u591a\u3002<br \/>\n\u4f7f\u7528Python\u52a0\u5bc6\u53ea\u80fd\u5e94\u5bf9\u4e0a\u8ff0\u60c5\u51b5\uff0c\u5176\u4ed6\u60c5\u51b5\u5374\u4e0d\u80fd\u9002\u7528\u3002<br \/>\n\u7248\u672c\u5df2\u7ecf\u66f4\u65b0\u4e86\u5f88\u591a\uff0c\u4f1a\u4e0d\u4f1a\u53ef\u4ee5\u53ea\u52a0\u5bc6\u67d0\u4e2a\u53d8\u91cf\u7684\u4e00\u9879\u5462\uff1f\u4e8e\u662f\u6211\u8fdb\u884c\u4e86\u641c\u7d22\uff0c\u7136\u540e&#8230;<\/p>\n<p>\u6709\u3002<\/p>\n<p>\u542c\u8bf4\u4eceAnsible 2.3\u7248\u672c\u5f00\u59cb\uff0c\u6709\u8fd9\u4e2a\u529f\u80fd\u3002<\/p>\n<h2>\u786e\u8ba4ansible-vault\u7684\u5e2e\u52a9\u3002<\/h2>\n<p>\u56e0\u4e3a\u6bcf\u6b21\u90fd\u8981\u6572\u547d\u4ee4\u6765\u68c0\u67e5\u5e2e\u52a9\u592a\u9ebb\u70e6\u4e86\uff0c\u6240\u4ee5\u6211\u628a\u6b65\u9aa4\u8d34\u5728\u6587\u7ae0\u91cc\u4e86\u3002<br \/>\n\u5982\u679c\u4f60\u60f3\u7acb\u5373\u67e5\u770b\u6587\u7ae0\u7684\u5185\u5bb9\uff0c\u8bf7\u8df3\u8fc7\u6b64\u6b65\u9aa4\u3002<\/p>\n<ul class=\"post-ul\">ansible-vault -h<\/ul>\n<pre class=\"post-pre\"><code>ansible-vault <span class=\"nt\">-h<\/span>\r\nUsage: ansible-vault <span class=\"o\">[<\/span>create|decrypt|edit|encrypt|encrypt_string|rekey|view] <span class=\"o\">[<\/span>options] <span class=\"o\">[<\/span>vaultfile.yml]\r\n\r\nencryption\/decryption utility <span class=\"k\">for <\/span>Ansible data files\r\n\r\nOptions:\r\n  <span class=\"nt\">--ask-vault-pass<\/span>      ask <span class=\"k\">for <\/span>vault password\r\n  <span class=\"nt\">-h<\/span>, <span class=\"nt\">--help<\/span>            show this <span class=\"nb\">help <\/span>message and <span class=\"nb\">exit<\/span>\r\n  <span class=\"nt\">--new-vault-id<\/span><span class=\"o\">=<\/span>NEW_VAULT_ID\r\n                        the new vault identity to use <span class=\"k\">for <\/span>rekey\r\n  <span class=\"nt\">--new-vault-password-file<\/span><span class=\"o\">=<\/span>NEW_VAULT_PASSWORD_FILE\r\n                        new vault password file <span class=\"k\">for <\/span>rekey\r\n  <span class=\"nt\">--vault-id<\/span><span class=\"o\">=<\/span>VAULT_IDS  the vault identity to use\r\n  <span class=\"nt\">--vault-password-file<\/span><span class=\"o\">=<\/span>VAULT_PASSWORD_FILES\r\n                        vault password file\r\n  <span class=\"nt\">-v<\/span>, <span class=\"nt\">--verbose<\/span>         verbose mode <span class=\"o\">(<\/span><span class=\"nt\">-vvv<\/span> <span class=\"k\">for <\/span>more, <span class=\"nt\">-vvvv<\/span> to <span class=\"nb\">enable\r\n                        <\/span>connection debugging<span class=\"o\">)<\/span>\r\n  <span class=\"nt\">--version<\/span>             show program<span class=\"s1\">'s version number and exit\r\n\r\n See '<\/span>ansible-vault &lt;<span class=\"nb\">command<\/span><span class=\"o\">&gt;<\/span> <span class=\"nt\">--help<\/span><span class=\"s1\">' for more information on a specific\r\ncommand.