-
我可以完全访问ServerA(单服务器([IP:142.5.55]，在那里我有我的公钥
/app/serverA/mw.pub。这个服务器可以从我运行自动化的地方进行解析。 -
我有从ansible ServerA到3台服务器[IP:111.1.1.220、11.1.1.221、11.1.1.222]的ssh无密码连接，我们将这3台服务器称为jump_nodes
-
最后，我有一个称为目标主机[IP:192.0.0.020192.0.012012]的东西，我们将其命名为dest_nodes，希望在其中注入公钥
mw.pub。只有jump_node可以连接到dest_node。
因此：
ServerA(ansible) ---------------------> jump_nodes --------------------> dest_nodes
copy to ~/mw.pub inject ~/mw.pub
我可以使用下面的剧本将我的公钥mw.pub复制到~/mw.pub下的所有jump_node。
一切都很好，但下面是失败的地方：
我现在希望将~/mw.pub从跳转服务器注入到目标主机，即曾经具有连接的dest_node。
我的战术手册：
---
- name: "Play 1"
hosts: localhost
gather_facts: false
tags: always
tasks:
- name: Add host
debug:
msg: " hello "
- set_fact:
jump_server_list: "{{ JUMP_SERVER | trim }}"
- set_fact:
target_server_list: "{{ TARGET_SERVER | trim }}"
- add_host:
hostname: "{{ item }}"
groups: jump_nodes
with_items: "{{ jump_server_list.split('n') }}"
- add_host:
hostname: "{{ item }}"
groups: dest_nodes
with_items: "{{ target_server_list.split('n') }}"
- name: "Play 2"
hosts: dest_nodes
user: root
ignore_unreachable: yes
vars:
ansible_ssh_extra_args: -o StrictHostKeyChecking=no
ansible_ssh_private_key_file: /app/id_rsa
gather_facts: true
tasks:
- name: Copy ssh public key to a file on jump servers
raw: "echo {{ TARGET_KEY }}>~/mw.pub"
run_once: True
delegate_to: "{{ item }}"
with_items: "{{ groups['jump_nodes'] }}"
- name: Set authorized key taken from file
ignore_errors: yes
authorized_key:
user: "{{ TARGET_USER }}"
state: present
key: "{{ lookup('file', '~/mw.pub') }}"
register: keystatus
delegate_to: "{{ item }}"
with_items: "{{ groups['jump_nodes'] }}"
- debug:
msg: "CHECK STATUS {{ keystatus }}"
ignore_errors: yes
输出：
TASK [Copy ssh public key to a file on jump servers] *******************************************************************************************************************
task path: /app/injectkeys/injectsshkeys.yml:40
<11.1.1.220> ESTABLISH SSH CONNECTION FOR USER: root
<11.1.1.220> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o 'IdentityFile="/app/id_rsa"' -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="root"' -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o ControlPath=/home/axmwapp/.ansible/cp/42c5d2e05f -tt 11.1.1.220 'echo ssh-rsa PPPPB3NzaC1yc2EPPPPDAQABAAABAQDQGeUOA0vJK1AXSp3UKK1KF4VnFzmcrCoM4Ha7jx49DGPkGuNgS4ZKYYGiAl7FDhwtysvUF6JSl1l3Gxrki3nLDmGYUHbzNCU0qghOw85gbr++W+b+VfEZEnzTE8VPjAgR/JvQItLd2F8PGGlZBwDUXOIvuw8Acqft0nErDkPkKApJcn302qHtOc9R1mFff/GuD6WL6gjPF0gZsEkxHq+FObdsuUzndon0SR3SPeoF/oKA2CVy15+ea6wZnAYqCCppbdgZYR9uSZlMnvwMGT2g3Au+kL2dls3aRYQm6ZH0IrOpfn8M+BaPCcpWppE64XSPZlkU+3mIe2riG4IyIE75 it@shop.com>~/mw.pub'
<11.1.1.220> (0, '', 'Shared connection to 11.1.1.220 closed.rn')
changed: [192.0.0.200 -> 11.1.1.220] => (item=11.1.1.220) => {
"ansible_loop_var": "item",
"changed": true,
"item": "11.1.1.220",
"rc": 0,
"stderr": "Shared connection to 11.1.1.220 closed.rn",
"stderr_lines": [
"Shared connection to 11.1.1.220 closed."
],
"stdout": "",
"stdout_lines": []
}
TASK [Set authorized key taken from file] ******************************************************************************************************************************
task path: /app/injectkeys/injectsshkeys.yml:46
[WARNING]: Unable to find '~/mw.pub' in expected paths (use -vvvvv to see paths)
fatal: [192.0.0.200]: FAILED! => {
"msg": "An unhandled exception occurred while running the lookup plugin 'file'. Error was a <class 'ansible.errors.AnsibleError'>, original message: could not locate file in lookup: ~/mw.pub"
}
...ignoring
TASK [debug] ***********************************************************************************************************************************************************
task path: /app/injectkeys/injectsshkeys.yml:57
ok: [192.0.0.200] => {
"msg": "CHECK STATUS {'msg': u"An unhandled exception occurred while running the lookup plugin 'file'. Error was a <class 'ansible.errors.AnsibleError'>, original message: could not locate file in lookup: ~/mw.pub", 'failed': True}"
}
META: ran handlers
META: ran handlers
以下是我如何运行
ansible-playbook /app/injectkeys/injectsshkeys.yml -f 5 -e JUMP_SERVER='11.1.1.220' -e TARGET_SERVER='192.0.0.200' -e TARGET_USER='root' -e TARGET_KEY="'ssh-rsa PPPPB3NzaC1yc2EPPPPDAQABAAABAQDQGeUOA0vJK1AXSp3UKK1KF4VnFzmcrCoM4Ha7jx49DGPkGuNgS4ZKYYGiAl7FDhwtysvUF6JSl1l3Gxrki3nLDmGYUHbzNCU0qghOw85gbr++W+b+VfEZEnzTE8VPjAgR/JvQItLd2F8PGGlZBwDUXOIvuw8Acqft0nErDkPkKApJcn302qHtOc9R1mFff/GuD6WL6gjPF0gZsEkxHq+FObdsuUzndon0SR3SPeoF/oKA2CVy15+ea6wZnAYqCCppbdgZYR9uSZlMnvwMGT2g3Au+kL2dls3aRYQm6ZH0IrOpfn8M+BaPCcpWppE64XSPZlkU+3mIe2riG4IyIE75 it@shop.com'" -vvv
正如您从输出中看到的，它在dest_nodes上查找~/mw.pub，而不是delegate_to: jump_nodes，即它在dest_nodes 192.0..200上查找~/mw.pub，而它本应在11.1.1.220上查找它所在的位置，然后在192.0.0-200注入它。
你能建议我怎么修吗？
来自查找插件的文档
与所有模板一样，这些插件是在Ansible控制机上评估的，而不是在目标/远程上。
所以它实际上不在目标主机上，而是在控制器上。
如果需要从目标获取文件，则必须在lookup本地副本之前使用fetch，或者在slurp变量中使用内容。