# Delegation issues **URL:** \ **Category:** Get Help\ **Tags:** awx, ee\ **Created:** [February 20, 2025, 5:43am UTC](https://forum.ansible.com/t/delegation-issues/40382 "2025-02-20T05:43:11Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![vibhor\_agarwalin](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@vibhor\_agarwalin](https://forum.ansible.com/u/vibhor_agarwalin)\ **Post date:** [February 20, 2025, 5:43am UTC](https://forum.ansible.com/t/delegation-issues/40382/1 "2025-02-20T05:43:11Z")
Hello Folks, We were using AWX 15.x for quite a time & used “delegate\_to: 127.0.0.1 or localhost” quite effectively to run tasks on controller node. Recently on upgrade to AWX 23.x, we found issues with delegation. delegate\_to: 127.0.0.1 Above is now running on the execution environment pod if i understand right. This fails as we have firewall policies tied to controller host & the pod cannot connect to other hosts. This delegation is needed for just a handful of steps & all others work good. Was able to get around by coding the name of AWX master but this doesn’t look flexible as playbooks are not tied to this instance & we loose portability. delegate\_to: “AWX master” Kindly share thoughts what’s the best strategy to delegate to AWX master. ---
**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\ **Post date:** [February 21, 2025, 3:01pm UTC](https://forum.ansible.com/t/delegation-issues/40382/2 "2025-02-21T15:01:26Z")
Hi, As you mentionned, i think the best is to have a firewall rule that allow traffic from pods subnet to the target subnet/hosts you need to work on. That’s how I manage it in my situation. ---
**Author:** ![vibhor\_agarwalin](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@vibhor\_agarwalin](https://forum.ansible.com/u/vibhor_agarwalin)\ **Post date:** [February 21, 2025, 3:36pm UTC](https://forum.ansible.com/t/delegation-issues/40382/3 "2025-02-21T15:36:04Z")
Ouch, we tried that approach for another use case but network team struck it down that source sub-nets won’t be allowed. It has to be precise ip. Just wondering, how do i figure out what subnet will AWX use to spawn pods? ---
**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\ **Post date:** [February 21, 2025, 8:33pm UTC](https://forum.ansible.com/t/delegation-issues/40382/4 "2025-02-21T20:33:00Z")
I’m not a Kubernetes expert at all but workers takes IP from DHCP. So except Ingress that is static, you can’t have a precise ip unfortunately. Moreover, everytime you launch a job it creates a temporary pod which takes IP from a DHCP subnet. Imho you have to specify a subnet to make it works. > **[Kubernetes Networking Explained - Guide for Beginners](https://spacelift.io/blog/kubernetes-networking)** > > Deep dive into Kubernetes networking. With this guide, you’ll learn what it is, the types of networking, and the architecture. Here’s an analogy but it’s like having a car, you have to press brake pedal to brake, but network team tell you to use something else cause they don’t know what braking is… ---
**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\ **Post date:** [February 21, 2025, 8:48pm UTC](https://forum.ansible.com/t/delegation-issues/40382/5 "2025-02-21T20:48:42Z")
Unless I’m misunderstanding something here, the pods inside a kubernetes cluster get launched with an internal IP from an internal IP CIDR yes (defaulting to the 172 subnet (certain distributions may vary, but you get the point)). However, when the pods go and reach for things outside of the kubernetes cluster, such as Ansible targets, the real network your Network guys probably care about will see traffic originating from the kubernetes host’s IP. Your network team needs to allow the kubernetes hosts’s IP addresses, not the kubernetes clusters’s internal cluster IP addresses for pods. I have no idea why your delegation to localhost would be failing, to the OP’s question. However, I can’t imagine your Network team would somehow be able to insert a firewall from inside the kubernetes cluster itself. I think it’d also need to block the pod from talking to itself, too. That’d be quite a feat. ---
**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\ **Post date:** [February 21, 2025, 8:55pm UTC](https://forum.ansible.com/t/delegation-issues/40382/6 "2025-02-21T20:55:14Z")
@mcen when you say “Your network team needs to allow the kubernetes hosts’s IP addresses, not the kubernetes clusters’s internal cluster IP addresses for pods.” Are we agree that hosts IP address are most of time delivered by DHCP ? (i mean every time we provide a k8s cluster we have to tell cidr subnet used for nodes) ---
**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\ **Post date:** [February 21, 2025, 8:56pm UTC](https://forum.ansible.com/t/delegation-issues/40382/7 "2025-02-21T20:56:15Z")
Ohhh, I see. The kubernetes hosts are getting DHCP assignments. That was the missing piece for me. My apologies. Though I dunno if the OP’s org is provisioned that way. If they are, seems odd for a Network team to permit DHCP assignments but then disallow CIDRs for rules, but Network people can be odd. ---
**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\ **Post date:** [February 21, 2025, 8:59pm UTC](https://forum.ansible.com/t/delegation-issues/40382/8 "2025-02-21T20:59:08Z")
That’s more or less what i said 3 comments earlier 😁 ---
**Author:** ![hugonz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/hugonz/32/503_2.png) [@hugonz](https://forum.ansible.com/u/hugonz)\ **Post date:** [February 22, 2025, 12:51am UTC](https://forum.ansible.com/t/delegation-issues/40382/9 "2025-02-22T00:51:48Z")
If you delegate to localhost literally, Ansible uses the local connection plugin defined by default for this host, no network connection of any kind. If you use localhost instead of 127… does it work? ---
