重新设置单独加密的ansible vault变量的密钥？

Question

通过阅读documentation

You cannot rekey encrypted variables

例如，如果这是group_vars/all.yaml的内容，我想对所有加密的变量重新设置密钥

key_tab: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  30333939663734636530386263663437343431353539643366633534366239643763326138653232
  3562383132623937346138613833396563653038646165300a623061363063663132373739373031
  66623133393239376366383235353332366336386532643637343438653634633734346639636334
  3633363032376339340a663531346633623466643163353638303534313937663931633962383637
  3637
certs:
  - file: client.cert
    password: !vault |
      $ANSIBLE_VAULT;1.1;AES256
      35626163653930386265393064326330393433343763626534373330393432373231633365656534
      6237626631326634333963313733356531623239653161370a356666326631663565396633396139
      32303962343064343530383364616235343130373935313161353135613539653061363735336337
      3636633036313565640a663736613065396262336433653564373161393431636661666134643761
      3639

我曾尝试使用一些bash命令来实现这一点，但缩进会使它变得复杂

有没有一种自动化的方法来完成这个重新密钥

Answer 1

根据Gaël的建议，我创建了一个python工具，它使用ansible libs来完成重键

它保留缩进并在适当的位置更新文件。适用于vault变量和常规vault文件

脚本

#!/usr/bin/env python3

import sys
import re
from tempfile import NamedTemporaryFile
from ansible.parsing.vault import VaultEditor, VaultLib, VaultSecret
from ansible.constants import DEFAULT_VAULT_IDENTITY

def rekey(content, old_secret, new_secret):
  vault_regex = re.compile(r'(^(\s*)\$ANSIBLE_VAULT\S*\n(\s*\w+\n)*)', re.MULTILINE)
  vaults = {match[0]: match[1] for match in vault_regex.findall(content)}
  for old_vault, indentation in vaults.items():
    with NamedTemporaryFile(mode='w', delete=False) as f:
      f.write(old_vault.replace(indentation, ''))
    VaultEditor(VaultLib([(DEFAULT_VAULT_IDENTITY, old_secret)])).rekey_file(f.name, new_secret)
    with open(f.name) as f:
      new_vault = indentation + indentation.join(f.readlines())
      content = content.replace(old_vault, new_vault)
  return content

def main(old_password, new_password, files):
  for file_name in files:
    with open(file_name) as f:
      content = f.read()
    with open(file_name, 'w') as f:
      f.write(rekey(content, VaultSecret(old_password.encode()), VaultSecret(new_password.encode())))

main(sys.argv[1], sys.argv[2], sys.argv[3:])

用法

./rekey.py my-old-pass my-new-pass $(find . -type f -name "*.yaml") another-file.vault

解释

对于每个输入文件：

1. 读取输入文件并提取与vault正则表达式匹配的序列
2. 将提取的Vault保存到临时文件
3. 重新键入临时文件
4. 使用重新设置密钥的文件的内容在输入文件中进行替换