Ansible não pode se conectar com sua própria configuração ssh para hosts de inventário dinâmicos

Question

Minha configuração Ansible ansible.cfg :

[defaults]
host_key_checking = False
remote_user = centos
roles_path = ./roles
pipelining = True

[ssh_connection]
ssh_args = -F /etc/ansible/ssh/ssh_config

ssh_config :

Host bastion.host
  Hostname bastion.host
  User centos
  IdentityFile /etc/ansible/ssh/KEY.pem
  StrictHostKeyChecking no

Host 10.*.*.*
  User centos
  ProxyCommand ssh -W %h:%p bastion.host
  IdentityFile /etc/ansible/ssh/KEY.pem
  StrictHostKeyChecking no

quando tento executar o manual da Ansible

ansible -i /etc/ansible/inventories/aws-inventory/ec2.py tag_class_master -m ping

The authenticity of host 'bastion.host' can't be established.
ECDSA key fingerprint is SHA256:vwYBZHWHDXx2ehQTEhzpD4EAcTTnu5cJWsNFPOYt9Q0.
Are you sure you want to continue connecting (yes/no)? The authenticity of host 'bastion.host' can't be established.
ECDSA key fingerprint is SHA256:vwYBZHWHDXx2ehQTEhzpD4EAcTTnu5cJWsNFPOYt9Q0.
Are you sure you want to continue connecting (yes/no)? The authenticity of host 'bastion.host' can't be established.
ECDSA key fingerprint is SHA256:vwYBZHWHDXx2ehQTEhzpD4EAcTTnu5cJWsNFPOYt9Q0.
Are you sure you want to continue connecting (yes/no)? yes
Please type 'yes' or 'no': yes
Please type 'yes' or 'no': yes
Please type 'yes' or 'no': yes
Please type 'yes' or 'no': yes
10.0.1.178 | UNREACHABLE! => {
    "changed": false, 
    "msg": "Failed to connect to the host via ssh: Host key verification failed.\r\nssh_exchange_identification: Connection closed by remote host\r\n", 
    "unreachable": true
}
10.0.3.188 | UNREACHABLE! => {
    "changed": false, 
    "msg": "Failed to connect to the host via ssh: Connection timed out during banner exchange\r\n", 
    "unreachable": true
}
10.0.2.36 | UNREACHABLE! => {
    "changed": false, 
    "msg": "Failed to connect to the host via ssh: Connection timed out during banner exchange\r\n", 
    "unreachable": true
}

mas quando eu copiar meu ssh_config no diretório home ~/.ssh/config , ele começa a funcionar. Passei alguns dias debbing e tentei diferentes soluções como

ansible_ssh_common_args: '-o ProxyCommand="ssh -W %h:%p [email protected] -i /etc/ansible/ssh/KEY.pem"'

em grupos de hosts específicos. Por que eu preciso colocar o arquivo de configuração ssh no meu diretório home usando o parâmetro ssh_args = -F /etc/ansible/ssh/ssh_config ? Minha versão ansiosa:

ansible 2.5.1
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/dist-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.15rc1 (default, Apr 15 2018, 21:51:34) [GCC 7.3.0]

Ansible é docerizado e eu corro como root:

FROM ubuntu:bionic-20180426

RUN apt-get update && \
    apt-get upgrade -y && \
    apt-get install -y ansible sshpass python-pip

# install boto python module for ec2 dynamic inventory
RUN pip install boto

ENTRYPOINT /bin/bash

de dentro do meu ansible repo como

docker run -it --rm -v $(pwd):/etc/ansible/ ansible:ubuntu bash

    

Answer 1

Tive a mesma situação que você. Eu rodei o Ansible com o -vvvv para depuração do SSH, e descobri que ele estava procurando por uma chave dentro da raiz / etc / .ssh. Meu erro foi correr com o sudo. Se a sua chave estiver localizada no diretório inicial, você receberá este erro.