In out common role we have a task which creates a script from a template to create ssh tunnel between a certain number of hosts in the inventory. The template looks like this:
`
{% for host in ssh_tunnel %}
{% if host != inventory_hostname %}
{% if hostvars[host][‘ansible_default_ipv4’] is defined %}
{% for ports in hostvars[host][‘ssh_tunnel_ports’] %}
su {{tunnel_user_name}} -c “autossh -p 22 -2 -fN -M 0 -L {{ports.local}}:127.0.0.1:{{ports.remote}} {{tunnel_user_name}}@{{hostvars[host][‘ansible_default_ipv4’][‘address’]}}”
{% endfor %}
{% endif %}
{% endif %}
{% endfor %}
`
So the current host should be tunnelling to all hosts in the hash ssh_tunnel except to itself.
We’ve now had the scenario that from one mis-configured PC, one of the hosts wasn’t reachable in the Ansible run which caused a warning but of course the rest of the playbook just went ahead - as it should do. As that one host wasn’t reachable, the above loop excluded that host from the ssh tunnel script and that caused some services to crash, i.e. those who required that tunnel.
My question: the tunnel should not be updated if one of the hosts ins ssh_tunnel already had failed. How can I include that in a “when:” statement in the task or is there a better way of achieving that level of reliability?