Vault 密碼檔

1. 修改 users.yml 腳本為 users_vault.yml，密碼使用 vault 加密的 pwlist.yml 的密碼表，密碼變數為 devpw：

   ceuser@deyu:~/ansible_pb$ vi users_vault.yml 
   ceuser@deyu:~/ansible_pb$ cat users_vault.yml 
   ---
   - name: Create users with Valut
     hosts: dev
     vars_files: pwlist.yml 
     tasks:
     - name: Ensure group "sharegrp" exists
       ansible.builtin.group:
         name: sharegrp
         state: present
     - name: Add user 'james'
       ansible.builtin.user:
         name: james
         groups: sharegrp
         password: "{{ devpw | password_hash('sha512') }}"
   

2. ansible-playbook 執行腳本 users_vault.yml，加選項 --ask-vault-pass 手動輸入密碼解密 pwlist.yml。

   ceuser@deyu:~/ansible_pb$ ansible-playbook users_vault.yml --ask-vault-pass
   Vault password: 
   
   PLAY [Create users with Valut] *************************************************
   
   TASK [Gathering Facts] *********************************************************
   ok: [kvm11]
   
   TASK [Ensure group "sharegrp" exists] ******************************************
   ok: [kvm11]
   
   TASK [Add user 'james'] ********************************************************
   changed: [kvm11]
   Vault password:
   
   PLAY [Create users with Valut] *************************************************
   
   TASK [Gathering Facts] *********************************************************
   ok: [kvm11]
   
   TASK [Ensure group "sharegrp" exists] ******************************************
   ok: [kvm11]
   
   TASK [Add user 'james'] ********************************************************
   [DEPRECATION WARNING]: Encryption using the Python crypt module is deprecated.
   The Python crypt module is deprecated and will be removed from Python 3.13.
   Install the passlib library for continued encryption functionality. This
   feature will be removed in version 2.17. Deprecation warnings can be disabled
   by setting deprecation_warnings=False in ansible.cfg.
   changed: [kvm11]
   
   PLAY RECAP *********************************************************************
   kvm11 : ok=3 changed=1  unreachable=0  failed=0  skipped=0  rescued=0  ignored=0
   
   PLAY RECAP *********************************************************************
   kvm11: ok=3  changed=1  unreachable=0  failed=0  skipped=0  rescued=0  ignored=0
   

3. ansible-playbook 執行腳本 users_vault.yml，加選項 --vault-password-file 指定金鑰檔解密 pwlist.yml。

   ceuser@deyu:~/ansible_pb$ ansible-playbook users_vault.yml --vault-password-file password.txt 
   
   PLAY [Create users with Valut] *************************************************
   
   TASK [Gathering Facts] *********************************************************
   ok: [kvm11]
   
   TASK [Ensure group "sharegrp" exists] ******************************************
   ok: [kvm11]
   
   TASK [Add user 'james'] ********************************************************
   [DEPRECATION WARNING]: Encryption using the Python crypt module is deprecated.
   The Python crypt module is deprecated and will be removed from Python 3.13.
   Install the passlib library for continued encryption functionality. This
   feature will be removed in version 2.17. Deprecation warnings can be disabled
   by setting deprecation_warnings=False in ansible.cfg.
   changed: [kvm11]
   
   PLAY RECAP *********************************************************************
   kvm11 : ok=3 changed=1  unreachable=0  failed=0  skipped=0  rescued=0  ignored=0
   

4. 查看 devpw 變數，密碼為 '123123'。

   ceuser@deyu:~/ansible_pb$ ansible-vault view pwlist.yml --vault-password-file=password.txt
   devpw: '123123'
   prodpw: 'qweqwe'
   

5. 使用密碼 '123123'，成功登入 james@kvm11。

   ceuser@deyu:~/ansible_pb$ ssh james@kvm11
   james@kvm11's password:
   

6. 登出 james@kvm11。

   [james@kvm11 ~]$ exit
   logout
   Connection to kvm11 closed.