# How do I get the Ansible plugin to work with Jenkins? **URL:** \ **Category:** Ansible Project\ **Created:** [February 3, 2016, 1:46am UTC](https://forum.ansible.com/t/how-do-i-get-the-ansible-plugin-to-work-with-jenkins/20429 "2016-02-03T01:46:55Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Kiran1](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@Kiran1](https://forum.ansible.com/u/Kiran1)\ **Post date:** [February 3, 2016, 1:46am UTC](https://forum.ansible.com/t/how-do-i-get-the-ansible-plugin-to-work-with-jenkins/20429/1 "2016-02-03T01:46:55Z")
My Ansible (version 1.9.5) server is on its own dedicated CentOS 7 server. My Jenkins (version 1.6) server is on its own dedicated CentOS 7 server. I installed the Ansible plugin for Jenkins. I created a New Item that invokes an ad-hoc Ansible command. For the Ansible Installation field, I enter the DNS name of the Ansible server. For host pattern, I chose the group of servers that I want the Ansible playbook to run again. The group name was defined in the …/ansible/hosts file. The console output of this new Jenkins job that should invoke an ansible command (on a separate server with Ansible installed) says this: “Building in workspace /var/lib/jenkins/jobs/… $ sshpass \*\*\*\*\*\* /ansible … DNSnameOfAnsibleServer -i … FATAL: command execution failed hudson.AbortException: Ansible Ad-Hoc command execution failed at org.jenkinsci.plugins.ansible.AnsibleAdHocCommandBuilder.perform(AnsibleAdHocCommandBuilder.java:176 at …” Does the Ansible server need sshpass? The Jenkins server has sshpass. How do I get Jenkins to invoke an ansible playbook on an Ansible server? This error makes me think that something is wrong with sshpass. I can view the man page of sshpass. Is there a certain version that I need? ---
**Author:** ![jno](https://avatars.discourse-cdn.com/v4/letter/j/f14d63/32.png) [@jno](https://forum.ansible.com/u/jno)\ **Post date:** [February 3, 2016, 10:11pm UTC](https://forum.ansible.com/t/how-do-i-get-the-ansible-plugin-to-work-with-jenkins/20429/2 "2016-02-03T22:11:08Z")
Hi Kiran, I suspect that the Ansible plugin for Jenkins only looks for a locally installed Ansible binary. See the example at the plugin page: [https://wiki.jenkins-ci.org/display/JENKINS/Ansible+Plugin](https://wiki.jenkins-ci.org/display/JENKINS/Ansible+Plugin) Cheers, //Jon ---
**Author:** ![jno](https://avatars.discourse-cdn.com/v4/letter/j/f14d63/32.png) [@jno](https://forum.ansible.com/u/jno)\ **Post date:** [February 3, 2016, 10:12pm UTC](https://forum.ansible.com/t/how-do-i-get-the-ansible-plugin-to-work-with-jenkins/20429/3 "2016-02-03T22:12:14Z")
Hi Kiran, I suspect that the Ansible plugin for Jenkins only looks for a locally installed Ansible binary. See the example at the plugin page: [https://wiki.jenkins-ci.org/display/JENKINS/Ansible+Plugin](https://wiki.jenkins-ci.org/display/JENKINS/Ansible+Plugin) Cheers, //Jon ---
**Author:** ![Javier\_Palacios](https://avatars.discourse-cdn.com/v4/letter/j/67e7ee/32.png) [@Javier\_Palacios](https://forum.ansible.com/u/Javier_Palacios)\ **Post date:** [February 4, 2016, 9:31am UTC](https://forum.ansible.com/t/how-do-i-get-the-ansible-plugin-to-work-with-jenkins/20429/4 "2016-02-04T09:31:46Z")
With the setup you describe, you have basically two jenkins-aware options. One, which is closer to what you are currently making, is to give ssh permission from jenkins to ansible servers. In that case you will need also one of the plugins that allows Jenkins to execute ssh commands in a different node (ssh-plugin or similar one) and use it instead of standard shell command box, _but_ the remote node has no access to whatever lives at the jenkins server, and will only access whatever exists at the ansible server unless you explicitly copy it (it’s just ssh after all). The second approach which is the one that will probably behave as you expect, is to make the ansible server a Jenkins slave, and configure all ansible jobs to be executed in that slave with standard shell command box, you can drop the ssh stuff and run the slave as a user capable to run ansible, but security implications are not actually higher than giving ssh access (except maybe firewall ports). In this setup the workspace lives at the ansible (slave) server, but it is transparent to you because everything else is stored at jenkins (master) server. ---
