ansible-vault 常用命令# 加密文件ansible-vault encrypt test-vault.ymlansible-vault encrypt test-vault.yml --vault-password-file pwdfile# 解密文件ansible-vault decrypt test-vault.ymlansible-vault decrypt test-vault.yml --vault-password-file pwdfile# 查看文件ansible-vault view test-vault.ymlansible-vault view test-vault.yml --vault-password-file pwdfile# 重置文件密码ansible-vault rekey test-vault.ymlansible-vault rekey test-vault.yml --vault-password-file pwdfile --new-vault-password-file pwdfilenew# 创建加密文件ansible-vault create test-vault.ymlansible-vault create test-vault.yml --vault-password-file pwdfile# 编辑加密文件ansible-vault edit test-vault.ymlansible-vault edit test-vault.yml --vault-password-file pwdfile# 加密字符串ansible-vault encrypt_string 'test123456'ansible-vault encrypt_string 'test123456' --name 'ansible_ssh_pass'ansible-vault encrypt_string 'test123456' --name 'ansible_ssh_pass' --vault-id anliven@pwdfileansible-vault "--vault-id"选项# 从ansible2.4版本开始，官方推荐使用"--vault-id"选项代替"--vault-password-file"选项指定密码文件# “--vault-id prompt”功能上等同于"--ask-vault-pass"选项# 支持同时使用多个密码文件进行解密，适用于“引用其他文件”的场景# 可以在被加密文件中包含特定字符“做记号”ansible-vault encrypt_string 'test123456' --name 'ansible_ssh_pass' --vault-id pwdfile# 加密字符串ansible-vault encrypt test-vault.yml --vault-id pwdfile# 加密文件ansible-vault encrypt test-vault.yml --vault-id anliven@pwdfile# 加密完成后的文件内容包含anliven字符ansible-vault decrypt test-vault.yml --vault-id pwdfile# 解密文件ansible-vault view test-vault.yml --vault-id pwdfile# 查看文件ansible-vault edit test-vault.yml --vault-id pwdfile# 编辑文件ansible-vault rekey test-vault.yml --vault-id pwdfile# 交互式密码重置ansible-vault rekey test-vault.yml --vault-id pwdfile--new-vault-id pwdfilenew# 通过新密码文件重置ansible-playbook test-vault.yml --vault-id pwdfile# 运行playbookansible-playbook test-vault.yml --vault-id pwdfile1 --vault-id pwdfile2# 提供多个密码文件来解密，test-vault.yml中引用其他vault加密文件ansible-playbook test-vault1.yml test-vault2.yml --vault-id pwdfile1 --vault-id pwdfile2# 提供多个加密文件来解密多个文件ansible-vault 示例示例-1交互式密码[root@test01 ansible-test]# cat test-vault.yml- hosts: tagather_facts: notasks:- debug:msg: "test ansible-vault"[root@test01 ansible-test]#[root@test01 ansible-test]# ansible-playbook test-vault.ymlPLAY [ta] *********************************************************************************************************************************************************************************************TASK [debug] ******************************************************************************************************************************************************************************************ok: [172.20.8.247] => {"msg": "test ansible-vault"}PLAY RECAP ********************************************************************************************************************************************************************************************172.20.8.247: ok=1changed=0unreachable=0failed=0skipped=0rescued=0ignored=0[root@test01 ansible-test]#[root@test01 ansible-test]# ansible-vault encrypt test-vault.ymlNew Vault password:Confirm New Vault password:Encryption successful[root@test01 ansible-test]#[root@test01 ansible-test]# cat test-vault.yml$ANSIBLE_VAULT;1.1;AES256326562396436326461396339386134303261396366363332353463616431613931313966613665346636386331316239616632316137316266316266646432360a366366643232313033343835346638386163316366396437316337663333356137636236363333633362383539316162633136373138343135656632343034340a316238656238336432386638373236653738306530383232626231333438386663383461303335613165353536376162306336343461623037303931663962306165333964353834653630643365356637343830356537303666313836633031383635666665663939343839613435333465623365636531653562363366323065316238333333353863376236373362373832633636626137326662633065316532313539313266353035336239346332353962396138386132303238623134[root@test01 ansible-test]#[root@test01 ansible-test]# ansible-vault view test-vault.ymlVault password:- hosts: tagather_facts: notasks:- debug:msg: "test ansible-vault"[root@test01 ansible-test]#[root@test01 ansible-test]# ansible-playbook --ask-vault-pass test-vault.ymlVault password: PLAY [ta] *********************************************************************************************************************************************************************************************TASK [debug] ******************************************************************************************************************************************************************************************ok: [172.20.8.247] => {"msg": "test ansible-vault"}PLAY RECAP ********************************************************************************************************************************************************************************************172.20.8.247: ok=1changed=0unreachable=0failed=0skipped=0rescued=0ignored=0[root@test01 ansible-test]#[root@test01 ansible-test]# ansible-vault decrypt test-vault.ymlVault password:Decryption successful[root@test01 ansible-test]#[root@test01 ansible-test]# cat test-vault.yml- hosts: tagather_facts: notasks:- debug:msg: "test ansible-vault"[root@test01 ansible-test]#