Ansible blockinfile模块替换配置块时匹配范围异常问题求助

问题说明 #

需要替换Vault配置文件中特定的HTTP listener注释块，但使用marker_end: ""的blockinfile模块会错误地将从匹配起始行到文件末尾的所有内容替换，导致中间配置丢失。

原Vault配置文件 #

# Full configuration options can be found at https://www.vaultproject.io/docs/configuration

ui = true

#mlock = true
#disable_mlock = true

storage "file" {
  path = "/opt/vault/data"
}

#storage "consul" {
#  address = "127.0.0.1:8500"
#  path    = "vault"
#}

# HTTP listener
#listener "tcp" {
#  address = "127.0.0.1:8200"
#  tls_disable = 1
#}

# HTTPS listener
listener "tcp" {
  address       = "0.0.0.0:8200"
  tls_cert_file = "/opt/vault/tls/tls.crt"
  tls_key_file  = "/opt/vault/tls/tls.key"
}

# Enterprise license_path
# This will be required for enterprise as of v1.8
#license_path = "/etc/vault.d/vault.hclic"

# Example AWS KMS auto unseal
#seal "awskms" {
#  region = "us-east-1"
#  kms_key_id = "REPLACE-ME"
#}

# Example HSM auto unseal
#seal "pkcs11" {
#  lib            = "/usr/vault/lib/libCryptoki2_64.so"
#  slot           = "0"
#  pin            = "AAAA-BBBB-CCCC-DDDD"
#  key_label      = "vault-hsm-key"
#  hmac_key_label = "vault-hsm-hmac-key"
#}

目标替换内容 #

将原注释的HTTP listener块替换为启用的非TLS监听：

# HTTP listener
listener "tcp" { 
  address = "0.0.0.0:8201"
  tls_disable = 1
}

原Ansible代码的问题 #

原代码中marker_end: ""会让blockinfile从# HTTP listener行开始，一直替换到文件末尾，导致中间的HTTPS listener等配置被删除：

- name: Disable tls for web interface
      ansible.builtin.blockinfile:
        path: /etc/vault.d/vault.hcl
        backup: true
        marker: "{mark}"
        marker_begin: "# HTTP listener"
        marker_end: ""
        block: |
          listener "tcp" {
            address = "0.0.0.0:8201"
            tls_disable = 1
          }

正确的解决方案 #

方法1：精准匹配marker_end #

指定marker_end为原块的结束行#}，同时保持默认注释格式的marker，精准定位要替换的块：

- name: Enable HTTP listener without TLS
      ansible.builtin.blockinfile:
        path: /etc/vault.d/vault.hcl
        backup: true
        marker_begin: "# HTTP listener"
        marker_end: "#}"
        block: |
          # HTTP listener
          listener "tcp" { 
            address = "0.0.0.0:8201"
            tls_disable = 1
          }

方法2：使用replace模块匹配完整块 #

如果担心marker_end可能匹配到其他行，可用replace模块直接匹配整个目标块（注意正则语法转义）：

- name: Replace HTTP listener block
      ansible.builtin.replace:
        path: /etc/vault.d/vault.hcl
        backup: true
        regexp: |
          # HTTP listener
          #listener "tcp" \{
          #  address = "127.0.0.1:8200"
          #  tls_disable = 1
          #\}
        replace: |
          # HTTP listener
          listener "tcp" { 
            address = "0.0.0.0:8201"
            tls_disable = 1
          }

最终正确配置效果 #

执行后仅替换目标HTTP listener块，其他配置完整保留：

# Full configuration options can be found at https://www.vaultproject.io/docs/configuration

ui = true

#mlock = true
#disable_mlock = true

storage "file" {
  path = "/opt/vault/data"
}

#storage "consul" {
#  address = "127.0.0.1:8500"
#  path    = "vault"
#}

# HTTP listener
listener "tcp" { 
  address = "0.0.0.0:8201"
  tls_disable = 1
}

# HTTPS listener
listener "tcp" {
  address       = "0.0.0.0:8200"
  tls_cert_file = "/opt/vault/tls/tls.crt"
  tls_key_file  = "/opt/vault/tls/tls.key"
}

# Enterprise license_path
# This will be required for enterprise as of v1.8
#license_path = "/etc/vault.d/vault.hclic"

# Example AWS KMS auto unseal
#seal "awskms" {
#  region = "us-east-1"
#  kms_key_id = "REPLACE-ME"
#}

# Example HSM auto unseal
#seal "pkcs11" {
#  lib            = "/usr/vault/lib/libCryptoki2_64.so"
#  slot           = "0"
#  pin            = "AAAA-BBBB-CCCC-DDDD"
#  key_label      = "vault-hsm-key"
#  hmac_key_label = "vault-hsm-hmac-key"
#}

内容的提问来源于stack exchange，提问作者rensar