|
|
|
@ -122,8 +122,9 @@ Noteworthy Differences
|
|
|
|
|
`lxc <https://docs.ansible.com/ansible/2.5/plugins/connection/lxc.html>`_,
|
|
|
|
|
`lxd <https://docs.ansible.com/ansible/2.5/plugins/connection/lxd.html>`_,
|
|
|
|
|
and `ssh <https://docs.ansible.com/ansible/2.5/plugins/connection/ssh.html>`_
|
|
|
|
|
built-in connection types are supported, along with a Mitogen-specific
|
|
|
|
|
``setns`` container type. File bugs to register interest in more.
|
|
|
|
|
built-in connection types are supported, along with Mitogen-specific
|
|
|
|
|
:ref:`machinectl <machinectl>`, :ref:`mitogen_sudo <sudo>`, and
|
|
|
|
|
:ref:`setns <setns>` types. File bugs to register interest in others.
|
|
|
|
|
|
|
|
|
|
* Local commands execute in a reuseable interpreter created identically to
|
|
|
|
|
interpreters on targets. Presently one interpreter per ``become_user``
|
|
|
|
@ -256,10 +257,17 @@ command line, or as host and group variables.
|
|
|
|
|
File Transfer
|
|
|
|
|
~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
Normally a tool like ``scp`` is used to copy a file with the ``copy`` or
|
|
|
|
|
``template`` actions, or when uploading modules with pipelining disabled. With
|
|
|
|
|
Mitogen copies are implemented natively using the same interpreters, connection
|
|
|
|
|
tree, and routed message bus that carries RPCs.
|
|
|
|
|
Normally `sftp <https://linux.die.net/man/1/sftp>`_ or
|
|
|
|
|
`scp <https://linux.die.net/man/1/scp>`_ is used to copy a file by the
|
|
|
|
|
`assemble <http://docs.ansible.com/ansible/latest/modules/assemble_module.html>`_,
|
|
|
|
|
`copy <http://docs.ansible.com/ansible/latest/modules/copy_module.html>`_,
|
|
|
|
|
`patch <http://docs.ansible.com/ansible/latest/modules/patch_module.html>`_,
|
|
|
|
|
`script <http://docs.ansible.com/ansible/latest/modules/script_module.html>`_,
|
|
|
|
|
`template <http://docs.ansible.com/ansible/latest/modules/template_module.html>`_, and
|
|
|
|
|
`unarchive <http://docs.ansible.com/ansible/latest/modules/unarchive_module.html>`_
|
|
|
|
|
actions, or when uploading modules with pipelining disabled. With Mitogen
|
|
|
|
|
copies are implemented natively using the same interpreters, connection tree,
|
|
|
|
|
and routed message bus that carries RPCs.
|
|
|
|
|
|
|
|
|
|
This permits streaming directly between endpoints regardless of execution
|
|
|
|
|
environment, without necessitating temporary copies in intermediary accounts or
|
|
|
|
@ -267,16 +275,39 @@ machines, for example when ``become`` is active, or in the presence of
|
|
|
|
|
connection delegation. It also neatly avoids the problem of securely sharing
|
|
|
|
|
temporary files between accounts and machines.
|
|
|
|
|
|
|
|
|
|
One roundtrip is required to initiate a transfer. For any tool that operates
|
|
|
|
|
via SSH multiplexing, 5 are required to configure the associated IO channel, in
|
|
|
|
|
addition to the time needed to start the local and remote processes. A complete
|
|
|
|
|
localhost invocation of ``scp`` requires around 15 ms.
|
|
|
|
|
|
|
|
|
|
As the implementation is self-contained, it is simple to make future
|
|
|
|
|
improvements like prioritizing transfers, supporting resume, or displaying
|
|
|
|
|
progress bars.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Safety
|
|
|
|
|
^^^^^^
|
|
|
|
|
|
|
|
|
|
Incomplete transfers proceed to a hidden file in the destination directory,
|
|
|
|
|
with content and metadata synced using `fsync(2)
|
|
|
|
|
<https://linux.die.net/man/2/fsync>`_ prior to rename over any existing file.
