6650ba7654
commit9921bb9d20Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Mon Aug 10 20:19:44 2015 +0530 Document --ssh-extra-args command-line option commit8b25595e7bAuthor: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Thu Aug 13 13:24:57 2015 +0530 Don't disable GSSAPI/Pubkey authentication when using --ask-pass This commit is based on a bug report and PR by kolbyjack (#6846) which was subsequently closed and rebased as #11690. The original problem was: «The password on the delegated host is different from the one I provided on the command line, so it had to use the pubkey, and the main host doesn't have a pubkey on it yet, so it had to use the password.» (This commit is revised and included here because #11690 would conflict with the changes in #11908 otherwise.) Closes #11690 commit119d032389Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Thu Aug 13 11:16:42 2015 +0530 Be more explicit about why SSH arguments are added This adds vvvvv log messages that spell out in detail where each SSH command-line argument is obtained from. Unfortunately, we can't be sure if, say, self._play_context.remote_user is obtained from ANSIBLE_REMOTE_USER in the environment, remote_user in ansible.cfg, -u on the command line, or an ansible_ssh_user setting in the inventory or on a task or play. In some cases, e.g. timeout, we can't even be sure if it was set by the user or just a default. Nevertheless, on the theory that at five v's you can use all the hints available, I've mentioned the possible sources in the log messages. Note that this caveat applies only to the arguments that ssh.py adds by itself. In the case of ssh_args and ssh_extra_args, we know where they are from, and say so, though we can't say WHERE in the inventory they may be set (e.g. in host_vars or group_vars etc.). commitb605c285baAuthor: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Tue Aug 11 15:19:43 2015 +0530 Add a FAQ entry about ansible_ssh_extra_args commit49f8edd035Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Mon Aug 10 20:48:50 2015 +0530 Allow ansible_ssh_args to be set as an inventory variable Before this change, ssh_args could be set only in the [ssh_connection] section of ansible.cfg, and was applied to all hosts. Now it's possible to set ansible_ssh_args as an inventory variable (directly, or through group_vars or host_vars) to selectively override the global setting. Note that the default ControlPath settings are applied only if ssh_args is not set, and this is true of ansible_ssh_args as well. So if you want to override ssh_args but continue to set ControlPath, you'll need to repeat the appropriate options when setting ansible_ssh_args. (If you only need to add options to the default ssh_args, you may be able to use the ansible_ssh_extra_args inventory variable instead.) commit37c1a5b679Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Mon Aug 10 19:42:30 2015 +0530 Allow overriding ansible_ssh_extra_args on the command-line This patch makes it possible to do: ansible somehost -m setup \ --ssh-extra-args '-o ProxyCommand="ssh -W %h:%p -q user@bouncer.example.com"' This overrides the inventory setting, if any, of ansible_ssh_extra_args. Based on a patch originally by @Richard2ndQuadrant. commitb023ace8a8Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Mon Aug 10 19:06:19 2015 +0530 Add an ansible_ssh_extra_args inventory variable This can be used to configure a per-host or per-group ProxyCommand to connect to hosts through a jumphost, e.g.: inventory: [gatewayed] foo ansible_ssh_host=192.0.2.1 group_vars/gatewayed.yml: ansible_ssh_extra_args: '-o ProxyCommand="ssh -W %h:%p -q bounceuser@gateway.example.com"' Note that this variable is used in addition to any ssh_args configured in the [ssh_connection] section of ansible.cfg (so you don't need to repeat the ControlPath settings in ansible_ssh_extra_args).
152 lines
3.7 KiB
Text
152 lines
3.7 KiB
Text
ansible(1)
|
|
=========
|
|
:doctype:manpage
|
|
:man source: Ansible
|
|
:man version: %VERSION%
|
|
:man manual: System administration commands
|
|
|
|
NAME
|
|
----
|
|
ansible-pull - set up a remote copy of ansible on each managed node
|
|
|
|
|
|
SYNOPSIS
|
|
--------
|
|
ansible-pull -d DEST -U URL [options] [ <filename.yml> ]
|
|
|
|
|
|
DESCRIPTION
|
|
-----------
|
|
|
|
*Ansible* is an extra-simple tool/framework/API for doing \'remote things' over
|
|
SSH.
|
|
|
|
Use ansible-pull to set up a remote copy of ansible on each managed
|
|
node, each set to run via cron and update playbook source via
|
|
a source repository. This inverts the default *push* architecture of
|
|
ansible into a *pull* architecture, which has near-limitless scaling
|
|
potential.
