Ansible Vault #

┌─────────────────────────────────────────────────────────────┐
│                    Vault 工作流程                            │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│  明文文件               加密                 解密            │
│  ──────────            ──────────           ──────────      │
│  password: secret      $ANSIBLE_VAULT       password: secret │
│  api_key: key123       1.1...               api_key: key123  │
│                        AES256...                             │
│                                                              │
│                        加密密码保护                           │
│                                                              │
└─────────────────────────────────────────────────────────────┘

# 创建加密的 YAML 文件
ansible-vault create secrets.yml

# 会提示输入密码，然后打开编辑器
# 输入内容后保存退出，文件自动加密

# 加密现有文件
ansible-vault encrypt secrets.yml

# 加密多个文件
ansible-vault encrypt file1.yml file2.yml file3.yml

# 使用密码文件创建
ansible-vault create --vault-password-file ~/.vault_pass secrets.yml

# 使用密码文件加密
ansible-vault encrypt --vault-password-file ~/.vault_pass secrets.yml

# 编辑加密文件
ansible-vault edit secrets.yml

# 使用密码文件
ansible-vault edit --vault-password-file ~/.vault_pass secrets.yml

# 查看加密文件内容
ansible-vault view secrets.yml

# 使用密码文件
ansible-vault view --vault-password-file ~/.vault_pass secrets.yml

# 解密文件（永久解密）
ansible-vault decrypt secrets.yml

# 解密到标准输出
ansible-vault decrypt --output=- secrets.yml

# 解密到新文件
ansible-vault decrypt secrets.yml --output=secrets_decrypted.yml

# 执行 Playbook 时提供密码
ansible-playbook site.yml --ask-vault-pass

# 使用密码文件
ansible-playbook site.yml --vault-password-file ~/.vault_pass

# 使用多个密码文件
ansible-playbook site.yml --vault-password-file pass1.txt --vault-password-file pass2.txt

# 修改密码
ansible-vault rekey secrets.yml

# 使用密码文件修改
ansible-vault rekey --vault-password-file ~/.vault_pass secrets.yml

# 使用新密码文件
ansible-vault rekey --new-vault-password-file ~/.new_vault_pass secrets.yml

# 加密字符串
ansible-vault encrypt_string 'my_secret_password' --name 'db_password'

# 输出
db_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          663864396539666364663166363964...

# 加密字符串并保存
ansible-vault encrypt_string 'my_secret_password' --name 'db_password' >> vars.yml

# 从 stdin 读取
echo 'my_secret_password' | ansible-vault encrypt_string --stdin-name 'db_password'

---
- name: Use encrypted string
  hosts: databases
  vars:
    db_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          663864396539666364663166363964...
  
  tasks:
    - name: Configure database
      mysql_user:
        name: appuser
        password: "{{ db_password }}"

# secrets.yml (加密文件)
---
db_root_password: SuperSecretPassword123!
db_app_password: AppPassword456!
api_key: sk-1234567890abcdef
ssl_certificate: |
  -----BEGIN CERTIFICATE-----
  MIIDXTCCAkWgAwIBAgIJAJC1HiIAZAiUMA0G...
  -----END CERTIFICATE-----

# site.yml
---
- name: Deploy application
  hosts: app_servers
  vars_files:
    - secrets.yml
  
  tasks:
    - name: Configure database
      mysql_user:
        name: appuser
        password: "{{ db_app_password }}"

# inventory/group_vars/databases.yml (加密文件)
---
mysql_root_password: "{{ vault_mysql_root_password }}"
mysql_replication_password: "{{ vault_mysql_replication_password }}"

# 创建密码文件
echo "my_vault_password" > ~/.vault_pass

# 设置权限
chmod 600 ~/.vault_pass

# ansible.cfg
[defaults]
vault_password_file = ~/.vault_pass

#!/bin/bash
# ~/.vault_pass.sh

# 从环境变量获取
echo $VAULT_PASSWORD

# 或从密钥管理服务获取
# aws ssm get-parameter --name "/ansible/vault_password" --with-decryption --query "Parameter.Value" --output text

# ansible.cfg
[defaults]
vault_password_file = ~/.vault_pass.sh

# 使用 Vault ID 创建文件
ansible-vault create --vault-id prod@~/.vault_prod secrets_prod.yml
ansible-vault create --vault-id dev@~/.vault_dev secrets_dev.yml