|
|
|
|
|
This ensures the file remains consistent in the event of a crash, or when
|
|
|
|
|
overlapping `ansible-playbook` runs deploy differing file contents.
|
|
|
|
|
|
|
|
|
|
The `sftp <https://linux.die.net/man/1/sftp>`_ and `scp
|
|
|
|
|
<https://linux.die.net/man/1/sftp>`_ tools may cause undetectable data
|
|
|
|
|
corruption in the form of truncated files, or files containing intermingled
|
|
|
|
|
data segments from overlapping runs. In normal operation both tools
|
|
|
|
|
additionally expose a window where users of the file may observe inconsistent
|
|
|
|
|
contents.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Performance
|
|
|
|
|
^^^^^^^^^^^
|
|
|
|
|
|
|
|
|
|
One roundtrip in each direction is required to initiate a transfer larger than
|
|
|
|
|
32KiB. For smaller transfers content is embedded in the RPC towards the target.
|
|
|
|
|
For any tool that operates via SSH multiplexing, 5 roundtrips are required to
|
|
|
|
|
configure the associated IO channel, in addition to the time needed to start
|
|
|
|
|
the local and remote copy subprocesses. A complete localhost invocation of
|
|
|
|
|
``scp`` with an empty ``.profile`` requires around 15 ms.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Interpreter Reuse
|
|
|
|
|
~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
@ -455,13 +486,15 @@ connection delegation is supported.
|
|
|
|
|
* ``ansible_user``: Name of user within the container to execute as.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
.. _machinectl:
|
|
|
|
|
|
|
|
|
|
Machinectl
|
|
|
|
|
~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
Behaves like `machinectl
|
|
|
|
|
Behaves like `machinectl third party plugin
|
|
|
|
|
<https://github.com/BaxterStockman/ansible-connection-machinectl>`_ except
|
|
|
|
|
connection delegation is supported. This is a lightweight wrapper around the
|
|
|
|
|
``setns`` method below.
|
|
|
|
|
connection delegation is supported. This is a light wrapper around the
|
|
|
|
|
:ref:`setns <setns>` method.
|
|
|
|
|
|
|
|
|
|
* ``ansible_host``: Name of Docker container (default: inventory hostname).
|
|
|
|
|
* ``ansible_user``: Name of user within the container to execute as.
|
|
|
|
@ -469,17 +502,44 @@ connection delegation is supported. This is a lightweight wrapper around the
|
|
|
|
|
as ``/bin/machinectl``.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Sudo
|
|
|
|
|
~~~~
|
|
|
|
|
FreeBSD Jails
|
|
|
|
|
~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
Behaves like `jail
|
|
|
|
|
<https://docs.ansible.com/ansible/2.5/plugins/connection/jail.html>`_ except
|
|
|
|
|
connection delegation is supported.
|
|
|
|
|
|
|
|
|
|
* ``ansible_host``: Name of jail (default: inventory hostname).
|
|
|
|
|
* ``ansible_user``: Name of user within the jail to execute as.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Local
|
|
|
|
|
~~~~~
|
|
|
|
|
|
|
|
|
|
Behaves like `local
|
|
|
|
|
<https://docs.ansible.com/ansible/2.5/plugins/connection/local.html>`_ except
|
|
|
|
|
connection delegation is supported.
|
|
|
|
|
|
|
|
|
|
* ``ansible_python_interpreter``
|
|
|
|
|
* ``ansible_sudo_exe``, ``ansible_become_exe``
|
|
|
|
|
* ``ansible_sudo_user``, ``ansible_become_user`` (default: ``root``)
|
|
|
|
|
* ``ansible_sudo_pass``, ``ansible_become_pass`` (default: assume passwordless)
|
|
|
|
|
* ``sudo_flags``, ``become_flags``
|
|
|
|
|
* ansible.cfg: ``timeout``
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
LXC
|
|
|
|
|
~~~
|
|
|
|
|
|
|
|
|
|
Behaves like `lxc
|
|
|
|
|
<https://docs.ansible.com/ansible/2.5/plugins/connection/lxc.html>`_ and `lxd
|
|
|
|
|
<https://docs.ansible.com/ansible/2.5/plugins/connection/lxd.html>`_ except
|
|
|
|
|
connection delegation is supported, and the ``lxc-attach`` tool is always used
|
|
|
|
|
rather than the LXC Python bindings, as is usual with the ``lxc`` method.
