|
|
|
|
ansible(1)
|
|
|
|
|
=========
|
|
|
|
|
:doctype:manpage
|
|
|
|
|
:man source: Ansible
|
|
|
|
|
:man version: %VERSION%
|
|
|
|
|
:man manual: System administration commands
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
NAME
|
|
|
|
|
----
|
|
|
|
|
ansible-pull - pull playbooks from VCS server and run them using this machine as the target.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SYNOPSIS
|
|
|
|
|
--------
|
|
|
|
|
ansible-pull -U URL [options] [ <filename.yml> ]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DESCRIPTION
|
|
|
|
|
-----------
|
|
|
|
|
|
|
|
|
|
*Ansible* is an extra-simple tool/framework/API for doing \'remote things'.
|
|
|
|
|
|
|
|
|
|
Use ansible-pull to set up a remote copy of ansible on each managed
|
|
|
|
|
node, each set to run via cron and update playbook source via
|
|
|
|
|
a source repository. This inverts the default *push* architecture of
|
|
|
|
|
ansible into a *pull* architecture, which has near-limitless scaling
|
|
|
|
|
potential.
|
|
|
|
|
|
|
|
|
|
The setup playbook can be tuned to change the cron frequency, logging
|
|
|
|
|
locations, and parameters to ansible-pull.
|
|
|
|
|
|
|
|
|
|
This is useful both for extreme scale-out as well as periodic
|
|
|
|
|
remediation. Usage of the 'fetch' module to retrieve logs from
|
|
|
|
|
ansible-pull runs would be an excellent way to gather and analyze
|
|
|
|
|
remote logs from ansible-pull.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
OPTIONAL ARGUMENT
|
|
|
|
|
-----------------
|
|
|
|
|
|
|
|
|
|
*filename.yml*::
|
|
|
|
|
|
|
|
|
|
The name of one the YAML format files to run as an ansible playbook. This can
|
|
|
|
|
be a relative path within the checkout. If not provided, ansible-pull
|
|
|
|
|
will look for a playbook based on the host's fully-qualified domain name, on the
|
|
|
|
|
host hostname and finally a playbook named *local.yml*.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
OPTIONS
|
|
|
|
|
-------
|
|
|
|
|
|
|
|
|
|
*--accept-host-key*::
|
|
|
|
|
|
|
|
|
|
Adds the hostkey for the repo URL if not already added.
|
|
|
|
|
|
|
|
|
|
*-b*, *--become*::
|
|
|
|
|
|
|
|
|
|
Use privilege escalation (specific one depends on become_method),
|
|
|
|
|
this does not imply prompting for passwords.
|
|
|
|
|
|
|
|
|
|
*-K*, *--ask-become-pass*::
|
|
|
|
|
|
|
|
|
|
Ask for privilege escalation password.
|
|
|
|
|
|
|
|
|
|
*-k*, *--ask-pass*::
|
|
|
|
|
|
|
|
|
|
Prompt for the connection password, if it is needed for the transport used.
|
|
|
|
|
For example, using ssh and not having a key-based authentication with ssh-agent.
|
|
|
|
|
|
|
|
|
|
*--ask-su-pass*::
|
|
|
|
|
|
|
|
|
|
Prompt for su password, used with --su (deprecated, use become).
|
|
|
|
|
|
|
|
|
|
*--ask-sudo-pass*::
|
|
|
|
|
|
|
|
|
|
Prompt for the password to use with --sudo, if any (deprecated, use become).
|
|
|
|
|
|
|
|
|
|
*--ask-vault-pass*::
|
|
|
|
|
|
|
|
|
|
Prompt for vault password.
|
|
|
|
|
|
|
|
|
|
*-C* 'CHECKOUT', *--checkout=*'CHECKOUT'::
|
|
|
|
|
|
|
|
|
|
Branch/Tag/Commit to checkout. If not provided, uses default behavior of module used to check out playbook repository.
|
|
|
|
|
|
|
|
|
|
*-d* 'DEST', *--directory=*'DEST'::
|
|
|
|
|
|
|
|
|
|
Directory to checkout repository into. If not provided, a subdirectory of ~/.ansible/pull/ will be used.
