2016-03-07 10:03:53 +00:00
|
|
|
# (c) 2014, Nandor Sivok <dominis@haxor.hu>
|
|
|
|
# (c) 2016, Redhat Inc
|
|
|
|
#
|
2016-03-09 18:53:52 +00:00
|
|
|
# ansible-console is free software: you can redistribute it and/or modify
|
2016-03-07 10:03:53 +00:00
|
|
|
# it under the terms of the GNU General Public License as published by
|
|
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
|
|
# (at your option) any later version.
|
|
|
|
#
|
2016-03-09 18:53:52 +00:00
|
|
|
# ansible-console is distributed in the hope that it will be useful,
|
2016-03-07 10:03:53 +00:00
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
|
|
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
#
|
|
|
|
|
|
|
|
from __future__ import (absolute_import, division, print_function)
|
|
|
|
__metaclass__ = type
|
|
|
|
|
|
|
|
########################################################
|
|
|
|
# ansible-console is an interactive REPL shell for ansible
|
|
|
|
# with built-in tab completion for all the documented modules
|
|
|
|
#
|
|
|
|
# Available commands:
|
|
|
|
# cd - change host/group (you can use host patterns eg.: app*.dc*:!app01*)
|
|
|
|
# list - list available hosts in the current path
|
|
|
|
# forks - change fork
|
|
|
|
# become - become
|
|
|
|
# ! - forces shell module instead of the ansible module (!yum update -y)
|
|
|
|
|
|
|
|
import atexit
|
|
|
|
import cmd
|
|
|
|
import getpass
|
|
|
|
import readline
|
|
|
|
import os
|
|
|
|
import sys
|
|
|
|
|
|
|
|
from ansible import constants as C
|
|
|
|
from ansible.cli import CLI
|
2016-05-31 16:15:19 +00:00
|
|
|
from ansible.errors import AnsibleError
|
2016-03-07 10:03:53 +00:00
|
|
|
from ansible.executor.task_queue_manager import TaskQueueManager
|
2016-09-07 05:54:17 +00:00
|
|
|
from ansible.module_utils._text import to_native, to_text
|
2017-07-14 23:44:58 +00:00
|
|
|
from ansible.module_utils.parsing.convert_bool import boolean
|
2016-03-07 10:03:53 +00:00
|
|
|
from ansible.parsing.splitter import parse_kv
|
|
|
|
from ansible.playbook.play import Play
|
2018-01-16 05:15:04 +00:00
|
|
|
from ansible.plugins.loader import module_loader, fragment_loader
|
2017-03-18 01:07:39 +00:00
|
|
|
from ansible.utils import plugin_docs
|
2016-03-07 10:03:53 +00:00
|
|
|
from ansible.utils.color import stringc
|
|
|
|
|
|
|
|
try:
|
|
|
|
from __main__ import display
|
|
|
|
except ImportError:
|
|
|
|
from ansible.utils.display import Display
|
|
|
|
display = Display()
|
|
|
|
|
|
|
|
|
|
|
|
class ConsoleCLI(CLI, cmd.Cmd):
|
2017-03-23 05:11:40 +00:00
|
|
|
''' a REPL that allows for running ad-hoc tasks against a chosen inventory (based on dominis' ansible-shell).'''
|
2016-03-07 10:03:53 +00:00
|
|
|
|
|
|
|
modules = []
|
2017-06-02 11:14:11 +00:00
|
|
|
ARGUMENTS = {'host-pattern': 'A name of a group in the inventory, a shell-like glob '
|
|
|
|
'selecting hosts in inventory or any combination of the two separated by commas.'}
|
2016-03-07 10:03:53 +00:00
|
|
|
|
|
|
|
def __init__(self, args):
|
|
|
|
|
|
|
|
super(ConsoleCLI, self).__init__(args)
|
|
|
|
|
|
|
|
self.intro = 'Welcome to the ansible console.\nType help or ? to list commands.\n'
|
|
|
|
|
|
|
|
self.groups = []
|
|
|
|
self.hosts = []
|
|
|
|
self.pattern = None
|
|
|
|
self.variable_manager = None
|
|
|
|
self.loader = None
|
|
|
|
self.passwords = dict()
|
|
|
|
|
|
|
|
self.modules = None
|
|
|
|
cmd.Cmd.__init__(self)
|
|
|
|
|
|
|
|
def parse(self):
|
|
|
|
self.parser = CLI.base_parser(
|
2017-03-22 20:38:49 +00:00
|
|
|
usage='%prog [<host-pattern>] [options]',
|
2016-03-07 10:03:53 +00:00
|
|
|
runas_opts=True,
|
|
|
|
inventory_opts=True,
|
|
|
|
connect_opts=True,
|
|
|
|
check_opts=True,
|
|
|
|
vault_opts=True,
|
|
|
|
fork_opts=True,
|
|
|
|
module_opts=True,
|
2017-10-31 19:41:30 +00:00
|
|
|
basedir_opts=True,
|
2017-03-22 20:38:49 +00:00
|
|
|
desc="REPL console for executing Ansible tasks.",
|
|
|
|
epilog="This is not a live session/connection, each task executes in the background and returns it's results."
