我如何指定一个sudo密码Ansible在非交互的方式?
我是这样运行Ansible剧本的:
$ ansible-playbook playbook.yml -i inventory.ini \
--user=username --ask-sudo-pass
但我想这样运行它:
$ ansible-playbook playbook.yml -i inventory.ini \
--user=username` **--sudo-pass=12345**
有办法吗?我希望尽可能地自动化我的项目部署。
sudo密码存储为名为ansible_sudo_pass的变量。
你可以通过以下几种方式设置这个变量:
对于每个主机,在您的目录hosts文件(inventory/<inventoryname>/hosts)中
[server]
10.0.0.0 ansible_sudo_pass=foobar
每个组,在您的库存组文件(inventory/<inventoryname>/groups)
[server:vars]
ansible_sudo_pass=foobar
每个组,在组vars中(group_vars/<groupname>/ansible.yml)
ansible_sudo_pass: "foobar"
每个组,加密(ansible-vault create group_vars/<groupname>/ansible.yml)
ansible_sudo_pass: "foobar"
我的黑客自动化这是使用一个环境变量,并通过——extralvars =“ansible_become_pass='{{lookup('env', ' ansible_become_pass ')}}'”访问它。
导出一个env变量,但避免bash/shell历史记录(前面有一个空格或其他方法)。例如:
export ANSIBLE_BECOME_PASS='<your password>'
查找env变量,同时将额外的ansible_become_pass变量传递到ansible-playbook中,例如:
ansible-playbook playbook.yml -i inventories/dev/hosts.yml -u user --extra-vars="ansible_become_pass='{{ lookup('env', 'ANSIBLE_BECOME_PASS') }}'"
好的替代答案:
@toast38coza: simply use a vaulted value for ansible_become_pass. This is decent. However, for the paranoid teams that need to share ansible vault passwords, and execute ansible plays with induvidual accounts, they coudld use the shared vault password to reverse each others operating system password (identiy theft). Arguably, you need to trust your own team?
@slm's bash subshell output generated to temp file descriptor and using the @ prefix to read the ansible variable from the file desriptor. Avoids bash history at least. Not sure, but hopefully subshell echo doesn't get caught and exposed in audit logging (e.g. auditd).