|
|
|
|
|
|
|
|
|
|
*-e* 'EXTRA_VARS', *--extra-vars=*'EXTRA_VARS::
|
|
|
|
|
|
|
|
|
|
Extra variables to inject into a playbook, in key=value key=value format or
|
|
|
|
|
as quoted YAML/JSON (hashes and arrays). To load variables from a file, specify
|
|
|
|
|
the file preceded by @ (e.g. @vars.yml).
|
|
|
|
|
|
|
|
|
|
*-f*, *--force*::
|
|
|
|
|
|
|
|
|
|
Force running of playbook even if unable to update playbook repository. This
|
|
|
|
|
can be useful, for example, to enforce run-time state when a network
|
|
|
|
|
connection may not always be up or possible.
|
|
|
|
|
|
|
|
|
|
*--full*::
|
|
|
|
|
|
|
|
|
|
Do a full clone of the repository. By default ansible-pull will do a shallow clone based on the last revision.
|
|
|
|
|
|
|
|
|
|
*-h*, *--help*::
|
|
|
|
|
|
|
|
|
|
Show the help message and exit.
|
|
|
|
|
|
|
|
|
|
*-i* 'PATH', *--inventory=*'PATH'::
|
|
|
|
|
|
|
|
|
|
The 'PATH' to the inventory, which defaults to '/etc/ansible/hosts'.
|
|
|
|
|
Alternatively you can use a comma separated list of hosts or single host with traling comma 'host,'.
|
|
|
|
|
|
|
|
|
|
*--private-key=*'PRIVATE_KEY_FILE'::
|
|
|
|
|
|
|
|
|
|
Use this file to authenticate the connection.
|
|
|
|
|
|
|
|
|
|
*-m* 'NAME', *--module-name=*'NAME'::
|
|
|
|
|
|
|
|
|
|
Module used to checkout playbook repository. Defaults to git.
|
|
|
|
|
|
|
|
|
|
*-o*, *--only-if-changed*::
|
|
|
|
|
|
|
|
|
|
Only run the playbook if the repository has been updated.
|
|
|
|
|
|
|
|
|
|
*--purge*::
|
|
|
|
|
|
|
|
|
|
Purge the checkout after the playbook is run.
|
|
|
|
|
|
|
|
|
|
*-s* 'SLEEP', *--sleep=*'SLEEP'::
|
|
|
|
|
|
|
|
|
|
Sleep for random interval (between 0 and SLEEP number of seconds) before starting. This is a useful way ot disperse git requests.
|
|
|
|
|
|
Rework additional ssh argument handling
Now we have the following ways to set additional arguments:
1. [ssh_connection]ssh_args in ansible.cfg: global setting, prepended to
every command line for ssh/scp/sftp. Overrides default ControlPersist
settings.
2. ansible_ssh_common_args inventory variable. Appended to every command
line for ssh/scp/sftp. Used in addition to ssh_args, if set above, or
the default settings.
3. ansible_{sftp,scp,ssh}_extra_args inventory variables. Appended to
every command line for the relevant binary only. Used in addition to
#1 and #2, if set above, or the default settings.
3. Using the --ssh-common-args or --{sftp,scp,ssh}-extra-args command
line options (which are overriden by #2 and #3 above).
This preserves backwards compatibility (for ssh_args in ansible.cfg),
but also permits global settings (e.g. ProxyCommand via _common_args) or
ssh-specific options (e.g. -R via ssh_extra_args).
Fixes #12576
9 years ago
|
|
|
*--ssh-common-args=*''-o ProxyCommand="ssh -W %h:%p ..." ...''::
|
Squashed commit of the following:
commit 9921bb9d2002e136c030ff337c14f8b7eab0fc72
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Mon Aug 10 20:19:44 2015 +0530
Document --ssh-extra-args command-line option
commit 8b25595e7b1cc3658803d0821fbf498c18ee608a
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Thu Aug 13 13:24:57 2015 +0530
Don't disable GSSAPI/Pubkey authentication when using --ask-pass
This commit is based on a bug report and PR by kolbyjack (#6846) which
was subsequently closed and rebased as #11690. The original problem was:
«The password on the delegated host is different from the one I
provided on the command line, so it had to use the pubkey, and the
main host doesn't have a pubkey on it yet, so it had to use the
password.»
(This commit is revised and included here because #11690 would conflict
with the changes in #11908 otherwise.)
