如何使用Ansible Tower中的现有Vault文件？

我想将之前与Ansible（standalone）（包括group_vars和Vault文件）一起使用的现有库存导入Ansible Tower（3.2.0）。

但是，一旦Vault文件起作用，似乎就不起作用。设置保险库密码文件凭证并使用源types“源自项目”创build清单后，我无法在“源详细信息”下select保险柜凭证。

凭证对话框截图

当我手动将其放入并保存源 – 同步失败，出现以下错误：

1.735 INFO Updating inventory 10: TEST 1.753 DEBUG Using system install of ansible-inventory CLI: /usr/bin/ansible-inventory 1.753 INFO Reading Ansible inventory source: /var/lib/awx/projects/_6__ansible_master/inventories/test/hosts 1.754 DEBUG Using private credential data in '/tmp/awx_123_LXUj9p'. 1.755 DEBUG Using fresh temporary directory '/tmp/awx_proot_ZURWmR' for isolation. 1.755 DEBUG Running from `/var/lib/awx/projects/_6__ansible_master/inventories/test` working directory. Traceback (most recent call last): File "/usr/bin/awx-manage", line 9, in <module> load_entry_point('awx==3.2.0', 'console_scripts', 'awx-manage')() File "/lib/python2.7/site-packages/awx/__init__.py", line 107, in manage File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/management/__init__.py", line 354, in execute_from_command_line utility.execute() File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/management/__init__.py", line 346, in execute self.fetch_command(subcommand).run_from_argv(self.argv) File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/management/base.py", line 394, in run_from_argv self.execute(*args, **cmd_options) File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/management/base.py", line 445, in execute output = self.handle(*args, **options) File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/management/base.py", line 661, in handle return self.handle_noargs(**options) File "/lib/python2.7/site-packages/awx/main/management/commands/inventory_import.py", line 1000, in handle_noargs File "/lib/python2.7/site-packages/awx/main/management/commands/inventory_import.py", line 243, in load_inventory_source File "/lib/python2.7/site-packages/awx/main/management/commands/inventory_import.py", line 179, in load File "/lib/python2.7/site-packages/awx/main/management/commands/inventory_import.py", line 163, in command_to_json RuntimeError: ansible-inventory failed (rc=4) with stdout: stderr: ERROR! Attempting to decrypt but no vault secrets found

我也尝试创build一个ansible_vault文件，并指出variables“vault_password_file” – 但这不会工作（抱怨找不到保险库密码文件）。

有没有人遇到过这个？

所以看起来这更像是一个实现问题。根据RedHat的说法，build议不要将库文件保留在库存中，因为这意味着每次库存同步运行时都会解密文件。

我现在解决这个问题的方法是在剧本中使用“vars_files”。它看起来像这样：

  # Secrets vars_files: - '../../secrets/{{ tower_env }}/vault.yml'

在Tower中，我传入了tower_envvariables，例如“dev”或“qa”，然后在剧本运行时解密相应的Vault文件 – 而不是在同步库存时。