|
2016-03-07 10:03:53 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
# options unique to shell
|
|
|
|
self.parser.add_option('--step', dest='step', action='store_true',
|
2017-06-02 11:14:11 +00:00
|
|
|
help="one-step-at-a-time: confirm each task before running")
|
2016-03-07 10:03:53 +00:00
|
|
|
|
|
|
|
self.parser.set_defaults(cwd='*')
|
2016-09-29 21:14:02 +00:00
|
|
|
|
2016-10-16 21:40:58 +00:00
|
|
|
super(ConsoleCLI, self).parse()
|
2016-03-07 10:03:53 +00:00
|
|
|
|
|
|
|
display.verbosity = self.options.verbosity
|
|
|
|
self.validate_conflicts(runas_opts=True, vault_opts=True, fork_opts=True)
|
|
|
|
|
|
|
|
def get_names(self):
|
|
|
|
return dir(self)
|
|
|
|
|
|
|
|
def cmdloop(self):
|
|
|
|
try:
|
|
|
|
cmd.Cmd.cmdloop(self)
|
|
|
|
except KeyboardInterrupt:
|
|
|
|
self.do_exit(self)
|
|
|
|
|
|
|
|
def set_prompt(self):
|
|
|
|
login_user = self.options.remote_user or getpass.getuser()
|
|
|
|
self.selected = self.inventory.list_hosts(self.options.cwd)
|
|
|
|
prompt = "%s@%s (%d)[f:%s]" % (login_user, self.options.cwd, len(self.selected), self.options.forks)
|
|
|
|
if self.options.become and self.options.become_user in [None, 'root']:
|
|
|
|
prompt += "# "
|
|
|
|
color = C.COLOR_ERROR
|
|
|
|
else:
|
|
|
|
prompt += "$ "
|
|
|
|
color = C.COLOR_HIGHLIGHT
|
|
|
|
self.prompt = stringc(prompt, color)
|
|
|
|
|
|
|
|
def list_modules(self):
|
|
|
|
modules = set()
|
2017-10-16 14:47:40 +00:00
|
|
|
if self.options.module_path:
|
|
|
|
for path in self.options.module_path:
|
|
|
|
if path:
|
|
|
|
module_loader.add_directory(path)
|
2016-03-07 10:03:53 +00:00
|
|
|
|
|
|
|
module_paths = module_loader._get_paths()
|
|
|
|
for path in module_paths:
|
|
|
|
if path is not None:
|
|
|
|
modules.update(self._find_modules_in_path(path))
|
|
|
|
return modules
|
|
|
|
|
|
|
|
def _find_modules_in_path(self, path):
|
|
|
|
|
|
|
|
if os.path.isdir(path):
|
|
|
|
for module in os.listdir(path):
|
|
|
|
if module.startswith('.'):
|
|
|
|
continue
|
|
|
|
elif os.path.isdir(module):
|
|
|
|
self._find_modules_in_path(module)
|
|
|
|
elif module.startswith('__'):
|
|
|
|
continue
|
|
|
|
elif any(module.endswith(x) for x in C.BLACKLIST_EXTS):
|
|
|
|
continue
|
|
|
|
elif module in C.IGNORE_FILES:
|
|
|
|
continue
|
|
|
|
elif module.startswith('_'):
|
2017-06-02 11:14:11 +00:00
|
|
|
fullpath = '/'.join([path, module])
|
2016-09-07 05:54:17 +00:00
|
|
|
if os.path.islink(fullpath): # avoids aliases
|
2016-03-07 10:03:53 +00:00
|
|
|
continue
|
|
|
|
module = module.replace('_', '', 1)
|
|
|
|
|
2016-09-07 05:54:17 +00:00
|
|
|
module = os.path.splitext(module)[0] # removes the extension
|
2016-03-07 10:03:53 +00:00
|
|
|
yield module
|
|
|
|
|
|
|
|
