I want to be a ...

I want to be a ...

I'm working on the small project which touches multiple cloud-based hosts across multiple providers. And this is a good chance to refresh your knowledge on how to handle various connections with Red Hat Ansible.

Let's see how you control the connection. There are a few ways:

  • By default, Ansible would use your current user id and public RSA key to establish a connection with the remote target. You can spend some time an create new accounts for all your providers, or you can go with the next option
  • User remote_user for plays or --user parameter for ad-hock commands. Ansible would try to connect with the provided user name. It's quite similar to the command ssh username@host.name.com
  • If you have all different SSH users for your hosts (as in my case), you can modify your inventory and add variable ansible_ssh_user. The example below shows you how to use it.
  • Ansible allows you to run a play or single task with an escalated privilege. Just add become ¬†clause or --become for ad-hoc command
  • If you need to execute a command as a non-root user, pair become with the become_user ( --become-user for ad-hoc) to specify desired user name

Let's take a look at my inventory excerpt to illustrate my topics:

---
all:
 vars:
   ansible_ssh_user: opc
 children:
   test-ready:
     hosts:
       host1.cloud.prj:
        ansible_ssh_user: ec2-user
       host2.cloud.prj:
       host4.cloud.prj:
       host5.cloud.prj:
        ansible_ssh_user: oracle
   not-ready:
     hosts:
       host3.cloud.prj:
        ansible_ssh_user: root
...
Ansible inventory with SSH users

The first ansible_ssh_user says that opc is a remote user for all the hosts. Few lines down, you may see that host1 overrides global value with ec2-user. The same declaration happens for a few other hosts.

As usual, everything comes with a price. User id from inventory overpowers remote_user or ad-hoc keys, and you should use become_user instead. The output below illustrates the difference.

opc@control:~> ansible test-ready -u oracle -a id

host1.cloud.prj | CHANGED | rc=0 >> uid=1000(ec2-user) gid=1000(ec2-user) groups=1000(ec2-user),4(adm),10(wheel),190(systemd-journal) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
host5.cloud.prj | CHANGED | rc=0 >> uid=1000(oracle) gid=1100(oinstall) groups=1100(oinstall),1000(oracle) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
host4.cloud.prj | CHANGED | rc=0 >> uid=1001(opc) gid=1002(opc) groups=1002(opc),1000(google-sudoers) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
host2.cloud.prj | CHANGED | rc=0 >> uid=1000(opc) gid=1000(opc) groups=1000(opc),4(adm),10(wheel),190(systemd-journal) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

opc@control:~> ansible test-ready --become --become-user oracle -a id

host1.cloud.prj | CHANGED | rc=0 >> uid=1001(oracle) gid=1002(oinstall) groups=1002(oinstall),1001(oracle) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
host5.cloud.prj | CHANGED | rc=0 >> uid=1000(oracle) gid=1100(oinstall) groups=1100(oinstall),1000(oracle) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
host2.cloud.prj | CHANGED | rc=0 >> uid=1001(oracle) gid=1002(oinstall) groups=1002(oinstall),1001(oracle) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
host4.cloud.prj | CHANGED | rc=0 >> uid=1000(oracle) gid=1001(oracle) groups=1001(oracle),4(adm),39(video),1000(google-sudoers) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Title image depicts Theatrical masks of Tragedy and Comedy. Mosaic, Roman mosaic, 2nd century AD.