**Author:** ![manne\_shiva\_kumar](https://avatars.discourse-cdn.com/v4/letter/m/94ad74/32.png) [@manne\_shiva\_kumar](https://forum.ansible.com/u/manne_shiva_kumar)\ **Post date:** [September 2, 2017, 4:17am UTC](https://forum.ansible.com/t/how-do-i-get-the-ansible-plugin-to-work-with-jenkins/20429/5 "2017-09-02T04:17:57Z")
Hi Kiran, Am having the same issue… could you please help me in resolving this… ---
**Author:** ![dch](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dch/32/7132_2.png) [@dch](https://forum.ansible.com/u/dch)\ **Post date:** [September 8, 2017, 8:13am UTC](https://forum.ansible.com/t/how-do-i-get-the-ansible-plugin-to-work-with-jenkins/20429/6 "2017-09-08T08:13:30Z")
I've just dealt with this last week. With the caveat that every time I use Jenkins I feel like I've been assaulted by aliens, here's the only solution I found that actually worked: - the jenkins slave has a passwordless ssh key provided to it that \*only\* enables ssh to the ansible box. It cannot be used elsewhere in the infrastructure. The key lives in $HOME of the jenkins user - $HOME/.ssh/id\_ed25519 (or id\_rsa whatever key you use) as putting the private key directly into the Jenkins config did not work. ssh-keygen -o -t ed25519 -f /home/jenkins/.ssh/id\_ed25519 "jenkins@example.org" - the ansible server has an authorized\_keys file that restricts the above key to run a pre-selected command and 1 parameter # /home/ansible/.ssh/authorized\_keys command="/home/ansible/src/ansible/jenkins.sh $SSH\_ORIGINAL\_COMMAND",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-ed25519 \ jenkins@example.org - the jenkins job calls ssh and passes in 1 parameter which will be provided to ansible # Jenkinsfile     stage('Deploy') {       steps {         echo 'Deploy step ...'         script {           switch(env.BRANCH\_NAME){             case "master" : sh 'ssh ansible@example.org production'             case "develop" : sh 'ssh ansible@example.org develop'             default : echo "... ignored in this branch"           }         }       } - this is the script spawned by ssh # /home/ansible/src/ansible/jenkins.sh #!/bin/sh -xe # restricted command for ssh to run ansible via make targets cd /home/ansible/src/ansible case $1 in     production) make production ;;     development) make development ;; esac - there is a Makefile in the root of the ansible dir that picks up the parameter and uses it as a makefile target # /home/ansible/src/ansible/Makefile clean::   @git reset --hard   @git clean -fdx   @git pull --ff-only production:: clean   ansible-playbook app.yml --limit prod,lb --diff There is also an ssh\_config and ansible.cfg files that specify ports, private key to use, and a few other useful parameters. There are a few things you can do to tighten security, making sure that there is no way for jenkins to do anything other than ssh in and run make. - make jenkins.sh immutable - move the authorized\_keys file to somewhere like /etc/ssh/ to ensure the command cannot be trimmed - find a better way to handle the ansible-side ssh key. I use hashicorp's vault here to handle that but thats a story for another day - get the jenkins hashicorp plug to work, it doesn't for me I'd really like to tell ansible to display output in ANSI colour even though its running as a background task. A+ Dave ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [September 8, 2017, 11:12am UTC](https://forum.ansible.com/t/how-do-i-get-the-ansible-plugin-to-work-with-jenkins/20429/7 "2017-09-08T11:12:16Z")
You can export ANSIBLE\_FORCE\_COLOR=TRUE if you have AnsiColor plugin installed in your jenkins you will see the colours in the Console output of your jobs. Jon