Ansible Inventory Security (all)

Archives Ansible Project
1

Hi there! Is there any way to overwrite the ‘all/*’ keyword in Ansible inventory? How can we prevent someone to run something nasty (intentionally or by mistake) over all our inventory?

We did a couple of tests using a dynamic inventory, but no luck. As a workaround, we are thinking to force all the playbooks to have a line similar to this one:

  • hosts: “{{ target_hosts | regex_replace(‘(all|\*)’, ‘invalid_target_host’) }}”

… but this doesn’t sound like the best option, any ideas?

Thanks!

2

Hello,

What we’re doing here is assigning a variable to “hosts”.

Something like:
hosts: {{ variable }}

So, our playbooks have always to be called as "ansible-playbooks -e “variable=|” otherwise they will fail.

Alex