# 使用 Vault ID 加密
ansible-vault encrypt --vault-id prod@~/.vault_prod secrets_prod.yml

# 执行时指定 Vault ID
ansible-playbook site.yml --vault-id prod@~/.vault_prod --vault-id dev@~/.vault_dev

project/
├── .vault/
│   ├── prod_pass    # 生产环境密码
│   ├── staging_pass # 预发环境密码
│   └── dev_pass     # 开发环境密码
├── inventory/
│   ├── production/
│   │   └── group_vars/
│   │       └── secrets.yml    # 使用 prod_pass 加密
│   ├── staging/
│   │   └── group_vars/
│   │       └── secrets.yml    # 使用 staging_pass 加密
│   └── development/
│       └── group_vars/
│           └── secrets.yml    # 使用 dev_pass 加密
└── ansible.cfg

# ansible.cfg
[defaults]
vault_identity_list = prod@.vault/prod_pass, staging@.vault/staging_pass, dev@.vault/dev_pass

inventory/
├── group_vars/
│   ├── all.yml           # 非敏感变量
│   ├── webservers.yml    # 非敏感变量
│   └── vault/
│       └── all.yml       # 加密的敏感变量

# inventory/group_vars/all.yml (明文)
---
db_host: localhost
db_port: 3306
db_user: appuser
db_password: "{{ vault_db_password }}"

# inventory/group_vars/vault/all.yml (加密)
---
vault_db_password: SuperSecretPassword123!

# .gitignore
.vault_pass
.vault/
*.pass

# 加密文件应该提交到版本控制
# !secrets.yml

# 开发环境：使用密码文件
echo "dev_password" > .vault_dev_pass

# 生产环境：使用密钥管理服务
# AWS Secrets Manager
aws secretsmanager get-secret-value --secret-id ansible/vault_password --query SecretString --output text > .vault_prod_pass

# HashiCorp Vault
vault kv get -field=password secret/ansible/vault > .vault_prod_pass

# .gitlab-ci.yml
deploy:
  stage: deploy
  script:
    - echo "$VAULT_PASSWORD" > .vault_pass
    - ansible-playbook -i inventory/production site.yml --vault-password-file .vault_pass
    - rm .vault_pass
  only:
    - main

# GitHub Actions
- name: Deploy with Ansible
  env:
    VAULT_PASSWORD: ${{ secrets.VAULT_PASSWORD }}
  run: |
    echo "$VAULT_PASSWORD" > .vault_pass
    ansible-playbook -i inventory/production site.yml --vault-password-file .vault_pass
    rm .vault_pass

project/
├── ansible.cfg
├── .vault_pass
├── inventory/
│   ├── production/
│   │   ├── hosts
│   │   └── group_vars/
│   │       ├── all.yml
│   │       └── vault/
│   │           └── all.yml
│   └── staging/
│       ├── hosts
│       └── group_vars/
│           ├── all.yml
│           └── vault/
│               └── all.yml
├── playbooks/
│   └── site.yml
└── roles/
    └── app/

# ansible.cfg
[defaults]
inventory = inventory/production
vault_password_file = .vault_pass
host_key_checking = False
retry_files_enabled = False

# inventory/production/group_vars/all.yml
---
app_name: myapp
app_port: 8080
db_host: db.production.example.com
db_port: 3306
db_name: "{{ app_name }}_production"
db_user: "{{ app_name }}"
db_password: "{{ vault_db_password }}"
api_key: "{{ vault_api_key }}"

# inventory/production/group_vars/vault/all.yml (加密)
---
vault_db_password: SuperSecretProductionPassword!
vault_api_key: prod_api_key_1234567890abcdef
vault_ssl_cert: |
  -----BEGIN CERTIFICATE-----
  MIIDXTCCAkWgAwIBAgIJAJC1HiIAZAiUMA0G...
  -----END CERTIFICATE-----

# playbooks/site.yml
---
- name: Deploy application
  hosts: app_servers
  become: yes
  vars_files:
    - inventory/production/group_vars/vault/all.yml
  
  tasks:
    - name: Configure database connection
      template:
        src: templates/db_config.yml.j2
        dest: /etc/app/db_config.yml
        owner: appuser
        group: appuser
        mode: '0600'
    
    - name: Deploy SSL certificate
      copy:
        content: "{{ vault_ssl_cert }}"
        dest: /etc/app/ssl/cert.pem
        owner: root
        group: root
        mode: '0644'

# 如果忘记密码，无法恢复加密文件
# 建议备份密码文件或使用密钥管理服务

# 批量加密文件
for file in inventory/*/group_vars/vault/*.yml; do
  ansible-vault encrypt "$file"
done

# 检查文件头
head -1 secrets.yml
# 加密文件以 $ANSIBLE_VAULT 开头