Hi,
Is there a way that we can use a playbook with no “hosts: XXX” defined.
All the servers are available in the inventory file defined in the ansible.cfg , but the playbooks have to be run based on a single or multiple client on the ad-hoc request based.
Is there a way to remove
`
hosts: all
`
and have the same playbook working for security reasons ?
In the meantime when a play is to be executed in all the clients they have to be mentioned from the command line(or jenkins)
Hi,
Is there a way that we can use a playbook with no "hosts: XXX" defined.
No, hosts is a required attribute for a play.
All the servers are available in the inventory file defined in the
ansible.cfg , but the playbooks have to be run based on a single or
multiple client on the ad-hoc request based.
You can always set hosts: all and use the --limit to only run on some hosts.
Is there a way to remove
hosts: all
and have the same playbook working for security reasons ?
I don't understand what you mean by "for security reasons".
In the meantime when a play is to be executed in all the clients they have
to be mentioned from the command line(or jenkins)
You can use a variable for hosts an set it with extra vars on the command line
- hosts: '{{ myvar }}'
ansible-playbook pb.yml -e myvar=all
Hi kai,
Thanks for the inputs.
“for security reasons”. - I mean that we have disabled gather_facts for better performance. And we want other users to play the playbook with access to the same inventory .
I am looking for a way to avoid them running “ansible-playbook pb.yml -e myvar=all” and to always use “myvar=hostname.”
is there a way to stop a particular user to stop using " myvar=all" based on inventory or other modes?
Hi,
you could start with a task running against the localhost doing `jinja2`
magic and see, if `myvar=!al` and then run the next task with
hosts: "{{ myvar}}"
Greets
J
You could use this
hosts: '{{ "" if myvar == "all" else myvar }}'
If myvar is all hosts becomes empty sting and that is not allowed and Ansible will fail.
But this is easily defeated but adding a comma at the end myvar=all,
To fix that you would need to use the search/regex[1] test and craft a appropriate regexp for this.
[1] https://docs.ansible.com/ansible/latest/user_guide/playbooks_tests.html#testing-strings
Ansible is not designed to limit users in this way, you want something
like tower/awx that can limit access to what users execute.
But it works so I don't see a problem.
its easy to bypass, if it is a security issue, they should really look
at something that uses RBAC.