python - 重新加密单独加密的 ansible 保险库变量？

Question

从阅读 documentation ,

You cannot rekey encrypted variables

例如，如果这是 group_vars/all.yaml 的内容，我想重新加密所有加密的变量。

key_tab: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  30333939663734636530386263663437343431353539643366633534366239643763326138653232
  3562383132623937346138613833396563653038646165300a623061363063663132373739373031
  66623133393239376366383235353332366336386532643637343438653634633734346639636334
  3633363032376339340a663531346633623466643163353638303534313937663931633962383637
  3637
certs:
  - file: client.cert
    password: !vault |
      $ANSIBLE_VAULT;1.1;AES256
      35626163653930386265393064326330393433343763626534373330393432373231633365656534
      6237626631326634333963313733356531623239653161370a356666326631663565396633396139
      32303962343064343530383364616235343130373935313161353135613539653061363735336337
      3636633036313565640a663736613065396262336433653564373161393431636661666134643761
      3639

我曾尝试用一些 bash 命令来做到这一点，但它因缩进而变得复杂。
有没有一种自动化的方法来完成这个重新加密？

Answer 1

根据 Gaël 的建议，我创建了一个 python 工具，它使用 ansible libs 来完成重新生成 key 。
它保留缩进并更新文件。适用于 Vault 变量和常规 Vault 文件。
脚本

#!/usr/bin/env python3

import sys
import re
from tempfile import NamedTemporaryFile
from ansible.parsing.vault import VaultEditor, VaultLib, VaultSecret
from ansible.constants import DEFAULT_VAULT_IDENTITY

def rekey(content, old_secret, new_secret):
  vault_regex = re.compile(r'(^(\s*)\$ANSIBLE_VAULT\S*\n(\s*\w+\n)*)', re.MULTILINE)
  vaults = {match[0]: match[1] for match in vault_regex.findall(content)}
  for old_vault, indentation in vaults.items():
    with NamedTemporaryFile(mode='w', delete=False) as f:
      f.write(old_vault.replace(indentation, ''))
    VaultEditor(VaultLib([(DEFAULT_VAULT_IDENTITY, old_secret)])).rekey_file(f.name, new_secret)
    with open(f.name) as f:
      new_vault = indentation + indentation.join(f.readlines())
      content = content.replace(old_vault, new_vault)
  return content

def main(old_password, new_password, files):
  for file_name in files:
    with open(file_name) as f:
      content = f.read()
    with open(file_name, 'w') as f:
      f.write(rekey(content, VaultSecret(old_password.encode()), VaultSecret(new_password.encode())))

main(sys.argv[1], sys.argv[2], sys.argv[3:])

用法

./rekey.py my-old-pass my-new-pass $(find . -type f -name "*.yaml") another-file.vault

说明
对于每个输入文件:

读取输入文件并提取与 Vault 正则表达式匹配的序列

将提取的保管库保存到临时文件

重新加密临时文件

使用重新加密的文件的内容在输入文件中进行替换