如何通过Ansible配置基于Hashicorp Vault Transit引擎与RGW Agent方式的Ceph S3存储桶加密？求可用Playbook

我太懂你看官方文档时两种配置混在一起的混乱感了！刚好我整理了一个适配Ceph Reef版本的Ansible Playbook，专门用来搞定基于Hashicorp Vault Transit引擎的RGW Agent式SSE-S3加密，步骤清晰，直接上手就行：

前提说明 #

假设你的3节点Vault HA集群已通过Ansible部署完成，Ceph Reef集群也通过cephadm正常运行，且Vault与Ceph节点网络互通。

完整Ansible Playbook #

---
- name: 配置Ceph RGW SSE-S3加密（Vault Transit + Agent模式）
  hosts: ceph_rgw_nodes
  become: true
  vars:
    vault_addr: "http://你的Vault集群地址:8200"
    vault_transit_mount: "transit"
    vault_ceph_role: "ceph-rgw-crypt"
    ceph_rgw_zone: "default"
    vault_agent_user: "vault-agent"

  tasks:
    - name: 在RGW节点安装Vault Agent
      apt:
        name: vault
        state: present
        update_cache: true
      when: ansible_os_family == "Debian"

    - name: 创建Vault Agent专用系统用户
      user:
        name: "{{ vault_agent_user }}"
        system: true
        shell: /usr/sbin/nologin

    - name: 创建Vault Agent配置目录
      file:
        path: /etc/vault-agent.d
        state: directory
        owner: "{{ vault_agent_user }}"
        group: "{{ vault_agent_user }}"
        mode: '0750'

    - name: 生成Vault Agent配置文件
      template:
        src: vault-agent.hcl.j2
        dest: /etc/vault-agent.d/ceph-rgw-agent.hcl
        owner: "{{ vault_agent_user }}"
        group: "{{ vault_agent_user }}"
        mode: '0640'
      vars:
        vault_role: "{{ vault_ceph_role }}"
        vault_addr: "{{ vault_addr }}"

    - name: 创建Vault Agent systemd服务文件
      template:
        src: vault-agent.service.j2
        dest: /etc/systemd/system/vault-agent.service
        mode: '0644'

    - name: 重载systemd并启动Vault Agent服务
      systemd:
        name: vault-agent
        daemon_reload: true
        enabled: true
        state: started

    - name: 配置Ceph RGW启用Vault Agent加密
      command: |
        ceph config set client.rgw.{{ ceph_rgw_zone }} rgw crypt vault auth agent
        ceph config set client.rgw.{{ ceph_rgw_zone }} rgw crypt vault addr {{ vault_addr }}
        ceph config set client.rgw.{{ ceph_rgw_zone }} rgw crypt vault transit mount {{ vault_transit_mount }}
        ceph config set client.rgw.{{ ceph_rgw_zone }} rgw crypt vault transit key name ceph-sse-key
      register: ceph_config_result
      changed_when: "'set' in ceph_config_result.stdout"

    - name: 重启RGW服务使配置生效
      command: ceph orch restart rgw.{{ ceph_rgw_zone }}
      changed_when: true

- name: 在Vault端配置Transit引擎与权限策略
  hosts: vault_server
  become: true
  vars:
    vault_addr: "http://你的Vault集群地址:8200"
    vault_root_token: "你的Vault管理员令牌"
    vault_transit_mount: "transit"
    vault_ceph_role: "ceph-rgw-crypt"
    vault_policy_name: "ceph-rgw-crypt-policy"

  tasks:
    - name: 启用Vault Transit加密引擎
      vault_mount:
        url: "{{ vault_addr }}"
        token: "{{ vault_root_token }}"
        path: "{{ vault_transit_mount }}"
        type: transit
        description: "用于Ceph RGW SSE-S3加密的Transit引擎"
        state: present

    - name: 创建Ceph RGW专用Vault权限策略
      vault_policy:
        url: "{{ vault_addr }}"
        token: "{{ vault_root_token }}"
        name: "{{ vault_policy_name }}"
        policy: |
          path "{{ vault_transit_mount }}/encrypt/ceph-sse-key" {
            capabilities = ["update"]
          }
          path "{{ vault_transit_mount }}/decrypt/ceph-sse-key" {
            capabilities = ["update"]
          }
          path "{{ vault_transit_mount }}/keys/ceph-sse-key" {
            capabilities = ["read"]
          }

    - name: 创建Ceph Agent专用的Vault AppRole角色
      vault_approle_role:
        url: "{{ vault_addr }}"
        token: "{{ vault_root_token }}"
        role_name: "{{ vault_ceph_role }}"
        bind_secret_id: true
        secret_id_num_uses: 0
        secret_id_ttl: 0
        token_num_uses: 0
        token_ttl: 1h
        token_max_ttl: 24h
        policies: ["{{ vault_policy_name }}"]

    - name: 获取Vault AppRole的Role ID
      vault_approle_role_id:
        url: "{{ vault_addr }}"
        token: "{{ vault_root_token }}"
        role_name: "{{ vault_ceph_role }}"
      register: role_id_result

    - name: 生成Vault AppRole的Secret ID
      vault_approle_secret_id:
        url: "{{ vault_addr }}"
        token: "{{ vault_root_token }}"
        role_name: "{{ vault_ceph_role }}"
      register: secret_id_result

    - name: 将Role ID和Secret ID暂存供Agent使用
      set_fact:
        vault_role_id: "{{ role_id_result.role_id }}"
        vault_secret_id: "{{ secret_id_result.secret_id }}"
      delegate_to: localhost
      run_once: true

配套模板文件 #

1. vault-agent.hcl.j2（放在Playbook的templates目录下）

pid_file = "/var/run/vault-agent.pid"

auto_auth {
  method "approle" {
    config = {
      role_id = "{{ vault_role_id }}"
      secret_id = "{{ vault_secret_id }}"
    }
  }

  sink "file" {
    config = {
      path = "/var/run/vault-agent-token"
    }
  }
}

cache {
  use_auto_auth_token = true
}

listener "tcp" {
  address = "127.0.0.1:8201"
  tls_disable = true
}

2. vault-agent.service.j2（放在Playbook的templates目录下）

[Unit]
Description=HashiCorp Vault Agent
Documentation=https://www.vaultproject.io/docs/agent/
Requires=network-online.target
After=network-online.target

[Service]
User={{ vault_agent_user }}
Group={{ vault_agent_user }}
ExecStart=/usr/bin/vault agent -config=/etc/vault-agent.d/ceph-rgw-agent.hcl
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

关键步骤说明 #

1. Vault端配置：启用Transit引擎，创建仅允许加密/解密指定密钥的权限策略，生成供Agent使用的AppRole角色。
2. Ceph RGW节点配置：安装并启动Vault Agent，通过Agent自动获取Vault令牌，然后配置RGW启用Agent模式的加密并重启服务。

验证方法 #

创建一个S3存储桶并启用默认加密，上传测试文件后：

• 检查Vault的Transit引擎日志，确认有加密请求记录
• 下载该文件，验证能正常解密访问

备注：内容来源于stack exchange，提问作者Swampcritter