\r\n<\/span><\/code><\/pre>\n<ul class=\"post-ul\">ansible-vault encrypt_string &#8211;help<\/ul>\n<pre class=\"post-pre\"><code>ansible-vault encrypt_string <span class=\"nt\">--help<\/span>\r\nUsage: ansible-vault encrypt_string <span class=\"o\">[<\/span><span class=\"nt\">--prompt<\/span><span class=\"o\">]<\/span> <span class=\"o\">[<\/span>options] string_to_encrypt\r\n\r\nencryption\/decryption utility <span class=\"k\">for <\/span>Ansible data files\r\n\r\nOptions:\r\n  <span class=\"nt\">--ask-vault-pass<\/span>      ask <span class=\"k\">for <\/span>vault password\r\n  <span class=\"nt\">--encrypt-vault-id<\/span><span class=\"o\">=<\/span>ENCRYPT_VAULT_ID\r\n                        the vault <span class=\"nb\">id <\/span>used to encrypt <span class=\"o\">(<\/span>required <span class=\"k\">if <\/span>more than\r\n                        vault-id is provided<span class=\"o\">)<\/span>\r\n  <span class=\"nt\">-h<\/span>, <span class=\"nt\">--help<\/span>            show this <span class=\"nb\">help <\/span>message and <span class=\"nb\">exit<\/span>\r\n  <span class=\"nt\">-n<\/span> ENCRYPT_STRING_NAMES, <span class=\"nt\">--name<\/span><span class=\"o\">=<\/span>ENCRYPT_STRING_NAMES\r\n                        Specify the variable name\r\n  <span class=\"nt\">--new-vault-id<\/span><span class=\"o\">=<\/span>NEW_VAULT_ID\r\n                        the new vault identity to use <span class=\"k\">for <\/span>rekey\r\n  <span class=\"nt\">--new-vault-password-file<\/span><span class=\"o\">=<\/span>NEW_VAULT_PASSWORD_FILE\r\n                        new vault password file <span class=\"k\">for <\/span>rekey\r\n  <span class=\"nt\">--output<\/span><span class=\"o\">=<\/span>OUTPUT_FILE  output file name <span class=\"k\">for <\/span>encrypt or decrypt<span class=\"p\">;<\/span> use - <span class=\"k\">for\r\n                        <\/span>stdout\r\n  <span class=\"nt\">-p<\/span>, <span class=\"nt\">--prompt<\/span>          Prompt <span class=\"k\">for <\/span>the string to encrypt\r\n  <span class=\"nt\">--stdin-name<\/span><span class=\"o\">=<\/span>ENCRYPT_STRING_STDIN_NAME\r\n                        Specify the variable name <span class=\"k\">for <\/span>stdin\r\n  <span class=\"nt\">--vault-id<\/span><span class=\"o\">=<\/span>VAULT_IDS  the vault identity to use\r\n  <span class=\"nt\">--vault-password-file<\/span><span class=\"o\">=<\/span>VAULT_PASSWORD_FILES\r\n                        vault password file\r\n  <span class=\"nt\">-v<\/span>, <span class=\"nt\">--verbose<\/span>         verbose mode <span class=\"o\">(<\/span><span class=\"nt\">-vvv<\/span> <span class=\"k\">for <\/span>more, <span class=\"nt\">-vvvv<\/span> to <span class=\"nb\">enable\r\n                        <\/span>connection debugging<span class=\"o\">)<\/span>\r\n  <span class=\"nt\">--version<\/span>             show program<span class=\"s1\">'s version number and exit\r\n\r\n See '<\/span>ansible-vault &lt;<span class=\"nb\">command<\/span><span class=\"o\">&gt;<\/span> <span class=\"nt\">--help<\/span><span class=\"s1\">' for more information on a specific\r\ncommand.\r\n<\/span><\/code><\/pre>\n<p>\u6709\u4ee5\u4e0b\u7684\u9009\u9879\uff1a&#8211;new-vault-id\u548c&#8211;new-vault-password-file\u3002\u4eceansible 2.4+\u5f00\u59cb\uff0c\u53ef\u4ee5\u4f7f\u7528&#8211;vault-id\u9009\u9879\u6765\u521b\u5efa\u591a\u4e2avault-id\u548cvault-passwrod\u3002\u7a0d\u540e\u4f1a\u4e86\u89e3\u5230\u8fd9\u662f\u5173\u4e8e\u4ec0\u4e48\u7684\u5bf9\u8bdd\u3002<\/p>\n<h2>\u4ec5\u5bf9\u53d8\u91cf\u8fdb\u884c\u5355\u9879\u52a0\u5bc6\u3002<\/h2>\n<p>\u5982\u679c\u5728\u4e0d\u6307\u5b9aansible-vault\u5bc6\u7801\u7684\u60c5\u51b5\u4e0b\u4f7f\u7528\uff0c\u5c06\u4f1a\u51fa\u73b0\u4ee5\u4e0b\u9519\u8bef\u3002<\/p>\n<pre