Mixing Ansible static and dynamic groups in inventory

1
votes

I'm trying to combine static & dynamic (EC2) inventory. have two ec2 instances:

  • ansible control machine
  • ami based host

Trying to ping 'ami' host from control machine. Here's my host file:

[local] 
localhost ansible_connection=local

[tag_Name_ami]

[tag_Name_redhat]

[amazon:children] 
tag_Name_ami 
tag_Name_redhat

To successfully ping 'ami' host, I need to use two specific variables:

  • ansible_ssh_user: ec2-user (my control machine is ubuntu)
  • ansible_ssh_private_key_file: /home/ubuntu/.ssh/klucze.pem

Trying to achieve it by creating files in group_vars directory:

.
├── demo_setup.yml
├── ec2.ini
├── ec2.py
├── group_vars
│   ├── amazon.yml
│   ├── aws-redhats
│   ├── tag_Name_ami.yml
│   └── tag_Name_redhat.yml
├── hosts
├── hosts.bckp
└── host_vars

$ cat group_vars/tag_Name_ami.yml 
ansible_ssh_user: ec2-user
$ cat group_vars/amazon.yml 
ansible_ssh_private_key_file: /home/ubuntu/.ssh/klucze.pem

Problem is that ansible seems to "see" only tag_Name_ami.yml with ansible_ssh_user, ignoring my amazon.yml with ansible_ssh_private_key_file value. Some output below:

$ ansible tag_Name_ami -i ec2.py -m ping -vvv
<52.59.246.244> ESTABLISH CONNECTION FOR USER: ec2-user
<52.59.246.244> REMOTE_MODULE ping
<52.59.246.244> EXEC ssh -C -tt -v -o ControlMaster=auto -o ControlPersist=60s -o ControlPath="/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r" -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 52.59.246.244 /bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1452256637.43-34398544897068 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1452256637.43-34398544897068 && echo $HOME/.ansible/tmp/ansible-tmp-1452256637.43-34398544897068'
52.59.246.244 | FAILED => SSH Error: Permission denied (publickey).
    while connecting to 52.59.246.244:22
It is sometimes useful to re-run the command using -vvvv, which prints SSH debug output to help diagnose the issue.

$ ansible amazon -i ec2.py -m ping
No hosts matched
$

When I add ansible_ssh_private_key_file to my tag_Name_ami, the ping is Successfull:

$ ansible tag_Name_ami -i ec2.py -m ping -vvv
<52.59.246.244> ESTABLISH CONNECTION FOR USER: ec2-user
<52.59.246.244> REMOTE_MODULE ping
<52.59.246.244> EXEC ssh -C -tt -v -o ControlMaster=auto -o ControlPersist=60s -o ControlPath="/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r" -o IdentityFile="/home/ubuntu/.ssh/klucze.pem" -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 52.59.246.244 /bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1452256765.34-42269843852436 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1452256765.34-42269843852436 && echo $HOME/.ansible/tmp/ansible-tmp-1452256765.34-42269843852436'
<52.59.246.244> PUT /tmp/tmpbFP5sH TO /home/ec2-user/.ansible/tmp/ansible-tmp-1452256765.34-42269843852436/ping
<52.59.246.244> EXEC ssh -C -tt -v -o ControlMaster=auto -o ControlPersist=60s -o ControlPath="/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r" -o IdentityFile="/home/ubuntu/.ssh/klucze.pem" -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 52.59.246.244 /bin/sh -c 'LANG=en_US.UTF-8 LC_CTYPE=en_US.UTF-8 /usr/bin/python /home/ec2-user/.ansible/tmp/ansible-tmp-1452256765.34-42269843852436/ping; rm -rf /home/ec2-user/.ansible/tmp/ansible-tmp-1452256765.34-42269843852436/ >/dev/null 2>&1'
52.59.246.244 | success >> {
    "changed": false, 
    "ping": "pong"
}

$
ubuntu@ip-172-31-20-41:/etc/ansible$ cat group_vars/tag_Name_ami.yml 
ansible_ssh_user: ec2-user
ansible_ssh_private_key_file: /home/ubuntu/.ssh/klucze.pem

But it's not what I want, I want every new EC2 instance have this ansible_ssh_private_key_file variable defined (it'll be part of 'amazon' static group), and ami/redhat instances additionally have ansible_ssh_user defined.

Thanks in advance for any help provided!

*********** UPDATE ****************

All I've been able to achive is doing it this way:

$ ansible-playbook demo_ping.yml --private-key=/home/ubuntu/.ssh/klucze.pem -u ec2-user

PLAY [webserver] ************************************************************** 

GATHERING FACTS *************************************************************** 
ok: [ec2-54-93-114-191.eu-central-1.compute.amazonaws.com]

TASK: [Execute ping] ********************************************************** 
ok: [ec2-54-93-114-191.eu-central-1.compute.amazonaws.com]

PLAY RECAP ******************************************************************** 
ec2-54-93-114-191.eu-central-1.compute.amazonaws.com : ok=2    changed=0    unreachable=0    failed=0

Using my static hosts file with webserver group. The playbook looks like:

---
- hosts: amazon 
  remote_user: ec2-user
  tasks:
  - name: Execute ping
    ping:
...

Putting 'amazon' as hosts value in playbook returns error:

PLAY [amazon] ***************************************************************** 
skipping: no hosts matched

Also tried executing playbook with '-i ec2.py', same error

1
amazon-ec2ansibleansible-inventory

1 Answers

1
votes

You could loop over the ec2 hosts and set the variable ansible_ssh_private_key_file in the playbook.

- hosts: amazon
  gather_facts: false
  tasks:
    - set_fact:
        ansible_ssh_private_key_file: '/home/ubuntu/.ssh/klucze.pem'
...