# host\_add uniqueness: name, ansible\_host & ansible\_ssh\_extra\_args ? **URL:** \ **Category:** Ansible Project\ **Created:** [October 27, 2016, 9:10pm UTC](https://forum.ansible.com/t/host-add-uniqueness-name-ansible-host-ansible-ssh-extra-args/22908 "2016-10-27T21:10:22Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![alexandre](https://avatars.discourse-cdn.com/v4/letter/a/a88e4f/32.png) [@alexandre](https://forum.ansible.com/u/alexandre)\ **Post date:** [October 27, 2016, 9:10pm UTC](https://forum.ansible.com/t/host-add-uniqueness-name-ansible-host-ansible-ssh-extra-args/22908/1 "2016-10-27T21:10:22Z")
Hi, I use docker to run (network namespaced) VPN… I have to use a custom ProxyCommand, per VPN, to access the other side with Ansible, so far so good… So I’m using Ansible to find the right container and then add\_host to set it up (as everything is dynamic) with: - name: Add VPN host add\_host: name: “{{ item }}” groups: vpn ansible\_ssh\_extra\_args: “-o StrictHostKeyChecking=no -o ProxyCommand="ssh -q user@{{ inventory\_hostname }} docker exec -i {{ item }} nc %h %p"” ansible\_ssh\_user: “user” ansible\_host: “10.0.0.1” with\_items: “{{ vpn\_container\_names }}” This works great with ssh directly and also “seems” to work with ansible, but I only get to access the first container with subsequent loops. It is as if adding them with the same ansible\_host did nothing, even though the name (container\_xyz\_1) was different… I would have thought that “name” + “ansible\_host” + ssh options would be used as the unique pair, but it seems something like this is not sufficiently unique in a dynamic inventory context: # name= & ansible\_host= (what it would look like in a file from my understanding) container\_001122334455\_1 ansible\_host=10.0.0.1 ansible\_ssh\_extra\_args=… ansible\_ssh\_user=user container\_667788990011\_1 ansible\_host=10.0.0.1 ansible\_ssh\_extra\_args=… ansible\_ssh\_user=user etc. Even though they all have the ProxyCommand that IS unique and works great on its own: ssh -o StrictHostKeyChecking=no -o ProxyCommand=“ssh -q [user@machine.example.com](mailto:user@machine.example.com) docker exec -i container\_001122334455\_1 nc %h %p” [user@10.0.0.1](mailto:user@10.0.0.1) ssh -o StrictHostKeyChecking=no -o ProxyCommand=“ssh -q [user@machine.example.com](mailto:user@machine.example.com) docker exec -i container\_667788990011\_1 nc %h %p” [user@10.0.0.1](mailto:user@10.0.0.1) … So am I correct in assuming that host uniqueness is only based on ansible\_host and doesn’t care about the host’s “name” if ansible\_host is set? if so, should it be based on all the relevant variables: name, host & options (ansible\_ssh\_extra\_args, etc.) considering different virtualization cases or remote network namespaces with jump hosts with similar IP space? Or do I simply have a bug in my playbook? (which would actually be great news as I’m not sure how to go around this issue otherwise!) Thanks a lot, 🙂 Alex ---
**Author:** ![alexandre](https://avatars.discourse-cdn.com/v4/letter/a/a88e4f/32.png) [@alexandre](https://forum.ansible.com/u/alexandre)\ **Post date:** [October 28, 2016, 3:24am UTC](https://forum.ansible.com/t/host-add-uniqueness-name-ansible-host-ansible-ssh-extra-args/22908/2 "2016-10-28T03:24:40Z")
digging deeper, things get stranger… With -vvv I see this, running a shell command to get the IP (anonymized): ssh -C -q -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=user -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o ‘ProxyCommand=ssh -q [user@machine.example.com](mailto:user@machine.example.com) docker exec -i container\_001122334455\_1 nc %h %p’ -o ControlPath=/home/user/.ansible/cp/ansible-ssh-%h-%p-%r -tt 10.0.0.1 if I use it myself, I get to the right machine, but clearly ansible is outputing the ip of the first machine in the list which isn’t this one. So -vvv is lying about what it’s actually using to connect. There is some ssh persistance that could be at play here, digging deeper I see: ~/.ansible/cp/ansible-ssh-10.0.0.1-22-user which isn’t unique enough, and by the look of it there isn’t a random argument available directly in ssh… If I can pin it per host added with add\_host, I could prepend the container name to this which would save the day. This really sound like a major bug with Ansible for anyone having overlapping address space in different networks… (currently trying with 2.1.2.0) Alex ---
**Author:** ![alexandre](https://avatars.discourse-cdn.com/v4/letter/a/a88e4f/32.png) [@alexandre](https://forum.ansible.com/u/alexandre)\ **Post date:** [October 28, 2016, 5:07am UTC](https://forum.ansible.com/t/host-add-uniqueness-name-ansible-host-ansible-ssh-extra-args/22908/3 "2016-10-28T05:07:07Z")
Indeed, this can fix it for now (not pretty) in my add\_host loop by prepending the ControlPath with the unique container ID (hopefully good enough for now): … ansible\_ssh\_extra\_args: “-o StrictHostKeyChecking=no -o ProxyCommand="ssh -q user@{{ inventory\_hostname }} docker exec -i {{ item }} nc %h %p" -o ControlPath=~/.ansible/cp/{{ item }}-ssh-%h-%p-%r” ansible\_scp\_extra\_args: “-o StrictHostKeyChecking=no -o ProxyCommand="ssh -q user@{{ inventory\_hostname }} docker exec -i {{ item }} nc %h %p" -o ControlPath=~/.ansible/cp/{{ item }}-ssh-%h-%p-%r” ansible\_sftp\_extra\_args: “-o StrictHostKeyChecking=no -o ProxyCommand="ssh -q user@{{ inventory\_hostname }} docker exec -i {{ item }} nc %h %p" -o ControlPath=~/.ansible/cp/{{ item }}-ssh-%h-%p-%r” … Feels like the hash should be based on all the options, not just ip-port-user 🙂