class=\"post-pre\"><code>TASK <span class=\"o\">[<\/span>Gathering Facts] <span class=\"k\">***********************************************************************************************************************************************<\/span>\r\nfatal: <span class=\"o\">[<\/span>redmine]: FAILED! <span class=\"o\">=&gt;<\/span> <span class=\"o\">{<\/span><span class=\"s2\">\"msg\"<\/span>: <span class=\"s2\">\"Attempting to decrypt but no vault secrets found\"<\/span><span class=\"o\">}<\/span>\r\n        to retry, use: <span class=\"nt\">--limit<\/span> @\/Users\/devtopia\/.ansible\/retry-files\/redmine.retry\r\n<\/code><\/pre>\n<p>\u53ea\u9700\u6307\u5b9a\u5bc6\u7801\u5e76\u4f7f\u7528\uff0c\u4fbf\u53ef\u901a\u8fc7\uff0c\u56e0\u6b64\u8bf7\u5148\u51c6\u5907\u597d\u5bc6\u7801\u6587\u4ef6\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c\"># \u5fa9\u53f7\u5316\u3059\u308b\u70ba\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092git repository\u3067\u306f\u306a\u3044\u4ed6\u306e\u3068\u3053\u308d\u306b\u4fdd\u5b58\u3059\u308b\u3002<\/span>\r\n<span class=\"nb\">echo<\/span> <span class=\"s1\">'PASSWORD'<\/span> <span class=\"o\">&gt;<\/span> ~\/.vault_pass\r\n<\/code><\/pre>\n<p>\u5728\u8fd9\u91cc\uff0c\u6211\u5c06\u5bf9\u53d8\u91cf&#8221;ansible_password&#8221;\u8fdb\u884c\u52a0\u5bc6\u5904\u7406\u3002<br \/>\n\u4e4b\u524d\uff0c\u6211\u4eec\u5c06\u5176\u4fdd\u5b58\u5728&#8221;hosts.ini&#8221;\u6587\u4ef6\u4e2d\uff0c\u5e76\u4e14\u5728&#8221;.gitignore&#8221;\u6587\u4ef6\u4e2d\u6307\u5b9a\u4e86\u5ffd\u7565\u8be5\u6587\u4ef6\u3002<br \/>\n\u73b0\u5728\u6211\u5c06&#8221;ansible_user&#8221;\u548c&#8221;ansible_password&#8221;\u4ece&#8221;hosts.ini&#8221;\u79fb\u52a8\u5230&#8221;groups_var\/all.yml&#8221;\u4e2d\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c\"># ansible_password\u3068\u3044\u3046variable\u3092\u6697\u53f7\u5316\u3059\u308b\u3002<\/span>\r\n<span class=\"nb\">echo<\/span> <span class=\"nt\">-n<\/span> <span class=\"s1\">'PASSWORD'<\/span> | ansible-vault encrypt_string <span class=\"nt\">--vault-id<\/span> dev@~\/.vault_pass <span class=\"nt\">--stdin-name<\/span> <span class=\"s1\">'ansible_password'<\/span>\r\n\r\nReading plaintext input from stdin. <span class=\"o\">(<\/span>ctrl-d to end input<span class=\"o\">)<\/span>\r\nansible_password: <span class=\"o\">!<\/span>vault |\r\n          <span class=\"nv\">$ANSIBLE_VAULT<\/span><span class=\"p\">;<\/span>1.2<span class=\"p\">;<\/span>AES256<span class=\"p\">;<\/span>dev\r\n          38653564306332366561363062643632663834656465366430306139376163386535303539303034\r\n          3335393633333538656534343631336238653063626135320a303834396534366235333030373464\r\n          62336538663566653765646331666130323061373262646166613834343939323938333666303162\r\n          3164303437306662630a646534643661323065373339363166366633363337396330323563656533\r\n          3635\r\nEncryption