重新加密单独加密的 ansibleVault 变量？

Question

通过阅读文档，

您无法重新设置加密变量的密钥

例如，如果这是 的内容group_vars/all.yaml，我想重新加密所有加密的变量。

key_tab: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  30333939663734636530386263663437343431353539643366633534366239643763326138653232
  3562383132623937346138613833396563653038646165300a623061363063663132373739373031
  66623133393239376366383235353332366336386532643637343438653634633734346639636334
  3633363032376339340a663531346633623466643163353638303534313937663931633962383637
  3637
certs:
  - file: client.cert
    password: !vault |
      $ANSIBLE_VAULT;1.1;AES256
      35626163653930386265393064326330393433343763626534373330393432373231633365656534
      6237626631326634333963313733356531623239653161370a356666326631663565396633396139
      32303962343064343530383364616235343130373935313161353135613539653061363735336337
      3636633036313565640a663736613065396262336433653564373161393431636661666134643761
      3639

我尝试用一​​些 bash 命令来做到这一点，但由于缩进，它变得很复杂。

是否有一种自动化的方法来完成此重新密钥？

Answer 1

根据 Ga\xc3\xabl\ 的建议，我创建了一个使用 ansible 库来完成 rekey 的 python 工具。

\n

它保留缩进并就地更新文件。适用于 Vault 变量和常规 Vault 文件。

\n

脚本

\n

#!/usr/bin/env python3\n\nimport sys\nimport re\nfrom tempfile import NamedTemporaryFile\nfrom ansible.parsing.vault import VaultEditor, VaultLib, VaultSecret\nfrom ansible.constants import DEFAULT_VAULT_IDENTITY\n\ndef rekey(content, old_secret, new_secret):\n  vault_regex = re.compile(r\'(^(\\s*)\\$ANSIBLE_VAULT\\S*\\n(\\s*\\w+\\n)*)\', re.MULTILINE)\n  vaults = {match[0]: match[1] for match in vault_regex.findall(content)}\n  for old_vault, indentation in vaults.items():\n    with NamedTemporaryFile(mode=\'w\', delete=False) as f:\n      f.write(old_vault.replace(indentation, \'\'))\n    VaultEditor(VaultLib([(DEFAULT_VAULT_IDENTITY, old_secret)])).rekey_file(f.name, new_secret)\n    with open(f.name) as f:\n      new_vault = indentation + indentation.join(f.readlines())\n      content = content.replace(old_vault, new_vault)\n  return content\n\ndef main(old_password, new_password, files):\n  for file_name in files:\n    with open(file_name) as f:\n      content = f.read()\n    with open(file_name, \'w\') as f:\n      f.write(rekey(content, VaultSecret(old_password.encode()), VaultSecret(new_password.encode())))\n\nmain(sys.argv[1], sys.argv[2], sys.argv[3:])\n

\n

用法

\n

./rekey.py my-old-pass my-new-pass $(find . -type f -name "*.yaml") another-file.vault\n

\n

解释

\n

对于每个输入文件：

\n

\n
1. 读取输入文件并提取与Vault正则表达式匹配的序列
\n
2. 将提取的保管库保存到临时文件
\n
3. 重新加密临时文件
\n
4. 使用重新设置密钥的文件的内容在输入文件中进行替换
\n

\n