# dynamic inventory from another ansbile?

**URL:** <https://forum.ansible.com/t/dynamic-inventory-from-another-ansbile/28269>\
**Category:** Ansible Project\
**Tags:** galaxy-ng\
**Created:** [August 6, 2018, 1:44pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-another-ansbile/28269 "2018-08-06T13:44:17Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![erichymowitz](https://avatars.discourse-cdn.com/v4/letter/e/9d8465/32.png) [@erichymowitz](https://forum.ansible.com/u/erichymowitz)\
**Post date:** [August 6, 2018, 1:44pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-another-ansbile/28269/1 "2018-08-06T13:44:17Z")

</div>

I have two ansible servers, call them ansible-a and ansible-b . ansible-a is my “primary” most-often-used ansible server for most of my hosts including ansible-b. However, there is a segregated network that ansible-a cannot get to, so ansible-b is the ansible server for those hosts on that network.

I would like to set up a dynamic inventory script so that ansible-a can refer to hosts managed by the ansible-b server, without manually duplicating the ansible-b inventory on ansible-a .

I’m hoping somebody has done this already, and has a dynamic inventory script that will properly

- query another ansible server
- specify a group that the remote ansible server knows about
- return the appropriate hosts in the appropriate format

I tried searching ansible-galaxy, but all I can find are roles. Maybe I’m not searching correctly. I have poor google-fu.

Can somebody point me the way?

–EbH

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [August 6, 2018, 2:09pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-another-ansbile/28269/2 "2018-08-06T14:09:19Z")

</div>

You could use ansible-b as a ssh proxy/bastion and have all the ansible configuration on ansible-a.  
Then when ansible-a need to contact host on the segregated network the connection would be proxy-ed through a ansible-b.

To make the dynamic inventory you could do this

#!/bin/bash

ssh \<user\>@ansible-a "cd /path/to/the/ansible/configuration; ansible-inventory all --list

Make it executable and put it in you inventory on ansible-b.

---

<div class="post-metadata">

**Author:** ![erichymowitz](https://avatars.discourse-cdn.com/v4/letter/e/9d8465/32.png) [@erichymowitz](https://forum.ansible.com/u/erichymowitz)\
**Post date:** [August 6, 2018, 2:29pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-another-ansbile/28269/3 "2018-08-06T14:29:17Z")

</div>

> > I have two ansible servers, call them ansible-a and ansible-b .  
> > ansible-a is my “primary” most-often-used ansible server for most of my  
> > hosts including ansible-b. However, there is a segregated network that  
> > ansible-a cannot get to, so ansible-b is the ansible server for those  
> > hosts on that network.
> 
> You could use ansible-b as a ssh proxy/bastion and have all the ansible  
> configuration on ansible-a.  
> Then when ansible-a need to contact host on the segregated network the  
> connection would be proxy-ed through a ansible-b.

I had trouble setting up an ssh-proxy the last time I tried, but I don’t remember why exactly. I should look into it again.

That is … a fascinating idea. One I will definitely need to look into (and check with my boss about).

> To make the dynamic inventory you could do this
> 
> #!/bin/bash
> 
> ssh @ansible-a "cd /path/to/the/ansible/configuration;  
> ansible-inventory all --list

Shortly after I posted my question, i found the ansible-inventory program which I think is exactly what I need in either case.

Thanks.

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [August 6, 2018, 2:37pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-another-ansbile/28269/4 "2018-08-06T14:37:00Z")

</div>

If you go this route, this blog post could help in setting it up  
[https://blog.scottlowe.org/2015/12/24/running-ansible-through-ssh-bastion-host/](https://blog.scottlowe.org/2015/12/24/running-ansible-through-ssh-bastion-host/)

---

<div class="post-metadata">

**Author:** ![erichymowitz](https://avatars.discourse-cdn.com/v4/letter/e/9d8465/32.png) [@erichymowitz](https://forum.ansible.com/u/erichymowitz)\
**Post date:** [August 6, 2018, 5:02pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-another-ansbile/28269/5 "2018-08-06T17:02:35Z")

</div>

I don’t know how to take a discussion from the list to a private email… but the problem with setting up ssh bastion hosts is not ansible configuration or ssh configuration, it’s poorly-designed security protocols that interfere with well-configured machines.

… unless you know of a way that I can set up my group\_vars file to use  
ansible\_user: $SUDO\_USER

…which I cannot get working.

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [August 6, 2018, 6:01pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-another-ansbile/28269/6 "2018-08-06T18:01:56Z")

</div>

The variable should be from localhost?  
If so this should work

ansible\_user: "{{ lookup('pipe', 'echo $SUDO\_USER') }}"

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [August 6, 2018, 6:11pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-another-ansbile/28269/7 "2018-08-06T18:11:47Z")

</div>

There is even an environment lookup plugin

ansible\_user: "{{ lookup('env', 'SUDO\_USER') }}"