successful\r\n<\/code><\/pre>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">&#8216;PASSWORD&#8217;\u306e\u3068\u3053\u308d\u306b\u5b9f\u969b\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5165\u529b\u3059\u308b\u3002<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">encrypt_string\u3068\u3044\u3046\u306e\u304c1\u9805\u76ee\u3060\u3051\u6697\u53f7\u5316\u3059\u308b\u70ba\u306e\u30b5\u30d6\u30b3\u30de\u30f3\u30c9\u3067\u3042\u308b\u3002<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">&#8211;vault-id\u3067\u300c\u30e9\u30d9\u30eb\u540d@\u30d1\u30b9\u30ef\u30fc\u30c9\u30d5\u30a1\u30a4\u30eb\u306e\u30d1\u30b9\u300d<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">&#8211;stdin-name\u306b\u306f\u6697\u53f7\u5316\u3057\u305f\u3044variable\u540d\uff08\u3053\u3053\u3067\u306fansible_password\uff09\u3092\u5165\u529b\u3059\u308b\u3002<\/ul>\n<p>\u4f7f\u7528ansible-vault\u8fdb\u884c\u52a0\u5bc6\u65f6\uff0c\u6267\u884cansible\u6216ansible-playbook\u547d\u4ee4\u65f6\uff0c\u5fc5\u987b\u901a\u8fc7\u9009\u9879\u6307\u5b9a\u5bc6\u7801\u6587\u4ef6\u3002\u6b63\u5982\u5f00\u5934\u6240\u63d0\u5230\u7684\uff0c\u5982\u679c\u4e0d\u6307\u5b9a\u5bc6\u7801\u6587\u4ef6\uff0c\u5c06\u4f1a\u51fa\u73b0\u9519\u8bef\u3002<\/p>\n<pre class=\"post-pre\"><code>ansible-playbook dev.yml <span class=\"nt\">--vault-password-file<\/span> ~\/.vault_pass\r\n\r\n<span class=\"c\"># ansible 2.4+<\/span>\r\nansible-playbook dev.yml <span class=\"nt\">--vault-id<\/span> ~\/.vault_pass\r\n<\/code><\/pre>\n<p>\u7531\u4e8e\u6bcf\u6b21\u8f93\u5165\u201c&#8211;vault-password-file ~\/.vault_pass\u201d\u5f88\u9ebb\u70e6\uff0c\u6240\u4ee5\u53ef\u4ee5\u5c06\u5bc6\u7801\u6587\u4ef6\u8bbe\u7f6e\u4e3a\u73af\u5883\u53d8\u91cfANSIBLE_VAULT_PASSWORD_FILE\uff0c\u5e76\u4f7f\u7528\u5b83\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c\"># \u74b0\u5883\u5909\u6570\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u306b\u8ffd\u52a0<\/span>\r\nvim ~\/.bash_profile\r\n... snip ...\r\n<span class=\"nb\">export <\/span>ANSIBLE_VAULT_PASSWORD_FILE <span class=\"o\">=<\/span> ~\/.vault_pass\r\n... snip ...\r\n\r\n<span class=\"c\"># \u8ffd\u52a0\u3057\u305f\u3082\u306e\u3092\u9069\u7528\u3059\u308b\u305f\u3081\u306b\u518d\u8aad\u8fbc<\/span>\r\n<span class=\"nb\">source<\/span> ~\/.bash_profile\r\n\r\n<span class=\"c\"># --vault-id\u3084--vault-password-file\u306a\u3057\u3067\u4f7f\u3048\u308b\u3002<\/span>\r\nansible-playbook dev.yml\r\n<\/code><\/pre>\n<p>\u4e0d\u4ec5\u53ef\u4ee5\u901a\u8fc7\u73af\u5883\u53d8\u91cf\uff0c\u8fd8\u53ef\u4ee5\u901a\u8fc7ansible.cfg\u6765\u8fdb\u884c\u914d\u7f6e\u3002<\/p>\n<pre class=\"post-pre\"><code>... snip ...\r\nvault_password_file <span class=\"o\">=<\/span> ~\/.vault_pass\r\n<\/code><\/pre>\n<p>\u5728\u5c1d\u8bd5\u5220\u9664\u73af\u5883\u53d8\u91cf\u540e\uff0c\u7a0b\u5e8f\u6b63\u5e38\u8fd0\u884c\u4e86\u3002<\/p>\n<p>\u63a5\u4e0b\u6765\uff0c\u5f53\u5c1d\u8bd5\u52a0\u5bc6\u5176\u4ed6\u53d8\u91cf\u65f6\u53d1\u751f\u4e86\u9519\u8bef\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nb\">echo<\/span> <span class=\"nt\">-n<\/span> <span class=\"s1\">'PASSWORD'<\/span> | ansible-vault encrypt_string <span class=\"nt\">--vault-id<\/span> dev@~\/.vault_pass <span class=\"nt\">--stdin<\/span> redmine_password\r\nUsage: ansible-vault encrypt_string <span class=\"o\">[<\/span><span class=\"nt\">--prompt<\/span><span class=\"o\">]<\/span> <span class=\"o\">[<\/span>options] string_to_encrypt\r\n... snip ...\r\ncommand.