ahvl 1.1.0

不需要向查找插件提供选项path，而是将对其进行计算。但是，如果希望具有不同的存储结构，则可以根据需要简单地更改基值。您可以在路径中使用变量{find}和{hostname}。不过，请注意任何冲突的路径。盐的特定路径无法设置，并且将始终遵循上述规则。

使用默认设置，您将得到一个类似于下面的结构。最低级别将包含键/值组合。

+-secret/
  +-credentials/
    +-aws/
    +-gcp/
  +-hosts/
    +-srv1.example.com/
      +-sshhostkeys/
        +-ed25519/
        +-rsa/
      +-mariadb/
  +-sshkeys/
    +-myuser/
  +-gpgkeys/
    +-someusr/

示例

Hashicorp保险库连接

# ansible.cfg...# connection details for HashiVault lookup plugin[ahvl_connection]ahvl_url=https://192.168.1.100:8200ahvl_auth_method=tokenahvl_validate_certs=Trueahvl_cacert=/usr/local/share/ca-certificates/Netson_CA.crt

# /etc/environment...AHVL_CONNECTION_AHVL_TOKEN=<myvaulttoken>PASSLIB_MAX_PASSWORD_SIZE=16384 # to prevent error when using the hash function on (very) large passwords or keys

密码

---# playbook to demonstrate ahvl_password-hosts:localhostgather_facts:novars:output_filters:-plaintext-hexsha256-hexsha512-sha256crypt-sha512crypt-phpass-mysql41-postgresmd5-pbkdf2sha256-pbkdf2sha512-argon2-grubpbkdf2sha512tasks:# the path in vault which will be searched is [hosts/localhost/mariadb] on the default mountpoint-name:'ahvl_password:getpasswordforMariaDBaccountwithusernamemyuserandshowalloutputs'debug:msg:"{{lookup('ahvl_password',find='mariadb',in='myuser',out=item)}}"loop:"{{output_filters}}"-name:'ahvl_password:getpassword(length=8,type=phrase-willresultin8words)forMariaDBaccountwithusernameanotheruserandoutputthemysql41hash'debug:msg:"{{lookup('ahvl_password',find='mariadb',in='anotheruser',out='mysql41',pwd_length=8,pwd_type='phrase')}}"

ssh密钥

---# playbook to demonstrate ahvl_sshkey-hosts:localhostgather_facts:novars:ahvl_generate_sshkey:sshkey_pkcs8_enabled:yes# requires openssl 6.5+sshkey_putty_enabled:yes# requires puttygen 0.72+# PCKS8 and SSHCOM do not support Ed25519 keyssshkey_ed25519_in:-password-private-private_keybits-private_keytype-private_openssh-private_putty-public-public_rfc4716-fingerprint_sha256-fingerprint_sha256_clean-fingerprint_sha256_art-fingerprint_md5-fingerprint_md5_clean-fingerprint_md5_art-fingerprint_bubblebabble-fingerprint_bubblebabble_clean-fingerprint_puttysshkey_rsa_in:-password-private-private_keybits-private_keytype-private_pkcs8-private_openssh-private_putty-private_sshcom-public-public_pem-public_pkcs8-public_rfc4716-fingerprint_sha256-fingerprint_sha256_clean-fingerprint_sha256_art-fingerprint_md5-fingerprint_md5_clean-fingerprint_md5_art-fingerprint_bubblebabble-fingerprint_bubblebabble_clean-fingerprint_puttytasks:-name:'ahvl_sshkey:fetch/generateSSHkeyoftypeEd25519andoutputallinformationpieces'debug:msg:"{{lookup('ahvl_sshkey',find='myusername',in=item,out='plaintext')}}"loop:"{{sshkey_ed25519_in}}"-name:'ahvl_sshkey:rsa'debug:msg:"{{lookup('ahvl_sshkey',find='anotherusername',sshkey_type='rsa',in=item,out='plaintext')}}"loop:"{{sshkey_rsa_in}}"

ssh主机密钥

---# playbook to demonstrate ahvl_sshhostkey-hosts:localhostgather_facts:novars:sshhostkey_ins:-private-public-fingerprint_sha256-fingerprint_sha256_clean-fingerprint_sha256_art-fingerprint_md5-fingerprint_md5_clean-fingerprint_md5_art-fingerprint_bubblebabble-fingerprint_bubblebabble_clean-dns_sha1-dns_sha1_clean-dns_sha256-dns_sha256_cleantasks:# search path used for vault will be [hosts/localhost/sshhostkeys/rsa]-name:'ahvl_sshhostkey:lookupRSAhostkeyandoutputallpieces'debug:msg:"{{lookup('ahvl_sshhostkey',find='rsa',in=item,out='plaintext')}}"loop:"{{sshhostkey_ins}}"# search path used for vault will be [hosts/localhost/sshhostkeys/ed25519]-name:'ahvl_sshhostkey:lookupEd25519hostkeyandoutputallpieces'debug:msg:"{{lookup('ahvl_sshhostkey',find='ed25519',in=item,out='plaintext')}}"loop:"{{sshhostkey_ins}}"# search path used for vault will be [hosts/myhost2.local/sshhostkeys/rsa]-name:'ahvl_sshhostkey:lookupRSAforanotherhostandoutputallpieces'debug:msg:"{{lookup('ahvl_sshhostkey',find='rsa',in=item,sshhostkey_type='rsa',out='plaintext',hostname='myhost2.local')}}"loop:"{{sshhostkey_ins}}"

