mysql - Ansible 在其他变量中使用加密变量

Question

我正在构建几个可以执行各种维护任务的剧本。为此，他们需要 MySQL 登录帐户。有几个数据库服务器，所以我创建了一个变量来保存所有信息。举例说明:

./vars/main.yml

  # 'secret' variables
  host1url: some_url
  host1user: user
  host1pass: pass
  host2url: some_url
  host2user: user
  host2pass: pass


  # array of db hosting info
  dbhosts:
    - name: host1
      host: {{ host1url }}
      user: {{ host1user }}
      pass: {{ host1pass }}
    - name: host2
      host: {{ host2url }}
      user: {{ host2user }}
      pass: {{ host2pass }}

./roles/the_role/tasks/main.yml
    - name: create script to perform task
      template:
        src=do_something.sh
        dest=do_something_{{ item.name }}.sh
      with_items:
        dbhosts

    - name: perform task
      command: do_something_{{ item.name }}.sh
      with_items:
        dbhosts

这可行，但我想将“ secret ”变量移动到不同的文件，这样我就可以:

• 根据特定的剧本或情况添加不同的用户组
• 将文件加密以便与 Ansible Vault 一起使用

如何将 dbhosts 结构保留在 main.yml 文件中以供引用，并将“ secret ”变量移动到不同的文件？

我所能找到的只是关于如何在运行时在任务中添加一个带有变量的文件的信息，但它不应该在加载变量“dbhosts”之前加载，所以 dbhosts 中的变量扩展将会工作？

Answer 1

来自此处的博客文章:http://www.reinteractive.net/posts/167-ansible-real-life-good-practices

我相信这就是您要找的:

What we like about Ansible is the readability, and encryption has a way of making things, well, less readable…

ansible-vault command will encrypt or decrypt the whole var file, you can not encrypt just the value of a variable. The solution is simple enough: create a second var file, just for the sensitive data. But this raises another issue: your variables are now spread over multiple files, and some of them encrypted. This can get messy. For instance, if you define a dictionary of variables and only one of them is sensitive, you have to encrypt the whole dictionary.

Leaf encryption was (is) a feature request, but in the meantime, there is an elegant way of keeping it both readable and secure: nested variables.

For every sensitive variable, you create a prefixed double that goes in an encrypted file.

# var_file
db_password: {{ vaulted_db_passord }}
# and for a dctionnary
aws: 
  - "access_key_id='abcdefgh'"
  - "secret_access_key='{{ vaulted_aws_secret_access_key }}'"

---

# vault_file
vaulted_db_passord: a_super_secret
vaulted_aws_secret_access_key: the_aws_secret

That way, you can manipulate all your vars like before, knowing the vaulted version stays encrypted. You can even solve the problem of having someone responsible for the encrypted file and the rest of the team never seeing its content but still being able to manage var files as they need.