sed替换中的嵌套命令

Question

我试图使用sed在库存文件中查找和加密ansible_password字段，并使用ansible-vault命令对其进行加密。但是ansible-command在抛出一个sed错误时失败了，简单地说，回波在这里运行得很好。

sed -n "s/\( *\)\(ansible_password\: *\)\"\(.*\)\"/$(echo \\3)/p" sample.yml

输出不带双引号的属性值。

ansible-vault命令：

sed -n "s/\( *\)\(ansible_password\: *\)\"\(.*\)\"/$(ansible-vault encrypt_string --vault-password-file ~/password.txt --name 'ansible_password' '\\3')/p" sample.yml

正在抛出错误消息：sed: -e expression #1, char 67: unterminated ``s' command

以下是正在进行替换的行：

        ansible_password: "somepassword"

Answer 1

这行不通。嵌套命令将首先运行。echo的工作是偶然的，因为它会将\3作为替换模式，在这种情况下，这正是您想要的(=输出原始值)。

不确定你到底想要什么，也许你可以试试grep和xargs：

grep -Po 'ansible_password: \K"[^"]*' sample.yaml \
| xargs -n1 ansible-vault encrypt_string --vault-password-file ~/password.txt --name 'ansible_password'

但是，您可能希望使用适配yaml解析器而不是grep或sed。

Answer 2

如果您可以将变量放入"# BEGIN .# END“块中，请使用块文件。

shell> cat sample.yml
# BEGIN my_password1
my_password1: "somepassword1"
# END my_password1
# BEGIN my_password2
my_password2: "somepassword2"
# END my_password2
# BEGIN my_password3
my_password3: "somepassword3"
# END my_password3

然后，下面的任务读取文件并用加密变量替换块。

    - include_vars:
        file: sample.yml
        name: my_pswd
    - blockinfile:
        dest: sample.yml
        marker: "# {mark} {{ item }}"
        block: "{{ _enc }}"
      loop: [my_password1, my_password2, my_password3]
      vars:
        vault_cmd: "ansible-vault encrypt_string --name '{{ item }}' "
        _enc: "{{ lookup('pipe', vault_cmd ~  my_pswd[item]) }}"

给出

shell> cat sample.yml
# BEGIN my_password1
my_password1: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          30343161323861646333623332303663326438336462613165633766313130363961366633343764
          3335393837613638633565616366353139623063366131640a616233616534386663666263653432
          36376530653139666634323435313433346263643634303463643963343937316562326634313437
          6262613663313664630a343830636436376366656534366438613435366664656132643866353030
          3633
# END my_password1
# BEGIN my_password2
my_password2: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          36653034373863613531643535353361636565633463626465393065316561353661666564633762
          6139666336666433646633303664633261626135343865380a656464363430643563373264343234
          38303034653332626238326432333236333439383365623866656262343436386137353638663436
          3261363962373237300a646263396432646134313561366662326439303739303061303936353134
          6235
# END my_password2
# BEGIN my_password3
my_password3: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          31383764376166363733313065636264343863346334386230333739316337306535313866303164
          3465616663626565623438316364326532306538303134640a313564356135373931306236373833
          62383563386230633265396261363861393530653034613732333962643233316535646462656331
          6566383662323266310a343337303465613334336638316132636238343637646235646565653532
          6134
# END my_password3

当您重复这些任务时，变量的加密将被更新。