通过kubespray设置本地主机名如何通过身份验证?

Question

嗨，当我通过kubespray使用ansible时，我一直得到这个错误，我想知道如何克服它

TASK [bootstrap-os : Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux)] ********************************************************************************************************************************************************************************************************
task path: /home/dc/xcp-projects/kubespray/roles/bootstrap-os/tasks/main.yml:50
<192.168.10.55> (1, b'x1b[1;31m==== AUTHENTICATING FOR org.freedesktop.hostname1.set-hostname ===rnx1b[0mAuthentication is required to set the local host name.rnMultiple identities can be used for authentication:rn 1.  testrn 2.  provisionrn 3.  dcrnChoose identity to authenticate as (1-3): rn{"msg": "Command failed rc=1, out=, err=\u001b[0;1;31mCould not set property: Connection timed out\u001b[0m\n", "failed": true, "invocation": {"module_args": {"name": "node3", "use": null}}}rn', b'Shared connection to 192.168.10.55 closed.rn')
<192.168.10.55> Failed to connect to the host via ssh: Shared connection to 192.168.10.55 closed.
<192.168.10.55> ESTABLISH SSH CONNECTION FOR USER: provision
<192.168.10.55> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o 'IdentityFile="/home/dc/.ssh/xcp_server_k8s_nodes/xcp-k8s-provision-key"' -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="provision"' -o ConnectTimeout=10 -oStrictHostKeyChecking=no -o ControlPath=/home/dc/.ansible/cp/c6d70a0b7d 192.168.10.55 '/bin/sh -c '"'"'rm -f -r /home/provision/.ansible/tmp/ansible-tmp-1614373378.5434802-17760837116436/ > /dev/null 2>&1 && sleep 0'"'"''
<192.168.10.56> (0, b'', b'')
fatal: [node2]: FAILED! => {
"changed": false,
"invocation": {
"module_args": {
"name": "node2",
"use": null
}
},
"msg": "Command failed rc=1, out=, err=u001b[0;1;31mCould not set property: Method call timed outu001b[0mn"
}

我的库存文件如下

all:
hosts:
node1:
ansible_host: 192.168.10.54
ip: 192.168.10.54
access_ip: 192.168.10.54
node2:
ansible_host: 192.168.10.56
ip: 192.168.10.56
access_ip: 192.168.10.56
node3:
ansible_host: 192.168.10.55
ip: 192.168.10.55
access_ip: 192.168.10.55
children:
kube-master:
hosts:
node1:
node2:
kube-node:
hosts:
node1:
node2:
node3:
etcd:
hosts:
node1:
node2:
node3:
k8s-cluster:
children:
kube-master:
kube-node:
calico-rr:
hosts: {}

我还有一个文件，它以以下方式为用户提供

- name: Add a new user named provision
user:
name: provision
create_home: true
shell: /bin/bash
password: "{{ provision_password }}"
groups: sudo
append: yes
- name: Add a new user named dc
user:
name: dc
create_home: true
shell: /bin/bash
password: "{{ provision_password }}"
groups: sudo
append: yes
- name: Add provision user to the sudoers
copy:
dest: "/etc/sudoers.d/provision"
content: "provision  ALL=(ALL)  NOPASSWD: ALL"
- name: Add provision user to the sudoers
copy:
dest: "/etc/sudoers.d/dc"
content: "dc  ALL=(ALL)  NOPASSWD: ALL"

- name: Disable Root Login
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^PermitRootLogin'
line: "PermitRootLogin no"
state: present
backup: yes
notify:
- Restart ssh

我以如下方式运行了ansible命令

ansible-playbook -i kubespray/inventory/mycluster/hosts.yaml --user="provision"  --ssh-extra-args="-oStrictHostKeyChecking=no" --key-file "/home/dc/.ssh/xcp_server_k8s_nodes/xcp-k8s-provision-key" kubespray/cluster.yml -vvv

和

ansible-playbook -i kubespray/inventory/mycluster/hosts.yaml --user="provision"  --ssh-extra-args="-oStrictHostKeyChecking=no" --key-file "/home/dc/.ssh/xcp_server_k8s_nodes/xcp-k8s-provision-key" --become-user="provision" kubespray/cluster.yml -vv

都产生相同的错误，有趣的是，在前面的点上升级似乎成功了

看完这篇文章https://askubuntu.com/questions/542397/change-default-user-for-authentication我已经决定将用户添加到sudo组，但错误仍然存在

查看main。Yaml文件位置提示的错误似乎是这段代码可能导致的问题?

# Workaround for https://github.com/ansible/ansible/issues/42726
# (1/3)
- name: Gather host facts to get ansible_os_family
setup:
gather_subset: '!all'
filter: ansible_*
- name: Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux)
hostname:
name: "{{ inventory_hostname }}"
when:
- override_system_hostname
- ansible_os_family not in ['Suse', 'Flatcar Container Linux by Kinvolk', 'ClearLinux'] and not is_fedora_coreos

主机的操作系统为ubuntu 20.04.02 server我还能做些什么吗?

Answer 1

来自Kubespray文档:

# Deploy Kubespray with Ansible Playbook - run the playbook as root
# The option `--become` is required, as for example writing SSL keys in /etc/,
# installing packages and interacting with various systemd daemons.
# Without --become the playbook will fail to run!
ansible-playbook -i inventory/mycluster/hosts.yaml  --become --become-user=root cluster.yml

如前所述，--become是强制性的，它允许对Kubespray执行的大多数系统修改(如设置主机名)进行特权升级。

对于--user=provision，您只是设置SSH用户，但无论如何它都需要特权升级。对于--become-user=provision，您只是说特权升级将升级到"配置"用户(但是您需要--become来执行特权升级)。在这两种情况下，除非'provision'用户具有root权限(不确定将其放在root组中是否足够)，否则它将不够。

要使用户'provision'足够，您需要确保它可以执行hostnamectl <some-new-host>而不被要求进行身份验证。