|
|
|
|
|
|
|
|
|
|
The ``lxc-attach`` command must be available on the host machine.
|
|
|
|
|
|
|
|
|
|
* ``ansible_python_interpreter``
|
|
|
|
|
* ``ansible_host``: Name of LXC container (default: inventory hostname).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
.. _setns:
|
|
|
|
|
|
|
|
|
|
Setns
|
|
|
|
|
~~~~~
|
|
|
|
|
|
|
|
|
@ -503,6 +563,32 @@ root process.
|
|
|
|
|
as ``/bin/machinectl``.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
.. _sudo:
|
|
|
|
|
|
|
|
|
|
Sudo
|
|
|
|
|
~~~~
|
|
|
|
|
|
|
|
|
|
Sudo can be used as a connection method that supports connection delegation, or
|
|
|
|
|
as a become method.
|
|
|
|
|
|
|
|
|
|
When used as a become method:
|
|
|
|
|
|
|
|
|
|
* ``ansible_python_interpreter``
|
|
|
|
|
* ``ansible_sudo_exe``, ``ansible_become_exe``
|
|
|
|
|
* ``ansible_sudo_user``, ``ansible_become_user`` (default: ``root``)
|
|
|
|
|
* ``ansible_sudo_pass``, ``ansible_become_pass`` (default: assume passwordless)
|
|
|
|
|
* ``sudo_flags``, ``become_flags``
|
|
|
|
|
* ansible.cfg: ``timeout``
|
|
|
|
|
|
|
|
|
|
When used as the ``mitogen_sudo`` connection method:
|
|
|
|
|
|
|
|
|
|
* The inventory hostname is ignored, and may be any value.
|
|
|
|
|
* ``ansible_user``: username to sudo as.
|
|
|
|
|
* ``ansible_password``: password to sudo as.
|
|
|
|
|
* ``sudo_flags``, ``become_flags``
|
|
|
|
|
* ``ansible_python_interpreter``
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SSH
|
|
|
|
|
~~~
|
|
|
|
|
|
|
|
|
@ -520,42 +606,6 @@ connection delegation is supported.
|
|
|
|
|
* ``ssh_args``, ``ssh_common_args``, ``ssh_extra_args``
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
FreeBSD Jails
|
|
|
|
|
~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
Behaves like `jail
|
|
|
|
|
<https://docs.ansible.com/ansible/2.5/plugins/connection/jail.html>`_ except
|
|
|
|
|
connection delegation is supported.
|
|
|
|
|
|
|
|
|
|
* ``ansible_host``: Name of jail (default: inventory hostname).
|
|
|
|
|
* ``ansible_user``: Name of user within the jail to execute as.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Local
|
|
|
|
|
~~~~~
|
|
|
|
|
|
|
|
|
|
Behaves like `local
|
|
|
|
|
<https://docs.ansible.com/ansible/2.5/plugins/connection/local.html>`_ except
|
|
|
|
|
connection delegation is supported.
|
|
|
|
|
|
|
|
|
|
* ``ansible_python_interpreter``
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
LXC
|
|
|
|
|
~~~
|
|
|
|
|
|
|
|
|
|
Behaves like `lxc
|
|
|
|
|
<https://docs.ansible.com/ansible/2.5/plugins/connection/lxc.html>`_ and `lxd
|
|
|
|
|
<https://docs.ansible.com/ansible/2.5/plugins/connection/lxd.html>`_ except
|
|
|
|
|
conncetion delegation is supported, and the ``lxc-attach`` tool is always used
|
|
|
|
|
rather than the LXC Python bindings, as is usual with the ``lxc`` method.
|
|
|
|
|
|
|
|
|
|
The ``lxc-attach`` command must be available on the host machine.
|
|
|
|
|
|
|
|
|
|
* ``ansible_python_interpreter``
|
|
|
|
|
* ``ansible_host``: Name of LXC container (default: inventory hostname).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Debugging
|
|
|
|
|
---------
|
|
|
|
|
|
|
|
|
|