# Any way to re-read ssh\_config on-the-fly from Ansible playbook? **URL:** \ **Category:** Ansible Project\ **Tags:** ubuntu\ **Created:** [January 23, 2015, 9:10am UTC](https://forum.ansible.com/t/any-way-to-re-read-ssh-config-on-the-fly-from-ansible-playbook/17360 "2015-01-23T09:10:32Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![user32](https://avatars.discourse-cdn.com/v4/letter/u/43a26b/32.png) [@user32](https://forum.ansible.com/u/user32)\ **Post date:** [January 23, 2015, 9:10am UTC](https://forum.ansible.com/t/any-way-to-re-read-ssh-config-on-the-fly-from-ansible-playbook/17360/1 "2015-01-23T09:10:32Z")
Hello, Ansible admins and users! I am using Ansible with Amazon EC2. I’ve configured provisioning of EC2 private hosts over public SSH bastions (exactly as specified here: [http://alexbilbie.com/2014/07/using-ansible-with-a-bastion-host](http://alexbilbie.com/2014/07/using-ansible-with-a-bastion-host)). So I have an ssh\_config like below containing settings for forwarding an SSH requests to private hosts over public ones: # DEV bastion Host ###.###.###.### User ubuntu HostName ###.###.###.### ProxyCommand none BatchMode yes PasswordAuthentication no ForwardAgent yes Host \* User ubuntu ServerAliveInterval 60 TCPKeepAlive yes ProxyCommand ssh -q -A [ubuntu@bastion.dev.xxx.com](mailto:ubuntu@bastion.dev.xxx.com) nc %h %p ControlMaster auto ControlPath ~/.ssh/mux-%r@%h:%p ControlPersist 8h But now I want to make generate this ssh\_config on-the-fly from the playbook. I.e what do I need to implement: 1. Single playbook spins up public and private EC2 hosts, attaches EIPs to public host (SSH bastions, etc.) and adds them to public hosted zones so SSH bastions will have public DNS names 2. Using info about created topology, playbook generates new ssh\_config file and starts using it instead of default one (without relaunch or retries) 3. Playbook continues nodes provisioning, but now private EC2 hosts are provisioned over public SSH bastions as configured in generated ssh\_config specified I am done with p.1, but now there is the problem - there is no way to tell Ansible to reload SSH config on-the-fly (without restarting playbook). So no way to continue provisioning private hosts over public ones at the same playbook. Could you, please suggest me an option to overcome this? Or, maybe, point me to the code I need to modify in Ansible to make this possible - any help will be very appreciated 😉 ---
**Author:** ![Trevor\_Baker](https://avatars.discourse-cdn.com/v4/letter/t/cab0a1/32.png) [@Trevor\_Baker](https://forum.ansible.com/u/Trevor_Baker)\ **Post date:** [May 6, 2015, 2:04pm UTC](https://forum.ansible.com/t/any-way-to-re-read-ssh-config-on-the-fly-from-ansible-playbook/17360/2 "2015-05-06T14:04:46Z")
If you already have a bastion host, security groups, and the proxy command configured you can do the following for new private subnet instances: - name: Launch new instance hosts: localhost gather\_facts: true vars: some vars: … tasks: - name: Launch instance ec2: key\_name: “{{ key\_name }}” group\_id: “{{ security\_group }}” instance\_type: “{{ instance\_type }}” image: “{{ image }}” wait: true region: “{{ region }}” etc… register: ec2 - name: Add new instance to host group add\_host: hostname=“{{ item.private\_ip }}” groupname=launched with\_items: ec2.instances # note, this only works if you’ve launched a single instance! # see [add\_host module called second time with second host should modify the host · Issue #3848 · ansible/ansible · GitHub](https://github.com/ansible/ansible/issues/3848) - name: Pause for EC2 instance to start SSH pause: prompt: “Pausing to allow new instance to start accepting ssh connections” minutes: 2 - name: Provision Jenkins in EC2 hosts: launched gather\_facts: True tasks: whatever… The issue you’re encountering is vexing me too. Problem summary: can’t use dynamic inventories with dynamic proxycommand You can’t add multiple machines via add\_host ([add\_host module called second time with second host should modify the host · Issue #3848 · ansible/ansible · GitHub](https://github.com/ansible/ansible/issues/3848)) and you can’t patch ssh’s config at runtime. I have multiple vpcs and multiple bastions. I am using cut in the proxy command per the following: [http://copperlight.github.io/ansible/2014/06/30/ansible-vault-and-ssh-key-distribution/](http://copperlight.github.io/ansible/2014/06/30/ansible-vault-and-ssh-key-distribution/) Using a dynamic proxy command with a separator per the above link only works in my example code above when there is a single ec2 host passed to add\_host. I am stuck wanting to use a tag\_some\_tag list with multiple hosts returned from the ec2 inventory plugin with this workflow. Any help is appreciated! ---
**Author:** ![Trevor\_Baker](https://avatars.discourse-cdn.com/v4/letter/t/cab0a1/32.png) [@Trevor\_Baker](https://forum.ansible.com/u/Trevor_Baker)\ **Post date:** [May 6, 2015, 3:00pm UTC](https://forum.ansible.com/t/any-way-to-re-read-ssh-config-on-the-fly-from-ansible-playbook/17360/3 "2015-05-06T15:00:31Z")
Another hack would be to have a ssh config and ansible config per vpc. The ansible config points to the appropriate ssh config for the vpc, which contains the correct bastion ip for said vpc, otherwise the files are the same. ie. ansible-vpc1.cfg / ssh-vpc1.cfg ansible-vpc2.cfg / ssh-vpc2.cfg Then start the playbook as: $ export ANSIBLE\_CONFIG=$(pwd)/ansible-vpc1.cfg && ansible-playbook playbook.yml