|
|
|
|
The setup playbook can be tuned to change the cron frequency, logging
|
|
locations, and parameters to ansible-pull.
|
|
|
|
This is useful both for extreme scale-out as well as periodic
|
|
remediation. Usage of the 'fetch' module to retrieve logs from
|
|
ansible-pull runs would be an excellent way to gather and analyze
|
|
remote logs from ansible-pull.
|
|
|
|
|
|
OPTIONAL ARGUMENT
|
|
-----------------
|
|
|
|
*filename.yml*::
|
|
|
|
The name of one the YAML format files to run as an ansible playbook. This can
|
|
be a relative path within the checkout. If not provided, ansible-pull
|
|
will look for a playbook based on the host's fully-qualified domain name, on the
|
|
host hostname and finally a playbook named *local.yml*.
|
|
|
|
|
|
OPTIONS
|
|
-------
|
|
|
|
*--accept-host-key*::
|
|
|
|
Adds the hostkey for the repo URL if not already added.
|
|
|
|
*-K*, *--ask-sudo-pass*::
|
|
|
|
Ask for sudo password.
|
|
|
|
*-C* 'CHECKOUT', *--checkout=*'CHECKOUT'::
|
|
|
|
Branch/Tag/Commit to checkout. If not provided, uses default behavior of module used to check out playbook repository.
|
|
|
|
*-d* 'DEST', *--directory=*'DEST'::
|
|
|
|
Directory to checkout repository into. If not provided, a subdirectory of
|
|
~/.ansible/pull/ will be used.
|
|
|
|
*-e* 'EXTRA_VARS', *--extra-vars=*'EXTRA_VARS*::
|
|
|
|
Set additional variables as key=value or YAML/JSON
|
|
|
|
*-f*, *--force*::
|
|
|
|
Force running of playbook even if unable to update playbook repository. This
|
|
can be useful, for example, to enforce run-time state when a network
|
|
connection may not always be up or possible.
|
|
|
|
*-h*, *--help*::
|
|
|
|
Show the help message and exit.
|
|
|
|
*-i* 'PATH', *--inventory=*'PATH'::
|
|
|
|
The 'PATH' to the inventory hosts file. This can be a relative path within the checkout.
|
|
|
|
*--key-file=*'KEYFILE'::
|
|
|
|
Pass '-i <key_file>' to the SSH arguments used by git.
|
|
|
|
*-m* 'NAME', *--module-name=*'NAME'::
|
|
|
|
Module used to checkout playbook repository. Defaults to git.
|
|
|
|
*-o*, *--only-if-changed*::
|
|
|
|
Only run the playbook if the repository has been updated.
|
|
|
|
*--purge*::
|
|
|
|
Purge the checkout after the playbook is run.
|
|
|
|
*-s* 'SLEEP', *--sleep=*'SLEEP'::
|
|
|
|
Sleep for random interval (between 0 and SLEEP number of seconds) before starting. This is a useful way ot disperse git requests.
|
|
|
|
*--ssh-extra-args=*''-o ProxyCommand="ssh -W %h:%p ..." ...''::
|
|
|
|
Add the specified arguments to any ssh command-line. Useful to set a
|
|
ProxyCommand to use a jump host, but any arguments may be specified.
|
|
|
|
*-t* 'TAGS', *--tags=*'TAGS'::
|
|
|
|
Only run plays and tasks tagged with these values.
|
|
|
|
*-U* 'URL', *--url=*'URL'::
|
|
|
|
URL of the playbook repository to checkout.
|
|
|
|
*--vault-password-file=*'VAULT_PASSWORD_FILE'::
|
|
|
|
Vault password file.
|
|
|
|
*-v*, *--verbose*::
|
|
|
|
Pass -vvv to ansible-playbook.
|
|
|
|
|
|
AUTHOR
|
|
------
|
|
|
|
Ansible was originally written by Michael DeHaan. See the AUTHORS file
|
|
for a complete list of contributors.
|
|
|
|
|
|
COPYRIGHT
|
|
---------
|
|
|
|
Copyright © 2012, Michael DeHaan
|
|
|
|
Ansible is released under the terms of the GPLv3 License.
|
|
|
|
|
|
SEE ALSO
|
|
--------
|
|
|
|
*ansible*(1), *ansible-playbook*(1), *ansible-doc*(1)
|
|
|
|
Extensive documentation is available in the documentation site:
|
|
<http://docs.ansible.com>. IRC and mailing list info can be found
|
|
in file CONTRIBUTING.md, available in: <https://github.com/ansible/ansible>
|