Ansible Vault 密码管理：敏感数据加密实战指南

明文 YAML → AES-256 加密（Vault 密码作为密钥）→ 密文 YAML（$ANSIBLE_VAULT 头部标识）

$ANSIBLE_VAULT;1.1;AES256
66386439653236336462626566653033393664633164636136383765393730353066386230336230
363366323737366336663737333635303462653066333637356436653066333763350a6366373134
37633733336236393030303237373332643761306635316631393963363033663638366363313061
...

# 交互式创建（会提示输入密码）
ansible-vault create secrets.yml

# 使用密码文件创建（推荐用于自动化）
ansible-vault create --vault-password-file=~/.vault_pass secrets.yml

# secrets.yml (加密后)
db_password: "prod-db-2026!"
admin_api_key: "sk_live_abc123def456"
ssh_private_key: |
  -----BEGIN RSA PRIVATE KEY-----
  MIIEowIBAAKCAQEA...
  -----END RSA PRIVATE KEY-----  

# 加密单个文件
ansible-vault encrypt existing_vars.yml

# 加密多个文件
ansible-vault encrypt group_vars/all.yml host_vars/web01.yml

# 指定输出文件（不覆盖原文件）
ansible-vault encrypt --output=encrypted.yml plaintext.yml

# 查看加密文件内容（不会在磁盘留下明文）
ansible-vault view secrets.yml

# 编辑加密文件（自动解密 → 编辑 → 保存时重新加密）
ansible-vault edit secrets.yml

# 修改加密密码（rekey）
ansible-vault rekey secrets.yml

# 永久解密文件（移除加密，慎用！）
ansible-vault decrypt secrets.yml

# 创建密码文件
echo "MyVaultPassword2026!" > ~/.vault_pass

# 设置严格权限（必须！）
chmod 600 ~/.vault_pass

[defaults]
vault_password_file = ~/.vault_pass

# 自动使用 ansible.cfg 中配置的密码文件
ansible-playbook site.yml

# 创建带 Vault ID 的加密文件
ansible-vault create --vault-id dev@~/.vault_dev_pass dev_secrets.yml
ansible-vault create --vault-id prod@~/.vault_prod_pass prod_secrets.yml

ansible-playbook site.yml \
  --vault-id dev@~/.vault_dev_pass \
  --vault-id prod@~/.vault_prod_pass

[defaults]
vault_identity_list = dev@~/.vault_dev_pass, prod@~/.vault_prod_pass, staging@~/.vault_staging_pass

# site.yml
---
- name: Deploy Application
  hosts: prod_servers
  vars_files:
    - secrets.yml  # 自动解密并加载变量
  tasks:
    - name: Configure database connection
      template:
        src: db.conf.j2
        dest: /etc/app/db.conf
      # {{ db_password }} 在运行时自动解密并填充

---
- name: Load secrets based on environment
  hosts: all
  tasks:
    - name: Include encrypted vars for current environment
      include_vars:
        file: "{{ env }}_secrets.yml"
      no_log: true  # 防止变量内容出现在日志中

# 使用 --ask-vault-pass 交互式输入
ansible-playbook site.yml --ask-vault-pass

# 使用 --vault-password-file 指定密码文件
ansible-playbook site.yml --vault-password-file=~/.vault_pass

# 使用 --vault-id 指定带标识的密码
ansible-playbook site.yml --vault-id prod@~/.vault_prod_pass

---
- name: Create database user
  community.mysql.mysql_user:
    name: "{{ db_user }}"
    password: "{{ db_password }}"
    priv: "*.*:ALL"
    state: present
  no_log: true  # 关键！防止密码出现在日志中

---
- name: Sensitive operations
  hosts: all
  no_log: true  # 该 Play 中所有 task 都不记录日志
  tasks:
    - name: Deploy with secrets
      ...

project/
├── ansible.cfg
├── inventory/
│   ├── production/
│   │   ├── hosts.ini
│   │   ├── group_vars/
│   │   │   ├── all/
│   │   │   │   ├── common.yml          # 公共变量（明文）
│   │   │   │   └── vault.yml           # 加密变量
│   │   │   └── webservers/
│   │   │       ├── vars.yml            # 明文变量
│   │   │       └── vault.yml           # 加密变量
│   │   └── host_vars/
│   │       └── web01/
│   │           ├── vars.yml
│   │           └── vault.yml
│   └── staging/
│       ├── hosts.ini
│       └── group_vars/
│           └── all/
│               └── vault.yml
├── playbooks/
│   ├── site.yml
│   ├── deploy.yml
│   └── db_setup.yml
├── roles/
│   ├── nginx/
│   ├── mysql/
│   └── app/
├── files/
│   └── ssl/
│       └── server.key                   # 加密的 SSL 私钥
└── templates/
    └── db.conf.j2