\r\nERROR! The vault-ids dev,default are available to encrypt. Specify the vault-id to encrypt with <span class=\"nt\">--encrypt-vault-id<\/span>\r\n<\/code><\/pre>\n<p>\u51b3\u7b56\u5982\u4e0b\uff0c\u8be5\u9009\u9879\u63d0\u4f9b\u4e2d\u6587\u7ffb\u8bd1\uff1a<br \/>\n&#8220;vault-ids dev\u3001default\u53ef\u7528\u4e8e\u52a0\u5bc6\u3002\u8bf7\u4f7f\u7528&#8211;encrypt-vault-id\u6307\u5b9a\u8981\u4f7f\u7528\u7684vault-id\u3002&#8221;<br \/>\n\u5982\u679c\u6309\u7167\u7ed9\u51fa\u7684\u6307\u4ee4\u5c1d\u8bd5\u4f7f\u7528&#8211;encrypt-vault-id\uff0c\u4ecd\u7136\u51fa\u73b0\u9519\u8bef\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nb\">echo<\/span> <span class=\"nt\">-n<\/span> <span class=\"s1\">'PASSWORD'<\/span> | ansible-vault encrypt_string <span class=\"nt\">--encrypt-vault-id<\/span> dev@~\/.vault_pass <span class=\"nt\">--stdin<\/span> redmine_password\r\nERROR! Did not find a match <span class=\"k\">for<\/span> <span class=\"nt\">--encrypt-vault-id<\/span><span class=\"o\">=<\/span>dev@~\/.vault_pass <span class=\"k\">in <\/span>the known vault-ids <span class=\"o\">[<\/span><span class=\"s1\">'default'<\/span><span class=\"o\">]<\/span>\r\n<\/code><\/pre>\n<p>\u80fd\u627e\u5230 vault-id\u5417\uff1f\u4e4b\u524d\u6709dev\u548cdefault\u53ef\u7528\uff0c\u4f46\u73b0\u5728\u53ea\u6709default\u4e86\u3002<br \/>\n\u53ef\u80fd\u662f\u56e0\u4e3a\u4e0e\u5bc6\u7801\u6587\u4ef6\u4e00\u8d77\u5199\u7684\u539f\u56e0\uff0c\u8bd5\u8fc7\u53ea\u66f4\u6539\u4e3adev\uff0c\u4f46\u662f\u51fa\u73b0\u540c\u6837\u7684\u9519\u8bef\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nb\">echo<\/span> <span class=\"nt\">-n<\/span> <span class=\"s1\">'PASSWORD'<\/span> | ansible-vault encrypt_string <span class=\"nt\">--encrypt-vault-id<\/span> dev <span class=\"nt\">--stdin<\/span> redmine_password\r\nERROR! Did not find a match <span class=\"k\">for<\/span> <span class=\"nt\">--encrypt-vault-id<\/span><span class=\"o\">=<\/span>dev <span class=\"k\">in <\/span>the known vault-ids <span class=\"o\">[<\/span><span class=\"s1\">'default'<\/span><span class=\"o\">]<\/span>\r\n<\/code><\/pre>\n<p>\u5f53\u6211\u5c1d\u8bd5\u641c\u7d22\u65f6\uff0c\u6211\u53d1\u73b0\u8fd8\u6709\u4e00\u4e2a\u540d\u4e3a&#8221;vault_identity_list&#8221;\u7684\u914d\u7f6e\u503c\u3002<\/p>\n<pre class=\"post-pre\"><code>... snip ...\r\nvault_password_file <span class=\"o\">=<\/span> ~\/.vault_pass\r\nvault_identity_list <span class=\"o\">=<\/span> dev@~\/.vault_pass\r\n<\/code><\/pre>\n<p>\u5982\u679c\u5c06\u5176\u6dfb\u52a0\u5230ansible.cfg\u5e76\u91cd\u65b0\u6267\u884c\uff0c\u5219\u4f1a\u6210\u529f\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nb\">echo<\/span> <span class=\"nt\">-n<\/span> <span class=\"s1\">'PASSWORD'<\/span> | ansible-vault encrypt_string <span class=\"nt\">--encrypt-vault-id<\/span> dev <span class=\"nt\">--stdin<\/span> redmine_password\r\nReading plaintext input from stdin. <span class=\"o\">(<\/span>ctrl-d to end input<span class=\"o\">)<\/span>\r\nredmine_password: <span class=\"o\">!