Closes #11690
commit 119d0323892c65e8169ae57e42bbe8e3517551a3
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Thu Aug 13 11:16:42 2015 +0530
Be more explicit about why SSH arguments are added
This adds vvvvv log messages that spell out in detail where each SSH
command-line argument is obtained from.
Unfortunately, we can't be sure if, say, self._play_context.remote_user
is obtained from ANSIBLE_REMOTE_USER in the environment, remote_user in
ansible.cfg, -u on the command line, or an ansible_ssh_user setting in
the inventory or on a task or play. In some cases, e.g. timeout, we
can't even be sure if it was set by the user or just a default.
Nevertheless, on the theory that at five v's you can use all the hints
available, I've mentioned the possible sources in the log messages.
Note that this caveat applies only to the arguments that ssh.py adds by
itself. In the case of ssh_args and ssh_extra_args, we know where they
are from, and say so, though we can't say WHERE in the inventory they
may be set (e.g. in host_vars or group_vars etc.).
commit b605c285baf505f75f0b7d73cb76b00d4723d02e
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Tue Aug 11 15:19:43 2015 +0530
Add a FAQ entry about ansible_ssh_extra_args
commit 49f8edd035cd28dd1cf8945f44ec3d55212910bd
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Mon Aug 10 20:48:50 2015 +0530
Allow ansible_ssh_args to be set as an inventory variable
Before this change, ssh_args could be set only in the [ssh_connection]
section of ansible.cfg, and was applied to all hosts. Now it's possible
to set ansible_ssh_args as an inventory variable (directly, or through
group_vars or host_vars) to selectively override the global setting.
Note that the default ControlPath settings are applied only if ssh_args
is not set, and this is true of ansible_ssh_args as well. So if you want
to override ssh_args but continue to set ControlPath, you'll need to
repeat the appropriate options when setting ansible_ssh_args.
(If you only need to add options to the default ssh_args, you may be
able to use the ansible_ssh_extra_args inventory variable instead.)
commit 37c1a5b6794cee29a7809ad056a86365a2c0f886
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Mon Aug 10 19:42:30 2015 +0530
Allow overriding ansible_ssh_extra_args on the command-line
This patch makes it possible to do:
ansible somehost -m setup \
--ssh-extra-args '-o ProxyCommand="ssh -W %h:%p -q user@bouncer.example.com"'
This overrides the inventory setting, if any, of ansible_ssh_extra_args.
Based on a patch originally by @Richard2ndQuadrant.
commit b023ace8a8a7ce6800e29129a27ebe8bf6bd38e0
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Mon Aug 10 19:06:19 2015 +0530
Add an ansible_ssh_extra_args inventory variable
This can be used to configure a per-host or per-group ProxyCommand to
connect to hosts through a jumphost, e.g.:
inventory:
[gatewayed]
foo ansible_ssh_host=192.0.2.1
group_vars/gatewayed.yml:
ansible_ssh_extra_args: '-o ProxyCommand="ssh -W %h:%p -q bounceuser@gateway.example.com"'
Note that this variable is used in addition to any ssh_args configured
in the [ssh_connection] section of ansible.cfg (so you don't need to
repeat the ControlPath settings in ansible_ssh_extra_args).
9 years ago
|
|
|
|
Rework additional ssh argument handling
Now we have the following ways to set additional arguments:
1. [ssh_connection]ssh_args in ansible.cfg: global setting, prepended to
every command line for ssh/scp/sftp. Overrides default ControlPersist
settings.
2. ansible_ssh_common_args inventory variable. Appended to every command
line for ssh/scp/sftp. Used in addition to ssh_args, if set above, or
the default settings.
3. ansible_{sftp,scp,ssh}_extra_args inventory variables. Appended to
every command line for the relevant binary only. Used in addition to
#1 and #2, if set above, or the default settings.
3. Using the --ssh-common-args or --{sftp,scp,ssh}-extra-args command
line options (which are overriden by #2 and #3 above).
This preserves backwards compatibility (for ssh_args in ansible.cfg),
but also permits global settings (e.g. ProxyCommand via _common_args) or
ssh-specific options (e.g. -R via ssh_extra_args).
