如何让Ansible在--ask-vault-pass密码解密失败时重复提示？

问题背景 #

使用--ask-vault-pass参数时，输入正确密码Playbook可正常执行；若密码错误，会抛出错误msg: Decryption failed (no vault secrets were found that could decrypt)并终止Playbook，这是默认行为。但通过外部脚本调用Playbook时，需要让Ansible在解密失败后持续提示输入密码，且拒绝任何将密码写入文件供Ansible调用的方案。

补充说明：我将加密后的Vault密码存储在settings.yaml文件中，格式如下：

general_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          66636431343633646639343661353330326634336565653430326662303039643634303564316132
          3137363234316532656438373332303861353734393430340a313133666231616163313734323536
          62313237323338366361613465303461613534373439333336306130316531363836323137376632
          6335303031343732300a343636366463903456726438633864353038333737353838303432346264
          3539

that_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          32636131346662626266363634333035653334336436616236316264663866373564326662353330
          6464353632323662343332633264636135656132303832640a326562313738373562363632643364
          37356438623537393139628394051631366163346233373830373965313437336632613366323332
          6237383135316238660a363366336431353438626234303066623233633163346661623162303163
          3238

this_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          33363362313163663864323364356661323937313962393532383235316234656230306230366235
          3734323731323135383737376435336138333833376263350a356432633634313531633533363736
          37376466346437383438353031353063623464356264663766393632396364656339336164396638
          3534393530393939310a343134636235386436383238343033656531396434626463616338643431
          64346263633463633635303932393731373863333735373234313336343735386639306665323239
          33386161316632373434613132663130643762346133343964396235346466656339666435656330

other_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          33646534383764313930623964643635626239373863383433313031393361333736396364353737
          4856386162636236383431643733626264336339666233610a353638316263373862653439663666
          36633936353064396135323934373865396635613235646631376435663737663638353132303432

解决方案 #

你可以通过以下两种无文件存储密码的方式实现需求：

1. 自定义交互式Vault密码脚本 #

编写一个循环提示密码的脚本，先验证密码有效性，再传递给Ansible。示例脚本（命名为vault_prompt.sh）：

#!/bin/bash
while true; do
    read -s -p "输入Vault密码: " VAULT_PASSWORD
    echo
    # 验证密码能否解密settings.yaml
    echo "$VAULT_PASSWORD" | ansible-vault view --vault-password-file=- settings.yaml >/dev/null 2>&1
    if [ $? -eq 0 ]; then
        echo "$VAULT_PASSWORD"
        exit 0
    else
        echo "密码无效，请重新输入。"
    fi
done

调用Playbook时指定该脚本：

ansible-playbook your_playbook.yml --vault-password-file=./vault_prompt.sh

该脚本会循环提示密码，直到输入正确，全程不会将密码写入文件。

2. 外部脚本循环调用Playbook #

在你的调用脚本中，循环执行Playbook命令，直到执行成功。示例Bash逻辑：

#!/bin/bash
while true; do
    ansible-playbook your_playbook.yml --ask-vault-pass
    if [ $? -eq 0 ]; then
        echo "Playbook执行成功。"
        exit 0
    else
        echo "解密失败，重试中..."
    fi
done

这种方式无需额外脚本，直接通过外部循环触发密码重提示，适合简单场景。

方案对比 #

• 自定义脚本方案更高效：提前验证密码，避免重复启动Playbook进程。
• 循环调用方案更简洁：无需额外编写验证逻辑，直接复用--ask-vault-pass参数。

内容的提问来源于stack exchange，提问作者Dave