| commit | author | age | ||
| 3371e8 | 1 | --- |
| GC | 2 | ########################################################################### |
| 3 | # CAUTION | |
| 4 | ########################################################################### | |
| 5 | # This file is used for several cloud provider. Keep in mind when you | |
| 6 | # update it and make sure it works for all of them using this common conf. | |
| 7 | ########################################################################### | |
| 8 | ||
| 9 | - name: SSH config setup | |
| 10 | hosts: localhost | |
| 11 | connection: local | |
| 12 | gather_facts: false | |
| 13 | become: false | |
| 14 | vars_files: | |
| 15 | - "{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/env_vars.yml" | |
| 16 | - "{{ ANSIBLE_REPO_PATH }}/configs/{{ env_type }}/env_secret_vars.yml" | |
| 17 | tags: | |
| 18 | - create_ssh_config | |
| 19 | tasks: | |
| 20 | - name: Store bastion hostname as a fact | |
| 21 | set_fact: | |
| 22 | bastion_hostname: "{{groups['bastions'].0 }}" | |
| 23 | # This is where the ssh_config file will be created, this file is used to | |
| 24 | # define the communication method to all the hosts in the deployment | |
| 25 | ansible_ssh_config: "{{ ANSIBLE_REPO_PATH }}/workdir/{{ env_type }}_{{ guid }}_ssh_conf" | |
| 26 | ansible_known_host: "{{ ANSIBLE_REPO_PATH }}/workdir/{{ env_type }}_{{ guid }}_ssh_known_hosts" | |
| 27 | ||
| 28 | - name: Delete dedicated known_host if it exists (new deployment) | |
| 29 | file: | |
| 30 | dest: "{{ansible_known_host}}" | |
| 31 | state: absent | |
| 32 | ||
| 33 | - name: delete local ssh config, start fresh | |
| 34 | file: | |
| 35 | dest: "{{ ansible_ssh_config }}" | |
| 36 | state: absent | |
| 37 | ||
| 38 | - name: Create empty local ssh config | |
| 39 | file: | |
| 40 | dest: "{{ ansible_ssh_config }}" | |
| 41 | state: touch | |
| 42 | ||
| 43 | - name: Add bastion proxy config to workdir ssh config file | |
| 44 | blockinfile: | |
| 45 | dest: "{{ ansible_ssh_config }}" | |
| 46 | marker: "##### {mark} ADDED BASTION PROXY HOST {{ env_type }}-{{ guid }} ######" | |
| 47 | content: | | |
| 3cc138 | 48 | Host {{ bastion_hostname }} {{ hostvars[bastion_hostname].shortname |d('')}} |
| 3371e8 | 49 | Hostname {{ hostvars[bastion_hostname].public_dns_name }} |
| GC | 50 | IdentityFile {{ ssh_key }} |
| 51 | IdentitiesOnly yes | |
| 52 | User {{ remote_user }} | |
| 53 | ControlMaster auto | |
| 54 | ControlPath /tmp/{{ guid }}-%r-%h-%p | |
| 55 | ControlPersist 5m | |
| 56 | StrictHostKeyChecking no | |
| 11af75 | 57 | ConnectTimeout 60 |
| GC | 58 | ConnectionAttempts 10 |
| 3371e8 | 59 | UserKnownHostsFile {{ansible_known_host}} |
| GC | 60 | tags: |
| 61 | - bastion_proxy_config_main | |
| 62 | ||
| 63 | - name: Add all hosts to workdir ssh config file | |
| 64 | blockinfile: | |
| 65 | dest: "{{ ansible_ssh_config }}" | |
| 66 | marker: "##### {mark} ADDED Node Proxy Config {{ item }} {{ env_type }}-{{ guid }} ######" | |
| 67 | block: | | |
| 3cc138 | 68 | Host {{ item }} {{ hostvars[item].public_ip_address | default('') }} {{ hostvars[item].shortname |d('')}} |
| 3371e8 | 69 | Hostname {{ hostvars[item].private_ip_address }} |
| GC | 70 | User {{ remote_user }} |
| 71 | IdentityFile {{ ssh_key }} | |
| 72 | ProxyCommand ssh -F {{ ansible_ssh_config }} {{ bastion_hostname }} -W %h:%p | |
| 73 | StrictHostKeyChecking no | |
| 74 | UserKnownHostsFile {{ansible_known_host}} | |
| 1bc784 | 75 | when: item not in [bastion_hostname, 'localhost', '127.0.0.1'] |
| 3371e8 | 76 | with_items: "{{ groups['all'] }}" |
| GC | 77 | tags: |
| 78 | - bastion_proxy_config_hosts | |
| 79 | ||
| 80 | - name: Set ssh extra args for all hosts, use ssh_config just created | |
| 81 | hosts: all | |
| 82 | gather_facts: false | |
| 83 | any_errors_fatal: true | |
| 84 | ignore_errors: false | |
| 85 | tags: | |
| 86 | - step001 | |
| 87 | - ssh_args | |
| 88 | tasks: | |
| 89 | - name: add -F option ansible_ssh_extra_args | |
| 90 | set_fact: | |
| 91 | ansible_ssh_extra_args: "{{ ansible_ssh_extra_args|d() }} -F {{ hostvars['localhost'].ansible_ssh_config }}" | |