<\/span>vault |\r\n          <span class=\"nv\">$ANSIBLE_VAULT<\/span><span class=\"p\">;<\/span>1.2<span class=\"p\">;<\/span>AES256<span class=\"p\">;<\/span>dev\r\n          61643061336363643331323437643535356333633439303532646430636534646331373136323234\r\n          3034373631396339306466373966643636353430303235320a646635336539646131343264306433\r\n          65626333643864636639353833326462323166636434393539613663333365383134366635373337\r\n          3866346238313866630a626135663230323462366661653434316361333636353530326231623437\r\n          3736\r\nEncryption successful\r\n<\/code><\/pre>\n<p>\u770b\u8d77\u6765\uff0c&#8211;vault-id\u548c&#8211;vault-password-file\u4f3c\u4e4e\u6709\u76f8\u540c\u7684\u7528\u9014\u3002<br \/>\n\u5f53\u6211\u641c\u7d22&#8221;vault-id vs vault-password-file&#8221;\u65f6\uff0c\u8fd9\u4e2a\u5173\u952e\u8bcd\u81ea\u52a8\u5f39\u51fa\u3002<br \/>\n&#8211;vault-id\u662f\u5728&#8211;vault-password-file\u57fa\u7840\u4e0a\u8fdb\u884c\u4e86\u529f\u80fd\u6269\u5c55\uff0c\u4e24\u8005\u90fd\u53ef\u4ee5\u4f7f\u7528\uff0c\u4f46\u53ea\u4f7f\u7528&#8211;vault-id\u4e5f\u662f\u53ef\u4ee5\u7684\u3002\u8fd9\u5e94\u8be5\u662f\u5176\u610f\u601d\u3002<\/p>\n<p>\u5982\u679c\u6211\u5f9eansible.cfg\u4e2d\u522a\u9664\u4e86vault_password_file\u4e26\u5617\u8a66\u5f8c\uff0c\u6210\u529f\u4e86\u3002<\/p>\n<p>\u53ef\u80fd\u53ea\u9700\u8981\u5c06\u6807\u7b7e\u540d\u4e3a&#8221;dev&#8221;\u7684\u9879\u6dfb\u52a0\u5230&#8221;vault_identity_list&#8221;\u4e2d\u5373\u53ef\uff0c\u5982\u679c\u672a\u5728ansible.cfg\u4e2d\u6dfb\u52a0&#8221;vault_identity_list&#8221;\uff0c\u5219\u53ea\u4f1a\u4f7f\u7528\u9ed8\u8ba4\u9009\u9879\u3002<\/p>\n<p>\u8fd9\u5bf9\u6211\u6765\u8bf4\u5f88\u6709\u5e2e\u52a9\u3002<\/p>\n<h2>\u5bf9\u6574\u4e2a\u6587\u4ef6\u8fdb\u884c\u52a0\u5bc6\u3002<\/h2>\n<p>\u5c06groups_var\/db.yml\u4e2d\u5b58\u653e\u7740\u6570\u636e\u5e93\u8fde\u63a5\u4fe1\u606f\u7684\u6587\u4ef6\u8fdb\u884c\u6574\u4f53\u52a0\u5bc6\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c\"># \u6697\u53f7\u5316<\/span>\r\nansible-vault create group_vars\/db.yml\r\n\r\n<span class=\"c\"># \u6697\u53f7\u5316\u3057\u305f\u5f8c\u3001\u30d5\u30a1\u30a4\u30eb\u306e\u5185\u5bb9<\/span>\r\n<span class=\"nb\">cat <\/span>group_vars\/db.yml\r\n<span class=\"nv\">$ANSIBLE_VAULT<\/span><span class=\"p\">;<\/span>1.1<span class=\"p\">;<\/span>AES256\r\n65656533363866316462313831663032353031626239633333323862323132616239306130303162\r\n3531363266336538376239646430656134363132633339320a636531653933636336306339636666\r\n35373765653935636233353733323538333835316139373632633131326231653838303862346338\r\n3963663332346263340a613932326665303631373932313364623232666535326235383836356336\r\n34373536336139363865633336313762393761386234353830643835376639376662623636363864\r\n37383136396436366231616130376636303039396236343266633930383230363635306332643136\r\n64633865386636636135383363663065396637636435666635653737383061616635616532373865\r\n64343165393335353231363539383635666562653936316264316330373438646564323161303066\r\n34363735323534383461623933333965626634393863386661613030656237346361306336663733\r\n37646531623432336262653030613461653262313831653365323536663034623439363562326365\r\n30356662396231353737346565666230313934343034316333323533313066333130393064323162\r\n31653434383939386164303838623633396665323530633738376262633232346337303661353261\r\n31623463376665383637663466613137313539333366343231303431313434346564366665363062\r\n3034303034653130666531343434346430653030393231373635\r\n\r\n<span class=\"c\"># \u5e73\u6587\u3067\u7de8\u96c6\u53ef\u80fd<\/span>\r\nansible-vault edit group_vars\/db.yml <span class=\"nt\">--vault-password-file<\/span> ~\/.vault_password\r\n\r\n<span