def default(self, arg, forceshell=False):
|
|
|
|
""" actually runs modules """
|
|
|
|
if arg.startswith("#"):
|
|
|
|
return False
|
|
|
|
|
|
|
|
if not self.options.cwd:
|
|
|
|
display.error("No host found")
|
|
|
|
return False
|
|
|
|
|
|
|
|
if arg.split()[0] in self.modules:
|
|
|
|
module = arg.split()[0]
|
|
|
|
module_args = ' '.join(arg.split()[1:])
|
|
|
|
else:
|
|
|
|
module = 'shell'
|
|
|
|
module_args = arg
|
|
|
|
|
|
|
|
if forceshell is True:
|
|
|
|
module = 'shell'
|
|
|
|
module_args = arg
|
|
|
|
|
|
|
|
self.options.module_name = module
|
|
|
|
|
|
|
|
result = None
|
|
|
|
try:
|
2016-03-21 15:00:07 +00:00
|
|
|
check_raw = self.options.module_name in ('command', 'shell', 'script', 'raw')
|
2016-03-07 10:03:53 +00:00
|
|
|
play_ds = dict(
|
2017-06-02 11:14:11 +00:00
|
|
|
name="Ansible Shell",
|
|
|
|
hosts=self.options.cwd,
|
|
|
|
gather_facts='no',
|
|
|
|
tasks=[dict(action=dict(module=module, args=parse_kv(module_args, check_raw=check_raw)))]
|
2016-03-07 10:03:53 +00:00
|
|
|
)
|
|
|
|
play = Play().load(play_ds, variable_manager=self.variable_manager, loader=self.loader)
|
|
|
|
except Exception as e:
|
2016-09-07 05:54:17 +00:00
|
|
|
display.error(u"Unable to build command: %s" % to_text(e))
|
2016-03-07 10:03:53 +00:00
|
|
|
return False
|
|
|
|
|
|
|
|
try:
|
2016-09-07 05:54:17 +00:00
|
|
|
cb = 'minimal' # FIXME: make callbacks configurable
|
2016-03-07 10:03:53 +00:00
|
|
|
# now create a task queue manager to execute the play
|
|
|
|
self._tqm = None
|
|
|
|
try:
|
|
|
|
self._tqm = TaskQueueManager(
|
2017-01-29 07:28:53 +00:00
|
|
|
inventory=self.inventory,
|
|
|
|
variable_manager=self.variable_manager,
|
|
|
|
loader=self.loader,
|
|
|
|
options=self.options,
|
|
|
|
passwords=self.passwords,
|
|
|
|
stdout_callback=cb,
|
|
|
|
run_additional_callbacks=C.DEFAULT_LOAD_CALLBACK_PLUGINS,
|
|
|
|
run_tree=False,
|
|
|
|
)
|
2016-03-07 10:03:53 +00:00
|
|
|
|
|
|
|
result = self._tqm.run(play)
|
|
|
|
finally:
|
|
|
|
if self._tqm:
|
|
|
|
self._tqm.cleanup()
|
2016-04-14 14:31:39 +00:00
|
|
|
if self.loader:
|
|
|
|
self.loader.cleanup_all_tmp_files()
|
2016-03-07 10:03:53 +00:00
|
|
|
|
|
|
|
if result is None:
|
|
|
|
display.error("No hosts found")
|
|
|
|
return False
|
|
|
|
except KeyboardInterrupt:
|
|
|
|
display.error('User interrupted execution')
|
|
|
|
return False
|
|
|
|
except Exception as e:
|
2016-09-07 05:54:17 +00:00
|
|
|
display.error(to_text(e))
|
|
|
|
# FIXME: add traceback in very very verbose mode
|
2016-03-07 10:03:53 +00:00
|
|
|
return False
|
|
|
|
|
|
|
|
def emptyline(self):
|
|
|
|
return
|
|
|
|
|
|
|
|
def do_shell(self, arg):
|
|
|
|
"""
|
|
|
|
You can run shell commands through the shell module.
