Ansible is connecting to the wrong hosts when using jump host

1
votes

I am managing hosts in two different data centers. I get to the managed hosts via a jump host. There is a dedicated jump host for each data center. My inventory files look something like:

$ cat inventory-dc1
[all:vars]
ansible_ssh_common_args='-o ProxyCommand="ssh -W %h:%p -q [email protected]"'

[docker]
docker-1 ansible_host=192.168.1.1
docker-2 ansible_host=192.168.1.2

$ cat inventory-dc2
[all:vars]
ansible_ssh_common_args='-o ProxyCommand="ssh -W %h:%p -q [email protected]"'

[docker]
docker-1 ansible_host=192.168.1.1
docker-2 ansible_host=192.168.1.2

When I run a playbook with inventory-dc1 everything works as expected.

The problem manifests when I subsequently run a playbook with inventory-dc2. Ansible connects to the hosts from inventory-dc1 instead of inventory-dc2. I know that the managed hosts have the same IP addesses but they are accessed via different jump hosts.

2
ansible

2 Answers

1
votes

Make unique control path for each inventory:

[all:vars]
ansible_ssh_common_args='-o ProxyCommand="ssh -W %h:%p -q [email protected]" -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=~/.ansible/cp/dc1-ssh-%C'

Note dc1 prefix for path. Specify dc2 for the second inventory.

0
votes

The problem is that Ansible automatically enables SSH multiplexing. It means the ssh connections made by Ansible look something like this:

CP=~/.ansible/cp/ansible-ssh-%h-%p-%r
ssh -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=$CP \
[email protected] /bin/true

This will create a socket like ~/.ansible/cp/ansible-ssh-192.168.1.1-22-ubuntu and keep it open for 60 seconds. If you run another ssh connection with the same IP address, port and username within 60 seconds you will get connected to the same host.

The solution that worked for me was to disable SSH multiplexing for Ansible:

$ cat ansible.cfg
[ssh_connection]
ssh_args = -o ControlMaster=no

It's not an optimal solution because it slows down Ansible.

Another (suboptimal :-) solution is to manually remove the socket(s):

rm ~/.ansible/cp/ansible-ssh-192.168.1.1-22-ubuntu