# group_vars/all/common.yml (明文，可提交到 Git)
---
app_name: "myapp"
app_port: 8080
db_host: "db.internal"
db_port: 3306

# group_vars/all/vault.yml (加密，可提交到 Git 但内容不可读)
$ANSIBLE_VAULT;1.1;AES256
6638643965323633646262656665303339366463316463613638376539373035...

# ansible.cfg
[defaults]
inventory = inventory/
vault_identity_list = dev@~/.vault_dev_pass, staging@~/.vault_staging_pass, prod@~/.vault_prod_pass
host_key_checking = False

# .gitlab-ci.yml
stages:
  - deploy

deploy_production:
  stage: deploy
  image: ansible/ansible-runner:latest
  variables:
    # Vault 密码通过 CI 变量注入（在 GitLab UI 中设置为 Masked 变量）
    VAULT_PASS_PROD: $VAULT_PASS_PROD
  before_script:
    # 将 CI 变量写入临时密码文件
    - echo "$VAULT_PASS_PROD" > /tmp/vault_pass
    - chmod 600 /tmp/vault_pass
  script:
    - ansible-playbook -i inventory/production playbooks/deploy.yml
        --vault-id prod@/tmp/vault_pass
  after_script:
    # 清理密码文件
    - rm -f /tmp/vault_pass
  only:
    - main

# .github/workflows/deploy.yml
name: Deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Ansible
        run: pip install ansible-core

      - name: Create vault password file
        run: |
          echo "${{ secrets.VAULT_PASS_PROD }}" > ~/.vault_pass
          chmod 600 ~/.vault_pass          

      - name: Run playbook
        run: |
          ansible-playbook -i inventory/production playbooks/deploy.yml \
            --vault-id prod@~/.vault_pass          

      - name: Cleanup
        if: always()
        run: rm -f ~/.vault_pass

pipeline {
    agent any
    environment {
        VAULT_PASS = credentials('ansible-vault-prod')
    }
    stages {
        stage('Deploy') {
            steps {
                sh '''
                    echo "${VAULT_PASS}" > /tmp/vault_pass
                    chmod 600 /tmp/vault_pass
                    ansible-playbook -i inventory/production playbooks/deploy.yml \
                        --vault-id prod@/tmp/vault_pass
                    rm -f /tmp/vault_pass
                '''
            }
        }
    }
}

# 交互式轮转（输入旧密码 → 设置新密码）
ansible-vault rekey secrets.yml

# 使用密码文件轮转
ansible-vault rekey \
  --vault-password-file=~/.vault_old_pass \
  --new-vault-password-file=~/.vault_new_pass \
  secrets.yml

# 使用 Vault ID 轮转
ansible-vault rekey \
  --vault-id prod@~/.vault_prod_old \
  --new-vault-id prod@~/.vault_prod_new \
  prod_secrets.yml

#!/bin/bash
# rotate-vault-passwords.sh
# 批量轮转所有加密文件的 Vault 密码

set -euo pipefail

OLD_PASS_FILE="$1"
NEW_PASS_FILE="$2"
VAULT_DIR="${3:-group_vars}"

if [ ! -f "$OLD_PASS_FILE" ] || [ ! -f "$NEW_PASS_FILE" ]; then
    echo "Usage: $0 <old_pass_file> <new_pass_file> [vault_dir]"
    exit 1
fi

# 查找所有加密文件
find "$VAULT_DIR" -type f -name "*.yml" -exec grep -l '^\$ANSIBLE_VAULT' {} \; | while read -r file; do
    echo "Rekeying: $file"
    ansible-vault rekey \
        --vault-password-file="$OLD_PASS_FILE" \
        --new-vault-password-file="$NEW_PASS_FILE" \
        "$file"
done

echo "All vault files rekeyed successfully."