|
|
|
|
|
|
|
|
eg.:
|
|
|
|
shell ps uax | grep java | wc -l
|
|
|
|
shell killall python
|
|
|
|
shell halt -n
|
|
|
|
|
|
|
|
You can use the ! to force the shell module. eg.:
|
|
|
|
!ps aux | grep java | wc -l
|
|
|
|
"""
|
|
|
|
self.default(arg, True)
|
|
|
|
|
|
|
|
def do_forks(self, arg):
|
|
|
|
"""Set the number of forks"""
|
|
|
|
if not arg:
|
|
|
|
display.display('Usage: forks <number>')
|
|
|
|
return
|
|
|
|
self.options.forks = int(arg)
|
|
|
|
self.set_prompt()
|
|
|
|
|
|
|
|
do_serial = do_forks
|
|
|
|
|
|
|
|
def do_verbosity(self, arg):
|
|
|
|
"""Set verbosity level"""
|
|
|
|
if not arg:
|
|
|
|
display.display('Usage: verbosity <number>')
|
|
|
|
else:
|
|
|
|
display.verbosity = int(arg)
|
|
|
|
display.v('verbosity level set to %s' % arg)
|
|
|
|
|
|
|
|
def do_cd(self, arg):
|
|
|
|
"""
|
|
|
|
Change active host/group. You can use hosts patterns as well eg.:
|
|
|
|
cd webservers
|
|
|
|
cd webservers:dbservers
|
|
|
|
cd webservers:!phoenix
|
|
|
|
cd webservers:&staging
|
|
|
|
cd webservers:dbservers:&staging:!phoenix
|
|
|
|
"""
|
|
|
|
if not arg:
|
|
|
|
self.options.cwd = '*'
|
|
|
|
elif arg in '/*':
|
|
|
|
self.options.cwd = 'all'
|
|
|
|
elif self.inventory.get_hosts(arg):
|
|
|
|
self.options.cwd = arg
|
|
|
|
else:
|
|
|
|
display.display("no host matched")
|
|
|
|
|
|
|
|
self.set_prompt()
|
|
|
|
|
|
|
|
def do_list(self, arg):
|
|
|
|
"""List the hosts in the current group"""
|
|
|
|
if arg == 'groups':
|
|
|
|
for group in self.groups:
|
|
|
|
display.display(group)
|
|
|
|
else:
|
|
|
|
for host in self.selected:
|
|
|
|
display.display(host.name)
|
|
|
|
|
|
|
|
def do_become(self, arg):
|
|
|
|
"""Toggle whether plays run with become"""
|
|
|
|
if arg:
|
2017-07-14 23:44:58 +00:00
|
|
|
self.options.become = boolean(arg, strict=False)
|
2016-03-07 10:03:53 +00:00
|
|
|
display.v("become changed to %s" % self.options.become)
|
|
|
|
self.set_prompt()
|
|
|
|
else:
|
|
|
|
display.display("Please specify become value, e.g. `become yes`")
|
|
|
|
|
|
|
|
def do_remote_user(self, arg):
|
|
|
|
"""Given a username, set the remote user plays are run by"""
|
|
|
|
if arg:
|
|
|
|
self.options.remote_user = arg
|
|
|
|
self.set_prompt()
|
|
|
|
else:
|
|
|
|
display.display("Please specify a remote user, e.g. `remote_user root`")
|
|
|
|
|
|
|
|
def do_become_user(self, arg):
|
|
|
|
"""Given a username, set the user that plays are run by when using become"""
|
|
|
|
if arg:
|
|
|
|
self.options.become_user = arg
|
|
|
|
else:
|
|
|
|
display.display("Please specify a user, e.g. `become_user jenkins`")
|
|
|
|
display.v("Current user is %s" % self.options.become_user)
|
|
|
|
self.set_prompt()
|
|
|
|
|
|
|
|
def do_become_method(self, arg):
|
|
|
|
"""Given a become_method, set the privilege escalation method when using become"""
|
|
|
|
if arg:
|
|
|
|
self.options.become_method = arg
|
|
|
|
display.v("become_method changed to %s" % self.options.become_method)
|
|
|
|
else:
|
|
|
|
display.display("Please specify a become_method, e.g. `become_method su`")
|
|
|
|
|
2016-07-25 12:03:16 +00:00
|
|
|
def do_check(self, arg):
|
|
|
|
"""Toggle whether plays run with check mode"""
|
|
|
|
if arg:
|
2017-07-14 23:44:58 +00:00
|
|
|
self.options.check = boolean(arg, strict=False)
|
2016-07-25 12:03:16 +00:00
|
|
|
display.v("check mode changed to %s" % self.options.check)
|
|
|
|
else:
|
|
|
|
