Hi everyone,
I am learning to use Ansible but I am running into a bit of a wall with regards to authentication. It could be that I am going about it all wrong in the first place or that I am somehow missing something relatively small. Regardless of which one it is, I could use some help.
So, I’ve deployed two vsphere virtual machines using Terraform. That part works as it should, I’ve verified this through connecting to them manually. Now, with security in mind, I want to make it so that Ansible can access the machines using a key. I’ve created a key pair using Terraform’s TLS module and stored both the private and public key in a vault (Infisical). My Ansible is deployed from gitlab and can obtain the secrets from Infisical by authenticating through environment variables. The public key should be on the deployed VM’s, but I cannot figure out how to get the private key in a position where Ansible can connect with my machines.
I’ve tried to look for an option to parse the key directly like one would a password, but failed to find such an option. Now, I’m trying to put the key in a file on the local runner like this:
tasks:
- name: Create the .ssh directory
ansible.builtin.shell: mkdir -p /home/ansible/.ssh/
delegate_to: 127.0.0.1
- name: Put private key on local runner
ansible.builtin.shell: cat "{{ ansible_private_key }}" > /home/ansible/.ssh/id_rsa
delegate_to: 127.0.0.1
- name: Put public key on local runner
ansible.builtin.shell: cat "{{ ansible_public_key }}" > /home/ansible/.ssh/id_rsa.pub
delegate_to: 127.0.0.1
- name: List all entries of the .ssh directory
ansible.builtin.shell: ls -lah ~.ssh/
delegate_to: 127.0.0.1
register: ls
- debug: var=ls.stdout_lines
I’ve also tried to use local_action in a similar fashion, but neither of them works. I’m not even getting the debug output I expected, only that it cannot find the file that it is supposed to make:
$ ansible-playbook --inventory inventory.yml playbook.yml $ANSIBLE_VARS
PLAY [Install the necessary software on the remote hosts] **********************
TASK [Gathering Facts] *********************************************************
fatal: [webserver01]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: Warning: Permanently added '<IP_address>:' (ED25519) to the list of known hosts.\r\nno such identity: /home/ansible/.ssh/id_rsa: No such file or directory\r\nubuntu@<IP_address>:: Permission denied (publickey).", "unreachable": true}
fatal: [webserver02]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: Warning: Permanently added '<IP_address>:' (ED25519) to the list of known hosts.\r\nno such identity: /home/ansible/.ssh/id_rsa: No such file or directory\r\nubuntu@<IP_address>: Permission denied (publickey).", "unreachable": true}
PLAY RECAP *********************************************************************
webserver01 : ok=0 changed=0 unreachable=1 failed=0 skipped=0 rescued=0 ignored=0
webserver02 : ok=0 changed=0 unreachable=1 failed=0 skipped=0 rescued=0 ignored=0
I’ve manually exchanged the actual IP addresses for <IP_address> for security.
So, I guess the overarching question is, how do I get my private key from where it is made into the Ansible container that runs in gitlab? Am I on the right track? Given that I am still learning, I am also happy with a hint or link to the documentation that contains the solution.
Thank you in advance for your help!