使用Ansible管理远程生成的API密钥

这是一个宽泛的问题。在你的剧本中,有多种处理秘密的方法; this article 描述了几个选项,并且有各种在线文章涵盖了类似的主题。

一个简单的选项可能是将API密钥加密为GPG公钥,只有当您登录并能够提供密码短语时,私钥才可用。

下面是一个简单(即不是特别健壮)的示例:

- hosts: localhost
  gather_facts: false

  tasks:
    # Check if the file in which we cache the API key exists.
    # If not, fetch the API key from the API and store it in
    # a GPG-encrypted file.
    - when: apikey_file is not file
      block:
        # This is just a dummy task to give us a string; you would of
        # course replace this with the logic to acquire an API key.
        - name: Get key from API
          command: echo secret.key
          register: apikey

        # Encrypt the key using the public key for the identity
        # stored in apikey_gpg_id.
        - name: Write API key to file
          command: >-
            gpg -o "{{ apikey_file }}" -e -r "{{ apikey_gpg_id }}"
          args:
            stdin: "{{ apikey.stdout }}"

- hosts: localhost
  gather_facts: false

  tasks:
    # Decrypt the API key file to stdout. This requires us to type in
    # the passphrase (which may be cached for some amount of time in your
    # GPG agent).
    - name: Read API key from file
      command: >-
        gpg -d "{{ apikey_file }}"
      register: apikey

    # Show what we got from the previous task.
    - debug:
        var: apikey.stdout

这假设变量 apikey_file 和 apikey_gpg_id 是预先定义的--我已经把它们放进去了 group_vars/all.yaml ,但它们也可以根据项目的结构在您的库存或其他地方进行定义。