display.display("Please specify check mode value, e.g. `check yes`")
|
|
|
|
|
|
|
|
def do_diff(self, arg):
|
|
|
|
"""Toggle whether plays run with diff"""
|
|
|
|
if arg:
|
2017-07-14 23:44:58 +00:00
|
|
|
self.options.diff = boolean(arg, strict=False)
|
2016-07-25 12:03:16 +00:00
|
|
|
display.v("diff mode changed to %s" % self.options.diff)
|
|
|
|
else:
|
|
|
|
display.display("Please specify a diff value , e.g. `diff yes`")
|
|
|
|
|
2016-03-07 10:03:53 +00:00
|
|
|
def do_exit(self, args):
|
|
|
|
"""Exits from the console"""
|
|
|
|
sys.stdout.write('\n')
|
|
|
|
return -1
|
|
|
|
|
|
|
|
do_EOF = do_exit
|
|
|
|
|
|
|
|
def helpdefault(self, module_name):
|
|
|
|
if module_name in self.modules:
|
|
|
|
in_path = module_loader.find_plugin(module_name)
|
|
|
|
if in_path:
|
2018-01-16 05:15:04 +00:00
|
|
|
oc, a, _, _ = plugin_docs.get_docstring(in_path, fragment_loader)
|
2016-03-07 10:03:53 +00:00
|
|
|
if oc:
|
|
|
|
display.display(oc['short_description'])
|
|
|
|
display.display('Parameters:')
|
|
|
|
for opt in oc['options'].keys():
|
|
|
|
display.display(' ' + stringc(opt, C.COLOR_HIGHLIGHT) + ' ' + oc['options'][opt]['description'][0])
|
|
|
|
else:
|
|
|
|
display.error('No documentation found for %s.' % module_name)
|
|
|
|
else:
|
|
|
|
display.error('%s is not a valid command, use ? to list all valid commands.' % module_name)
|
|
|
|
|
|
|
|
def complete_cd(self, text, line, begidx, endidx):
|
|
|
|
mline = line.partition(' ')[2]
|
|
|
|
offs = len(mline) - len(text)
|
|
|
|
|
2017-06-02 11:14:11 +00:00
|
|
|
if self.options.cwd in ('all', '*', '\\'):
|
2016-03-07 10:03:53 +00:00
|
|
|
completions = self.hosts + self.groups
|
|
|
|
else:
|
|
|
|
completions = [x.name for x in self.inventory.list_hosts(self.options.cwd)]
|
|
|
|
|
2016-09-07 05:54:17 +00:00
|
|
|
return [to_native(s)[offs:] for s in completions if to_native(s).startswith(to_native(mline))]
|
2016-03-07 10:03:53 +00:00
|
|
|
|
|
|
|
def completedefault(self, text, line, begidx, endidx):
|
|
|
|
if line.split()[0] in self.modules:
|
|
|
|
mline = line.split(' ')[-1]
|
|
|
|
offs = len(mline) - len(text)
|
|
|
|
completions = self.module_args(line.split()[0])
|
|
|
|
|
|
|
|
return [s[offs:] + '=' for s in completions if s.startswith(mline)]
|
|
|
|
|
|
|
|
def module_args(self, module_name):
|
|
|
|
in_path = module_loader.find_plugin(module_name)
|
2018-01-16 05:15:04 +00:00
|
|
|
oc, a, _, _ = plugin_docs.get_docstring(in_path, fragment_loader)
|
2016-12-20 20:50:29 +00:00
|
|
|
return list(oc['options'].keys())
|
2016-03-07 10:03:53 +00:00
|
|
|
|
|
|
|
def run(self):
|
|
|
|
|
|
|
|
super(ConsoleCLI, self).run()
|
|
|
|
|
2017-06-02 11:14:11 +00:00
|
|
|
sshpass = None
|
2016-03-07 10:03:53 +00:00
|
|
|
becomepass = None
|
|
|
|
|
|
|
|
# hosts
|
|
|
|
if len(self.args) != 1:
|
|
|
|
self.pattern = 'all'
|
|
|
|
else:
|
|
|
|
self.pattern = self.args[0]
|
|
|
|
self.options.cwd = self.pattern
|
|
|
|
|
|
|
|
# dynamically add modules as commands
|
|
|
|
self.modules = self.list_modules()
|
|
|
|
for module in self.modules:
|
|
|
|
setattr(self, 'do_' + module, lambda arg, module=module: self.default(module + ' ' + arg))
|
|
|
|
setattr(self, 'help_' + module, lambda module=module: self.helpdefault(module))
|
|
|
|
|
|
|
|
self.normalize_become_options()
|
|
|
|
(sshpass, becomepass) = self.ask_passwords()
|
2017-06-02 11:14:11 +00:00
|
|
|
