我的黑客自动化这是使用一个环境变量，并通过——extralvars =“ansible_become_pass='{{lookup('env'， ' ansible_become_pass ')}}'”访问它。

导出一个env变量，但避免bash/shell历史记录(前面有一个空格或其他方法)。例如:

     export ANSIBLE_BECOME_PASS='<your password>'

查找env变量，同时将额外的ansible_become_pass变量传递到ansible-playbook中，例如:

ansible-playbook playbook.yml -i inventories/dev/hosts.yml -u user --extra-vars="ansible_become_pass='{{ lookup('env', 'ANSIBLE_BECOME_PASS') }}'"

好的替代答案:

@toast38coza: simply use a vaulted value for ansible_become_pass. This is decent. However, for the paranoid teams that need to share ansible vault passwords, and execute ansible plays with induvidual accounts, they coudld use the shared vault password to reverse each others operating system password (identiy theft). Arguably, you need to trust your own team? @slm's bash subshell output generated to temp file descriptor and using the @ prefix to read the ansible variable from the file desriptor. Avoids bash history at least. Not sure, but hopefully subshell echo doesn't get caught and exposed in audit logging (e.g. auditd).

文档强烈建议不要将sudo密码设置为明文:

提醒一下，密码永远不应该以纯文本的形式存储。有关使用Ansible Vault加密您的密码和其他秘密的信息，请参见使用Ansible Vault加密内容。

相反，当运行ansible-playbook时，你应该在命令行上使用——ask-become-pass

之前版本的Ansible使用——ask-sudo-pass和sudo来代替become。

您可以使用sshpass实用程序如下所示，

$ sshpass -p "your pass" ansible pattern -m module -a args \
   -i inventory --ask-sudo-pass

您可以为一个组或所有服务器设置密码:

[all:vars]
ansible_sudo_pass=default_sudo_password_for_all_hosts

[group1:vars]
ansible_sudo_pass=default_sudo_password_for_group1

你可以在命令行通过——extra-vars "name=value"传递变量。Sudo密码变量为ansible_sudo_pass。所以你的命令看起来像这样:

ansible-playbook playbook.yml -i inventory.ini --user=username \
                              --extra-vars "ansible_sudo_pass=yourPassword"

2017年更新:Ansible 2.2.1.0现在使用var ansible_become_pass。两种方法似乎都有效。

2021年更新:ansible_become_pass仍然有效，但现在，我们应该使用-e而不是——extra-vars

用——extra-vars "become_pass=Password"调用你的剧本

become_pass =(“ansible_become_password”、“ansible_become_pass”)