**Author:** ![vibhor\_agarwalin](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@vibhor\_agarwalin](https://forum.ansible.com/u/vibhor_agarwalin)\ **Post date:** [February 24, 2025, 5:36am UTC](https://forum.ansible.com/t/delegation-issues/40382/10 "2025-02-24T05:36:45Z")
Thanks for the inputs folks. Few more clarification on environment. This is AWX 23.9.0 hosted on standalone cluster created via k3s. > However, when the pods go and reach for things outside of the kubernetes cluster, such as Ansible targets, the real network your Network guys probably care about will see traffic originating from the kubernetes host’s IP Doubt, apparently it’s taking pod’s IP. > Your network team needs to allow the kubernetes hosts’s IP addresses Kubernetes host’s IP is already allowed. That’s why when i delegate to AWX master server it passed but fails with localhost or 127.0.0.1 > If you use localhost instead of 127… does it work? Nope, both localhost & 127.0.0.1 are failing. Only coding AWX server is getting good results. ---
**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\ **Post date:** [February 24, 2025, 8:30am UTC](https://forum.ansible.com/t/delegation-issues/40382/11 "2025-02-24T08:30:01Z")
@vibhor_agarwalin so it means your network teams have allowed subnet configured in your pods, are we agree ? You can double check with : `kubectl get nodes -o wide` The internal IP column is the subnet you have to allow. Also, i’ve just had a look to some projects of mine that use localhost in a play part and it’s ok. ---
**Author:** ![vibhor\_agarwalin](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@vibhor\_agarwalin](https://forum.ansible.com/u/vibhor_agarwalin)\ **Post date:** [February 24, 2025, 9:00am UTC](https://forum.ansible.com/t/delegation-issues/40382/12 "2025-02-24T09:00:21Z")
No, subnet hasn’t been allowed. Only AWX master server is allowed. Our playbooks had localhost which wasn’t working, hence, had to code it to AWX server hostname to get it working. ---
**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\ **Post date:** [February 24, 2025, 2:13pm UTC](https://forum.ansible.com/t/delegation-issues/40382/13 "2025-02-24T14:13:01Z")
Ok but if your playbook use localhost and it isn’t working, i think there still a network issue due to your firewall. What do you mean by “had to code it to AWX server hostname” ? ---
**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\ **Post date:** [February 24, 2025, 2:35pm UTC](https://forum.ansible.com/t/delegation-issues/40382/14 "2025-02-24T14:35:12Z")
In my side, “localhost” can be used by any playbook on any projects. It doesn’t belong to any groups, doesn’t have any facts. The result is, it’s just a host like another one. When I use it, it means tasks are executed by the AWX pod itself and not pods that are created only during the time of execution. ---
**Author:** ![vibhor\_agarwalin](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@vibhor\_agarwalin](https://forum.ansible.com/u/vibhor_agarwalin)\ **Post date:** [February 25, 2025, 3:35am UTC](https://forum.ansible.com/t/delegation-issues/40382/15 "2025-02-25T03:35:38Z")
Let’s say AWX server is installed on host “Abc”. Playbooks with the following were failing: > delegate\_to: localhost > delegate\_to: 127.0.0.1 However, this is passing: > delegate\_to: Abc > When I use it, it means tasks are executed by the AWX pod itself and not pods that are created only during the time of execution. By AWX pod here do we mean the task or web pod? Either way it may be same as these will have different ip addresses than AWX server. ---
**Author:** ![hugonz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/hugonz/32/503_2.png) [@hugonz](https://forum.ansible.com/u/hugonz)\ **Post date:** [February 25, 2025, 7:03am UTC](https://forum.ansible.com/t/delegation-issues/40382/16 "2025-02-25T07:03:33Z")
I’m confused. What’s the output for the error in the playbook/template/task when it fails delegate\_to: localhost? I can’t imagine what the error is with the local connection plugin. Can you try to run it with maximum verbosity (3 - debug)? ---
**Author:** ![vibhor\_agarwalin](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@vibhor\_agarwalin](https://forum.ansible.com/u/vibhor_agarwalin)\ **Post date:** [February 25, 2025, 8:39am UTC](https://forum.ansible.com/t/delegation-issues/40382/17 "2025-02-25T08:39:54Z")
Error is can’t connect to host (precise words i don’t have handy). In effect delegation doesn’t fail, connecting to remote server from localhost fails which is allowed only from AWX master server. ---
**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\ **Post date:** [February 25, 2025, 12:35pm UTC](https://forum.ansible.com/t/delegation-issues/40382/18 "2025-02-25T12:35:39Z")
In that case why don’t you create a host with variables `ansible_connection: local` within AWX/AAP and then use Abc instead of localhost ? (as mentionned i’m doing the same but I create a host called localhost in AWX) EDIT: here’s an explanation [support "delegate\_to: localhost" · Issue #1006 · ansible/awx · GitHub](https://github.com/ansible/awx/issues/1006) ---
**Author:** ![vibhor\_agarwalin](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@vibhor\_agarwalin](https://forum.ansible.com/u/vibhor_agarwalin)\ **Post date:** [February 25, 2025, 4:28pm UTC](https://forum.ansible.com/t/delegation-issues/40382/19 "2025-02-25T16:28:03Z")
Seems i already have that in AWX ![image](https://us1.discourse-cdn.com/ansible/original/2X/5/557e2740fd9c88a4cb9198378f5ed005d5d6b7ad.png) Is this good or am i missing something? ---
**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\ **Post date:** [February 25, 2025, 5:24pm UTC](https://forum.ansible.com/t/delegation-issues/40382/20 "2025-02-25T17:24:06Z")
It seems good. Could you share the error you have (=awx job output) when using localhost please ? [Next page](https://forum.ansible.com/t/delegation-issues/40382.md?page=2)