Fixes #12576
9 years ago
|
|
|
Add the specified arguments to any sftp/scp/ssh command-line. Useful to
|
|
|
|
|
set a ProxyCommand to use a jump host, but any arguments that are
|
|
|
|
|
accepted by all three programs may be specified.
|
|
|
|
|
|
|
|
|
|
*--sftp-extra-args=*''-f ...''::
|
|
|
|
|
|
|
|
|
|
Add the specified arguments to any sftp command-line.
|
|
|
|
|
|
|
|
|
|
*--scp-extra-args=*''-l ...''::
|
|
|
|
|
|
|
|
|
|
Add the specified arguments to any scp command-line.
|
|
|
|
|
|
|
|
|
|
*--ssh-extra-args=*''-R ...''::
|
|
|
|
|
|
|
|
|
|
Add the specified arguments to any ssh command-line.
|
Squashed commit of the following:
commit 9921bb9d2002e136c030ff337c14f8b7eab0fc72
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Mon Aug 10 20:19:44 2015 +0530
Document --ssh-extra-args command-line option
commit 8b25595e7b1cc3658803d0821fbf498c18ee608a
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Thu Aug 13 13:24:57 2015 +0530
Don't disable GSSAPI/Pubkey authentication when using --ask-pass
This commit is based on a bug report and PR by kolbyjack (#6846) which
was subsequently closed and rebased as #11690. The original problem was:
«The password on the delegated host is different from the one I
provided on the command line, so it had to use the pubkey, and the
main host doesn't have a pubkey on it yet, so it had to use the
password.»
(This commit is revised and included here because #11690 would conflict
with the changes in #11908 otherwise.)
Closes #11690
commit 119d0323892c65e8169ae57e42bbe8e3517551a3
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Thu Aug 13 11:16:42 2015 +0530
Be more explicit about why SSH arguments are added
This adds vvvvv log messages that spell out in detail where each SSH
command-line argument is obtained from.
Unfortunately, we can't be sure if, say, self._play_context.remote_user
is obtained from ANSIBLE_REMOTE_USER in the environment, remote_user in
ansible.cfg, -u on the command line, or an ansible_ssh_user setting in
the inventory or on a task or play. In some cases, e.g. timeout, we
can't even be sure if it was set by the user or just a default.
Nevertheless, on the theory that at five v's you can use all the hints
available, I've mentioned the possible sources in the log messages.
Note that this caveat applies only to the arguments that ssh.py adds by
itself. In the case of ssh_args and ssh_extra_args, we know where they
are from, and say so, though we can't say WHERE in the inventory they
may be set (e.g. in host_vars or group_vars etc.).
commit b605c285baf505f75f0b7d73cb76b00d4723d02e
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Tue Aug 11 15:19:43 2015 +0530
Add a FAQ entry about ansible_ssh_extra_args
commit 49f8edd035cd28dd1cf8945f44ec3d55212910bd
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Mon Aug 10 20:48:50 2015 +0530
Allow ansible_ssh_args to be set as an inventory variable
Before this change, ssh_args could be set only in the [ssh_connection]
section of ansible.cfg, and was applied to all hosts. Now it's possible
to set ansible_ssh_args as an inventory variable (directly, or through
group_vars or host_vars) to selectively override the global setting.
Note that the default ControlPath settings are applied only if ssh_args
is not set, and this is true of ansible_ssh_args as well. So if you want
to override ssh_args but continue to set ControlPath, you'll need to
repeat the appropriate options when setting ansible_ssh_args.
(If you only need to add options to the default ssh_args, you may be
able to use the ansible_ssh_extra_args inventory variable instead.)
commit 37c1a5b6794cee29a7809ad056a86365a2c0f886
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Mon Aug 10 19:42:30 2015 +0530
Allow overriding ansible_ssh_extra_args on the command-line
This patch makes it possible to do:
ansible somehost -m setup \
--ssh-extra-args '-o ProxyCommand="ssh -W %h:%p -q user@bouncer.example.com"'
This overrides the inventory setting, if any, of ansible_ssh_extra_args.