class=\"c\"># export ANSIBLE_VAULT_PASSWORD_FILE=~\/.vault_pass \u3057\u305f\u5834\u5408<\/span>\r\nansible-vault edit group_vars\/db.yml\r\n<\/code><\/pre>\n<h2>\u8bf7\u53c2\u7167\u4ee5\u4e0b\u5185\u5bb9\u3002<\/h2>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">https:\/\/docs.ansible.com\/ansible\/latest\/user_guide\/playbooks_vault.html#single-encrypted-variable<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">https:\/\/qiita.com\/yunano\/items\/86d3f9beb678adbff50d<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">https:\/\/qiita.com\/takuya599\/items\/2420fb286318c4279a02<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u5f15\u5165 \u4ee5\u524d\u6211\u5199\u8fc7\u4e00\u7bc7\u540d\u4e3a\u201c\u4f7f\u7528\u52a0\u5bc6\u5bc6\u7801\u751f\u6210\u7528\u6237\u201d\u7684\u6587\u7ae0\u3002 \u5f53\u65f6\u6211\u60f3\u8981\u52a0\u5bc6\u7684\u5e76\u4e0d\u662f\u6574\u4e2a\u6587\u4ef6\uff0c\u800c\u662f\u67d0\u4e2a\u53d8\u91cf\u7684\u4e00\u9879\uff0c [&hellip;]<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-42535","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.5 (Yoast SEO v21.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u4f7f\u7528Ansible-Vault\u8fdb\u884c\u52a0\u5bc6 - Blog - Silicon Cloud<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/zh\/blog\/\u4f7f\u7528ansible-vault\u8fdb\u884c\u52a0\u5bc6\u3002\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u4f7f\u7528Ansible-Vault\u8fdb\u884c\u52a0\u5bc6\" \/>\n<meta property=\"og:description\" content=\"\u5f15\u5165 \u4ee5\u524d\u6211\u5199\u8fc7\u4e00\u7bc7\u540d\u4e3a\u201c\u4f7f\u7528\u52a0\u5bc6\u5bc6\u7801\u751f\u6210\u7528\u6237\u201d\u7684\u6587\u7ae0\u3002 \u5f53\u65f6\u6211\u60f3\u8981\u52a0\u5bc6\u7684\u5e76\u4e0d\u662f\u6574\u4e2a\u6587\u4ef6\uff0c\u800c\u662f\u67d0\u4e2a\u53d8\u91cf\u7684\u4e00\u9879\uff0c [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/zh\/blog\/\u4f7f\u7528ansible-vault\u8fdb\u884c\u52a0\u5bc6\u3002\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2023-06-12T23:16:45+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-28T20:12:50+00:00\" \/>\n<meta name=\"author\" content=\"\u65b0, \u97f5\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u65b0, \u97f5\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/\",\"name\":\"\u4f7f\u7528Ansible-Vault\u8fdb\u884c\u52a0\u5bc6 - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\"},\"datePublished\":\"2023-06-12T23:16:45+00:00\",\"dateModified\":\"2024-04-28T20:12:50+00:00\",\"author\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/4ba4019495123db3038fd0809e6959c9\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.silicloud.com\/zh\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u4f7f\u7528Ansible-Vault\u8fdb\u884c\u52a0\u5bc6\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/\",\"name\":\"Blog - Silicon Cloud\",\"description\":\"\",\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/4ba4019495123db3038fd0809e6959c9\",\"name\":\"\u65b0, \u97f5\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d484b6c6e4ae82e8a9efea989e1d2af46d9b6ef128101e63b18f559fca0ae627?