GPG键

---# playbook to demonstrate ahvl_gpgkey-hosts:localhostgather_facts:novars:gpgkey_regular_ins:-master_cert_pub_key_armored-master_cert_sec_key_armored-master_cert_sec_keytype-master_cert_sec_keyuid-master_cert_sec_password-master_cert_sec_fingerprint-master_cert_sec_keycurve-master_cert_sec_keygrip-master_cert_sec_keybits-master_cert_sec_creationdate-master_cert_sec_keyid-master_cert_sec_expirationdate-subkey_sign_sec_key_armored-subkey_sign_sec_fingerprint-subkey_sign_sec_keycurve-subkey_sign_sec_keygrip-subkey_sign_sec_keybits-subkey_sign_sec_creationdate-subkey_sign_sec_keyid-subkey_sign_sec_expirationdate-subkey_encr_sec_key_armored-subkey_encr_sec_fingerprint-subkey_encr_sec_keycurve-subkey_encr_sec_keygrip-subkey_encr_sec_keybits-subkey_encr_sec_creationdate-subkey_encr_sec_keyid-subkey_encr_sec_expirationdate-subkey_auth_sec_key_armored-subkey_auth_sec_fingerprint-subkey_auth_sec_keycurve-subkey_auth_sec_keygrip-subkey_auth_sec_keybits-subkey_auth_sec_creationdate-subkey_auth_sec_keyid-subkey_auth_sec_expirationdategpgkey_backup_ins:-sign_master_cert_pub_key_armored-sign_master_cert_sec_key_armored-sign_master_cert_sec_keytype-sign_master_cert_sec_keyuid-sign_master_cert_sec_password-sign_master_cert_sec_fingerprint-sign_master_cert_sec_keycurve-sign_master_cert_sec_keygrip-sign_master_cert_sec_keybits-sign_master_cert_sec_creationdate-sign_master_cert_sec_keyid-sign_master_cert_sec_expirationdate-sign_subkey_sign_sec_key_armored-sign_subkey_sign_sec_fingerprint-sign_subkey_sign_sec_keycurve-sign_subkey_sign_sec_keygrip-sign_subkey_sign_sec_keybits-sign_subkey_sign_sec_creationdate-sign_subkey_sign_sec_keyid-sign_subkey_sign_sec_expirationdate-encr_master_cert_pub_key_armored-encr_master_cert_sec_key_armored-encr_master_cert_sec_keytype-encr_master_cert_sec_keyuid-encr_master_cert_sec_password-encr_master_cert_sec_fingerprint-encr_master_cert_sec_keycurve-encr_master_cert_sec_keygrip-encr_master_cert_sec_keybits-encr_master_cert_sec_creationdate-encr_master_cert_sec_keyid-encr_master_cert_sec_expirationdate-encr_subkey_encr_sec_key_armored-encr_subkey_encr_sec_fingerprint-encr_subkey_encr_sec_keycurve-encr_subkey_encr_sec_keygrip-encr_subkey_encr_sec_keybits-encr_subkey_encr_sec_creationdate-encr_subkey_encr_sec_keyid-encr_subkey_encr_sec_expirationdatetasks:# search path used for vault will be [gpgkeys/name_ed25519_localhost_myemail]-name:'ahvl_gpgkey:fetch/generateregulared25519keyandoutputallpieces'debug:msg:"{{lookup('ahvl_gpgkey',gpgkey_fullname='name_ed25519',gpgkey_email='myemail',in=item,out='plaintext')}}"loop:"{{gpgkey_regular_ins}}"# search path used for vault will be [gpgkeys/name_rsa_localhost_myemail]-name:'ahvl_gpgkey:fetchgenerateregularRSAkeyandoutputallpieces'debug:msg:"{{lookup('ahvl_gpgkey',gpgkey_type='rsa',gpgkey_fullname='name_rsa',gpgkey_email='myemail',in=item,out='plaintext')}}"loop:"{{gpgkey_regular_ins}}"# search path used for vault will be [gpgkeys/bckp_ed25519_localhost_myemail]-name:'ahvl_gpgkey:fetch/generatebackuped25519keyandoutputallpieces'debug:msg:"{{lookup('ahvl_gpgkey',gpgkey_keyset='backup',gpgkey_fullname='bckp_ed25519',gpgkey_email='myemail',gpgkey_comment=inventory_hostname,in=item,out='plaintext')}}"loop:"{{gpgkey_backup_ins}}"# search path used for vault will be [gpgkeys/bckp_rsa_localhost_myemail]-name:'ahvl_gpgkey:fetch/generatebackupRSAkeyandoutputallpieces'debug:msg:"{{lookup('ahvl_gpgkey',gpgkey_keyset='backup',gpgkey_type='rsa',gpgkey_fullname='bckp_rsa',gpgkey_email='myemail',gpgkey_comment=inventory_hostname,in=item,out='plaintext')}}"loop:"{{gpgkey_backup_ins}}"

凭证

pip install ahvl

配置选项

为了在配置这些查找插件的行为时提供最大的灵活性，有几种方法可以设置选项值，一种优先于另一种。它们的处理顺序如下。最低的数字将具有最高的优先级。显然，ansibe中定义的变量优先级也适用。有关详细信息，请参阅ansible docs。