Gitlab CI with Ansible

Question

I am creating a pipeline which is automatically triggered when I push my code on gitlab.com. The project is about the provisioning of a machine.

Here my .gitlab-ci.yml file

ansible_build:
image: debian:10
script:
  - apt-get update -q -y
  - apt-get install -y ansible git openssh-server keychain
  - service ssh stop
  - service ssh start
  - cp files/<ad-hoc-created-key> key.pem && chmod 600 key.pem
  - eval `keychain --eval` > /dev/null 2>&1
  - ssh-add key.pem
  - ansible-galaxy install -r requirements.yml
  - ansible-playbook provision.yml --inventory hosts --limit local

When I push my code, the gitlab environment starts running all commands, but then it exits with the following error

$ ansible-playbook provision.yml --inventory hosts --limit local
 PLAY [Provision step] **********************************************************
 TASK [Gathering Facts] *********************************************************
 fatal: [127.0.0.1]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: Host key verification failed.", "unreachable": true}
 NO MORE HOSTS LEFT *************************************************************
    to retry, use: --limit @/builds/team/ansible/provision.retry
 PLAY RECAP *********************************************************************
 127.0.0.1                  : ok=0    changed=0    unreachable=1    failed=0

In my local PC, I solved it using the ssh-copy-id <path-to-the-key> <localhost> command, but I don't know how to solve it for gitlab-ci, given that it's not an environment which I can control.

I tried also to replace the 127.0.0.1 IP address with localhost.

ansible-playbook provision.yml --inventory hosts --limit localhost

Then it fails:

ansible-playbook provision.yml --inventory hosts --limit localhost
  [WARNING] Ansible is being run in a world writable directory (/builds/teamiguana/minerva-ansible), ignoring it as an ansible.cfg source. For more information see https://docs.ansible.com/ansible/devel/reference_appendices/config.html#cfg-in-world-writable-dir
  [WARNING]: Found both group and host with same name: localhost
 PLAY [Provision step] **********************************************************
 TASK [Gathering Facts] *********************************************************
 fatal: [localhost]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.\r\nroot@localhost: Permission denied (publickey,password).", "unreachable": true}
 NO MORE HOSTS LEFT *************************************************************
    to retry, use: --limit @/builds/teamiguana/minerva-ansible/provision.retry
 PLAY RECAP *********************************************************************
 localhost                  : ok=0    changed=0    unreachable=1    failed=0

Can you do a bind volume mount into the executing container? — Matt Schuchard
Use localhost instead of 127.0.0.1. This will use the implicit localhost definition, configured by default with the local connection plugin, bypassing ssh so you don't have to bother with the keys to play actions on the controller. It will use the current logued in user as well. Moreover, if using a docker runner for your CI, sshd might not be installed at all. — Zeitounator
It doesn't work neither replacing localhost instead of 127.0.0.1. I edited the question. — caleale90

n7s n7s · Accepted Answer · 2020-03-03T16:16:59

I don't have experience setting up similar - but my first thought would be to check

What system user is Gitlab trying to SSH as?
What system user has the corresponding public keys on the remote hosts?

You can override which user Ansible connects with either in the playbooks, or via --user <user> command-line flag, see https://docs.ansible.com/ansible/latest/cli/ansible-playbook.html#cmdoption-ansible-playbook-u.

Though maybe I'm misunderstanding, because I just noticed that you've set --limit local in your command?

Gitlab CI with Ansible

1 Answers