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d484b6c6e4ae82e8a9efea989e1d2af46d9b6ef128101e63b18f559fca0ae627?s=96&d=mm&r=g\",\"caption\":\"\u65b0, \u97f5\"},\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/author\/yunxin\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Blog - Silicon Cloud\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u4f7f\u7528Ansible-Vault\u8fdb\u884c\u52a0\u5bc6 - Blog - Silicon Cloud","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/zh\/blog\/\u4f7f\u7528ansible-vault\u8fdb\u884c\u52a0\u5bc6\u3002\/","og_locale":"zh_CN","og_type":"article","og_title":"\u4f7f\u7528Ansible-Vault\u8fdb\u884c\u52a0\u5bc6","og_description":"\u5f15\u5165 \u4ee5\u524d\u6211\u5199\u8fc7\u4e00\u7bc7\u540d\u4e3a\u201c\u4f7f\u7528\u52a0\u5bc6\u5bc6\u7801\u751f\u6210\u7528\u6237\u201d\u7684\u6587\u7ae0\u3002 \u5f53\u65f6\u6211\u60f3\u8981\u52a0\u5bc6\u7684\u5e76\u4e0d\u662f\u6574\u4e2a\u6587\u4ef6\uff0c\u800c\u662f\u67d0\u4e2a\u53d8\u91cf\u7684\u4e00\u9879\uff0c [&hellip;]","og_url":"https:\/\/www.silicloud.com\/zh\/blog\/\u4f7f\u7528ansible-vault\u8fdb\u884c\u52a0\u5bc6\u3002\/","og_site_name":"Blog - Silicon Cloud","article_published_time":"2023-06-12T23:16:45+00:00","article_modified_time":"2024-04-28T20:12:50+00:00","author":"\u65b0, \u97f5","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"\u65b0, \u97f5","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"3 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/","url":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/","name":"\u4f7f\u7528Ansible-Vault\u8fdb\u884c\u52a0\u5bc6 - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website"},"datePublished":"2023-06-12T23:16:45+00:00","dateModified":"2024-04-28T20:12:50+00:00","author":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/4ba4019495123db3038fd0809e6959c9"},"breadcrumb":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.silicloud.com\/zh\/blog\/"},{"@type":"ListItem","position":2,"name":"\u4f7f\u7528Ansible-Vault\u8fdb\u884c\u52a0\u5bc6"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website","url":"https:\/\/www.silicloud.com\/zh\/blog\/","name":"Blog - Silicon Cloud","description":"","inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/4ba4019495123db3038fd0809e6959c9","name":"\u65b0, \u97f5","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d484b6c6e4ae82e8a9efea989e1d2af46d9b6ef128101e63b18f559fca0ae627?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d484b6c6e4ae82e8a9efea989e1d2af46d9b6ef128101e63b18f559fca0ae627?s=96&d=mm&r=g","caption":"\u65b0, \u97f5"},"url":"https:\/\/www.silicloud.com\/zh\/blog\/author\/yunxin\/"},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8ansible-vault%e8%bf%9b%e8%a1%8c%e5%8a%a0%e5%af%86%e3%80%82\/#local-main-organization-logo","url":"","contentUrl":"","caption":"Blog - Silicon Cloud"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/42535","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/comments?post=42535"}],"version-history":[{"count":2,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/42535\/revisions"}],"predecessor-version":[{"id":80946,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/42535\/revisions\/80946"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/media?parent=42535"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/categories?post=42535"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/tags?post=42535"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}