self.passwords = {'conn_pass': sshpass, 'become_pass': becomepass}
|
2016-03-07 10:03:53 +00:00
|
|
|
|
2017-05-23 21:16:49 +00:00
|
|
|
self.loader, self.inventory, self.variable_manager = self._play_prereqs(self.options)
|
2016-03-07 10:03:53 +00:00
|
|
|
|
2017-08-15 15:56:17 +00:00
|
|
|
default_vault_ids = C.DEFAULT_VAULT_IDENTITY_LIST
|
|
|
|
vault_ids = self.options.vault_ids
|
|
|
|
vault_ids = default_vault_ids + vault_ids
|
Support multiple vault passwords (#22756)
Fixes #13243
** Add --vault-id to name/identify multiple vault passwords
Use --vault-id to indicate id and path/type
--vault-id=prompt # prompt for default vault id password
--vault-id=myorg@prompt # prompt for a vault_id named 'myorg'
--vault-id=a_password_file # load ./a_password_file for default id
--vault-id=myorg@a_password_file # load file for 'myorg' vault id
vault_id's are created implicitly for existing --vault-password-file
and --ask-vault-pass options.
Vault ids are just for UX purposes and bookkeeping. Only the vault
payload and the password bytestring is needed to decrypt a
vault blob.
Replace passing password around everywhere with
a VaultSecrets object.
If we specify a vault_id, mention that in password prompts
Specifying multiple -vault-password-files will
now try each until one works
** Rev vault format in a backwards compatible way
The 1.2 vault format adds the vault_id to the header line
of the vault text. This is backwards compatible with older
versions of ansible. Old versions will just ignore it and
treat it as the default (and only) vault id.
Note: only 2.4+ supports multiple vault passwords, so while
earlier ansible versions can read the vault-1.2 format, it
does not make them magically support multiple vault passwords.
use 1.1 format for 'default' vault_id
Vaulted items that need to include a vault_id will be
written in 1.2 format.
If we set a new DEFAULT_VAULT_IDENTITY, then the default will
use version 1.2
vault will only use a vault_id if one is specified. So if none
is specified and C.DEFAULT_VAULT_IDENTITY is 'default'
we use the old format.
** Changes/refactors needed to implement multiple vault passwords
raise exceptions on decrypt fail, check vault id early
split out parsing the vault plaintext envelope (with the
sha/original plaintext) to _split_plaintext_envelope()
some cli fixups for specifying multiple paths in
the unfrack_paths optparse callback
fix py3 dict.keys() 'dict_keys object is not indexable' error
pluralize cli.options.vault_password_file -> vault_password_files
pluralize cli.options.new_vault_password_file -> new_vault_password_files
pluralize cli.options.vault_id -> cli.options.vault_ids
** Add a config option (vault_id_match) to force vault id matching.
With 'vault_id_match=True' and an ansible
vault that provides a vault_id, then decryption will require
that a matching vault_id is required. (via
--vault-id=my_vault_id@password_file, for ex).
In other words, if the config option is true, then only
the vault secrets with matching vault ids are candidates for
decrypting a vault. If option is false (the default), then
all of the provided vault secrets will be selected.
If a user doesn't want all vault secrets to be tried to
decrypt any vault content, they can enable this option.
Note: The vault id used for the match is not encrypted or
cryptographically signed. It is just a label/id/nickname used
for referencing a specific vault secret.