Based on a patch originally by @Richard2ndQuadrant.
commit b023ace8a8a7ce6800e29129a27ebe8bf6bd38e0
Author: Abhijit Menon-Sen <ams@2ndQuadrant.com>
Date: Mon Aug 10 19:06:19 2015 +0530
Add an ansible_ssh_extra_args inventory variable
This can be used to configure a per-host or per-group ProxyCommand to
connect to hosts through a jumphost, e.g.:
inventory:
[gatewayed]
foo ansible_ssh_host=192.0.2.1
group_vars/gatewayed.yml:
ansible_ssh_extra_args: '-o ProxyCommand="ssh -W %h:%p -q bounceuser@gateway.example.com"'
Note that this variable is used in addition to any ssh_args configured
in the [ssh_connection] section of ansible.cfg (so you don't need to
repeat the ControlPath settings in ansible_ssh_extra_args).
9 years ago
|
|
|
|
|
|
|
|
*-t* 'TAGS', *--tags=*'TAGS'::
|
|
|
|
|
|
|
|
|
|
Only run plays and tasks tagged with these values.
|
|
|
|
|
|
|
|
|
|
*-U* 'URL', *--url=*'URL'::
|
|
|
|
|
|
|
|
|
|
URL of the playbook repository to checkout.
|
|
|
|
|
|
|
|
|
|
*--vault-password-file=*'VAULT_PASSWORD_FILE'::
|
|
|
|
|
|
|
|
|
|
Vault password file.
|
|
|
|
|
|
|
|
|
|
*--clean*::
|
|
|
|
|
|
|
|
|
|
Modified files in the working repository will be discarded.
|
|
|
|
|
|
|
|
|
|
*--track-subs*::
|
|
|
|
|
|
|
|
|
|
Submodules will track the latest changes.
|
|
|
|
|
|
|
|
|
|
*-v*, *--verbose*::
|
|
|
|
|
|
|
|
|
|
Pass -vvv to ansible-playbook.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
INVENTORY
|
|
|
|
|
---------
|
|
|
|
|
|
|
|
|
|
Ansible stores the hosts it can potentially operate on in an inventory.
|
|
|
|
|
This can be an ini-like file, a script, directory or a list.
|
|
|
|
|
The ini syntax is one host per line. Groups headers are allowed and
|
|
|
|
|
are included on their own line, enclosed in square brackets that start the line.
|
|
|
|
|
|
|
|
|
|
Ranges of hosts are also supported. For more information and
|
|
|
|
|
additional options, see the documentation on http://docs.ansible.com/.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ENVIRONMENT
|
|
|
|
|
-----------
|
|
|
|
|
|
|
|
|
|
The following environment variables may be specified.
|
|
|
|
|
|
|
|
|
|
ANSIBLE_INVENTORY -- Override the default ansible inventory file
|
|
|
|
|
|
|
|
|
|
ANSIBLE_LIBRARY -- Override the default ansible module library path
|
|
|
|
|
|
|
|
|
|
ANSIBLE_CONFIG -- Override the default ansible config file
|
|
|
|
|
|
|
|
|
|
Many more are available for most options in ansible.cfg
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
FILES
|
|
|
|
|
-----
|
|
|
|
|
|
|
|
|
|
/etc/ansible/hosts -- Default inventory file
|
|
|
|
|
|
|
|
|
|
/usr/share/ansible/ -- Default module library
|
|
|
|
|
|
|
|
|
|
/etc/ansible/ansible.cfg -- Config file, used if present
|
|
|
|
|
|
|
|
|
|
~/.ansible.cfg -- User config file, overrides the default config if present
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
AUTHOR
|
|
|
|
|
------
|
|
|
|
|
|
|
|
|
|
Ansible was originally written by Michael DeHaan.
|
|
|
|
|
See the AUTHORS file for a complete list of contributors.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
COPYRIGHT
|
|
|
|
|
---------
|
|
|
|
|
|
|
|
|
|
Copyright © 2012, Michael DeHaan
|
|
|
|
|
Ansible is released under the terms of the GPLv3 License.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SEE ALSO
|
|
|
|
|
--------
|
|
|
|
|
|
|
|
|
|
*ansible*(1) *ansible-playbook*(1), *ansible-doc*(1), *ansible-vault*(1), *ansible-galaxy*(1)
|
|
|
|
|
|
|
|
|
|
Extensive documentation is available in the documentation site:
|
|
|
|
|
<http://docs.ansible.com>. IRC and mailing list info can be found
|
|
|
|
|
in file CONTRIBUTING.md, available in: <https://github.com/ansible/ansible>
|