# /etc/cron.d/vault-rotate
# 每季度第一天凌晨2点执行密码轮转
0 2 1 */3 * /opt/scripts/rotate-vault-passwords.sh \
    /etc/ansible/.vault_pass \
    /etc/ansible/.vault_pass_new \
    /etc/ansible/group_vars \
    && mv /etc/ansible/.vault_pass_new /etc/ansible/.vault_pass

#!/bin/bash
# scan-plaintext-secrets.sh
# 扫描可能包含明文密码的文件

PATTERNS=(
    "password.*=.*['\"].\{8,\}['\"]"
    "secret.*=.*['\"].\{8,\}['\"]"
    "api_key.*=.*['\"].\{20,\}['\"]"
    "token.*=.*['\"].\{20,\}['\"]"
    "private_key"
)

SCAN_DIR="${1:-.}"
ISSUES=0

for pattern in "${PATTERNS[@]}"; do
    while IFS= read -r file; do
        # 跳过已加密的文件
        if head -1 "$file" | grep -q '^\$ANSIBLE_VAULT'; then
            continue
        fi
        # 跳过 .git 目录
        if echo "$file" | grep -q '\.git/'; then
            continue
        fi
        echo "[WARNING] Potential plaintext secret in: $file"
        grep -n "$pattern" "$file" | head -5
        ISSUES=$((ISSUES + 1))
    done < <(grep -rl "$pattern" "$SCAN_DIR" 2>/dev/null)
done

if [ "$ISSUES" -gt 0 ]; then
    echo ""
    echo "Found $ISSUES files with potential plaintext secrets."
    echo "Consider encrypting them with: ansible-vault encrypt <file>"
    exit 1
else
    echo "No plaintext secrets found."
    exit 0
fi

# 记录 vault 操作的审计日志
vault_audit() {
    local action="$1"
    local file="$2"
    local user="$(whoami)"
    local timestamp="$(date '+%Y-%m-%d %H:%M:%S')"
    local log_file="/var/log/ansible-vault-audit.log"

    echo "[$timestamp] user=$user action=$action file=$file" >> "$log_file"
}

# 用法
vault_audit "view" "group_vars/all/vault.yml"
ansible-vault view group_vars/all/vault.yml

# group_vars/all.yml
---
db_host: "db.internal"
db_port: 3306
db_password: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  66386439653236336462626566653033393664633164636136383765393730353066386230336230
  363366323737366336663737333635303462653066333637356436653066333763350a6366373134
  ...
api_key: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  37323438366638343536373633336630333134356238393630353436393866636330303037343030
  ...
# 非敏感变量保持明文
app_name: "myapp"
app_port: 8080

# 使用 encrypt_string 命令
ansible-vault encrypt_string --vault-id prod@~/.vault_prod_pass 'my_secret_password'

# 指定变量名
ansible-vault encrypt_string --vault-id prod@~/.vault_prod_pass \
  --name 'db_password' \
  'prod-db-2026!'

# playbook.yml
---
- name: Get secrets from HashiCorp Vault
  hosts: localhost
  vars:
    vault_url: "http://vault:8200"
  tasks:
    - name: Read database credentials from Vault
      hashivault_read:
        url: "{{ vault_url }}"
        token: "{{ lookup('env', 'VAULT_TOKEN') }}"
        secret: "secret/data/database"
        key: "password"
      register: db_secret
      no_log: true

    - name: Use the secret
      debug:
        msg: "DB password retrieved from Vault (masked)"
      no_log: true

#!/bin/bash
# encrypt-directory.sh
# 加密目录下所有 YAML 文件

DIR="${1:-group_vars}"

find "$DIR" -type f \( -name "*.yml" -o -name "*.yaml" \) | while read -r file; do
    # 跳过已加密的文件
    if head -1 "$file" | grep -q '^\$ANSIBLE_VAULT'; then
        echo "[SKIP] Already encrypted: $file"
        continue
    fi
    echo "[ENCRYPT] $file"
    ansible-vault encrypt --vault-id prod@~/.vault_prod_pass "$file"
done

# 错误信息示例
ERROR! Attempting to decrypt but no valid secrets found

# 排查步骤
# 1. 检查密码文件是否存在且可读
ls -la ~/.vault_pass

# 2. 检查密码文件内容（确保没有多余的换行或空格）
cat -A ~/.vault_pass

# 3. 检查 ansible.cfg 中的 vault_password_file 路径
grep vault ansible.cfg

# 4. 检查 Vault ID 是否匹配
ansible-vault view --vault-id prod@~/.vault_prod_pass secrets.yml

# 在 .gitattributes 中配置
echo "*.yml diff=ansible_vault" >> .gitattributes

# 在 .git/config 中配置 diff 工具
git config diff.ansible_vault.textconv "ansible-vault view"