2017-07-28 19:20:58 +00:00
|
|
|
vault_secrets = self.setup_vault_secrets(self.loader,
|
2017-08-15 15:56:17 +00:00
|
|
|
vault_ids=vault_ids,
|
Support multiple vault passwords (#22756)
Fixes #13243
** Add --vault-id to name/identify multiple vault passwords
Use --vault-id to indicate id and path/type
--vault-id=prompt # prompt for default vault id password
--vault-id=myorg@prompt # prompt for a vault_id named 'myorg'
--vault-id=a_password_file # load ./a_password_file for default id
--vault-id=myorg@a_password_file # load file for 'myorg' vault id
vault_id's are created implicitly for existing --vault-password-file
and --ask-vault-pass options.
Vault ids are just for UX purposes and bookkeeping. Only the vault
payload and the password bytestring is needed to decrypt a
vault blob.
Replace passing password around everywhere with
a VaultSecrets object.
If we specify a vault_id, mention that in password prompts
Specifying multiple -vault-password-files will
now try each until one works
** Rev vault format in a backwards compatible way
The 1.2 vault format adds the vault_id to the header line
of the vault text. This is backwards compatible with older
versions of ansible. Old versions will just ignore it and
treat it as the default (and only) vault id.
Note: only 2.4+ supports multiple vault passwords, so while
earlier ansible versions can read the vault-1.2 format, it
does not make them magically support multiple vault passwords.
use 1.1 format for 'default' vault_id
Vaulted items that need to include a vault_id will be
written in 1.2 format.
If we set a new DEFAULT_VAULT_IDENTITY, then the default will
use version 1.2
vault will only use a vault_id if one is specified. So if none
is specified and C.DEFAULT_VAULT_IDENTITY is 'default'
we use the old format.
** Changes/refactors needed to implement multiple vault passwords
raise exceptions on decrypt fail, check vault id early
split out parsing the vault plaintext envelope (with the
sha/original plaintext) to _split_plaintext_envelope()
some cli fixups for specifying multiple paths in
the unfrack_paths optparse callback
fix py3 dict.keys() 'dict_keys object is not indexable' error
pluralize cli.options.vault_password_file -> vault_password_files
pluralize cli.options.new_vault_password_file -> new_vault_password_files
pluralize cli.options.vault_id -> cli.options.vault_ids
** Add a config option (vault_id_match) to force vault id matching.
With 'vault_id_match=True' and an ansible
vault that provides a vault_id, then decryption will require
that a matching vault_id is required. (via
--vault-id=my_vault_id@password_file, for ex).
In other words, if the config option is true, then only
the vault secrets with matching vault ids are candidates for
decrypting a vault. If option is false (the default), then
all of the provided vault secrets will be selected.
If a user doesn't want all vault secrets to be tried to
decrypt any vault content, they can enable this option.
Note: The vault id used for the match is not encrypted or
cryptographically signed. It is just a label/id/nickname used
for referencing a specific vault secret.
2017-07-28 19:20:58 +00:00
|
|
|
vault_password_files=self.options.vault_password_files,
|
|
|
|
ask_vault_pass=self.options.ask_vault_pass)
|
|
|
|
self.loader.set_vault_secrets(vault_secrets)
|
|
|
|
|
2017-12-15 20:43:51 +00:00
|
|
|
hosts = CLI.get_host_list(self.inventory, self.options.subset, self.pattern)
|
2016-05-31 16:15:19 +00:00
|
|
|
|
2016-03-07 10:03:53 +00:00
|
|
|
self.groups = self.inventory.list_groups()
|
2016-05-31 16:15:19 +00:00
|
|
|
self.hosts = [x.name for x in hosts]
|
2016-03-07 10:03:53 +00:00
|
|
|
|
|
|
|
# This hack is to work around readline issues on a mac:
|
|
|
|
# http://stackoverflow.com/a/7116997/541202
|
|
|
|
if 'libedit' in readline.__doc__:
|
|
|
|
readline.parse_and_bind("bind ^I rl_complete")
|
|
|
|
else:
|
|
|
|
readline.parse_and_bind("tab: complete")
|
|
|
|
|
|
|
|
histfile = os.path.join(os.path.expanduser("~"), ".ansible-console_history")
|
|
|
|
try:
|
|
|
|
readline.read_history_file(histfile)
|
|
|
|
except IOError:
|
|
|
|
pass
|
|
|
|
|
|
|
|
atexit.register(readline.write_history_file, histfile)
|
|
|
|
self.set_prompt()
|
|
|
|
self.cmdloop()
|