如何从 github 操作运行 ansible playbook - 不使用外部操作

Question

我编写了一个工作流文件，准备运行器使用 ssh 连接到所需的服务器，以便我可以运行 ansible 剧本。

ssh -t -v theUser@theHost 告诉我 SSH 连接有效。

然而，ansible sript 告诉我，缺少 sudo 密码。

如果我离开ssh -t -v theUser@theHost 行，ansible 会抛出连接超时并且无法连接到服务器。

=> fatal: [***]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: ssh: connect to host *** port 22: Connection timed out

首先我不明白，为什么ansible只有执行命令才能连接到服务器ssh -t -v theUser@theHost。

这下一个问题也就是说，用户不需要任何 sudo 密码即可拥有执行权限。相同的 ansible playbook 在我的本地机器上运行良好，无需使用 sudo 密码。我配置了服务器，以便用户递归地在所需文件夹中拥有足够的权限。

它根本不适用于我的 GithHub Action。 你能告诉我我做错了什么吗？

我的工作流程文件如下所示：

name: CI

# Controls when the workflow will run
on:
  # Triggers the workflow on push or pull request events but only for the "master" branch
  push:
    branches: [ "master" ]

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
  
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  run-playbooks:
    runs-on: ubuntu-latest
    steps: 
      - uses: actions/checkout@v3
        with:
          submodules: true
          token: ${{secrets.REPO_TOKEN}}
      - name: Run Ansible Playbook
        run: |
         mkdir -p /home/runner/.ssh/
         touch /home/runner/.ssh/config
         touch /home/runner/.ssh/id_rsa
         echo -e "${{secrets.SSH_KEY}}" > /home/runner/.ssh/id_rsa
         echo -e "Host ${{secrets.SSH_HOST}}\nIdentityFile /home/runner/.ssh/id_rsa" >> /home/runner/.ssh/config 
         ssh-keyscan -H ${{secrets.SSH_HOST}} > /home/runner/.ssh/known_hosts
         cd myproject-infrastructure/ansible
         eval `ssh-agent -s`
         chmod 700 /home/runner/.ssh/id_rsa
         ansible-playbook -u ${{secrets.ANSIBLE_DEPLOY_USER}} -i hosts.yml setup-prod.yml
      

Answer 1

另一种方法是测试并使用actions/run-ansible-playbook 来运行您的剧本，而无需解释为什么会出现这些错误。

这样，您可以测试该配置中是否缺少“sudo Password is missing”。

- name: Run playbook
  uses: dawidd6/action-ansible-playbook@v2
  with:
    # Required, playbook filepath
    playbook: deploy.yml
    # Optional, directory where playbooks live
    directory: ./
    # Optional, SSH private key
    key: ${{secrets.SSH_PRIVATE_KEY}}
    # Optional, literal inventory file contents
    inventory: |
      [all]
      example.com

      [group1]
      example.com
    # Optional, SSH known hosts file content
    known_hosts: .known_hosts
    # Optional, encrypted vault password
    vault_password: ${{secrets.VAULT_PASSWORD}}
    # Optional, galaxy requirements filepath
    requirements: galaxy-requirements.yml
    # Optional, additional flags to pass to ansible-playbook
    options: |
      --inventory .hosts
      --limit group1
      --extra-vars hello=there
      --verbose

Answer 2

终于找到了

动作本身的第一个基本设置。

name: CI

# Controls when the workflow will run
on:
  # Triggers the workflow on push or pull request events but only for the "master" branch
  push:
    branches: [ "master" ]

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:

接下来添加一个作业以在第一步中运行并签出存储库。

jobs:
  run-playbooks:
    runs-on: ubuntu-latest
    steps: 
      - uses: actions/checkout@v3
        with:
          submodules: true
          token: ${{secrets.REPO_TOKEN}}

接下来正确设置 ssh。

   - name: Setup ssh
   shell: bash
        run: |
         service ssh status
         eval `ssh-agent -s`

首先，您要确保 ssh 服务正在运行。就我而言，ssh 服务已经在运行。

但是，当我尝试使用 Docker 时，我必须首先手动启动服务，例如 service ssh start。接下来确保您的用户存在.shh 文件夹，并将您的私钥复制到该文件夹​​。我在我的存储库中添加了一个 github 机密，我在其中保存了我的私钥。就我而言，它是runner 用户。

         mkdir -p /home/runner/.ssh/
         touch /home/runner/.ssh/id_rsa
         echo -e "${{secrets.SSH_KEY}}" > /home/runner/.ssh/id_rsa

确保您的私钥受到保护。如果不是，ssh 服务将不接受使用它。为此：

         chmod 700 /home/runner/.ssh/id_rsa

通常，当您启动 ssh 连接时，系统会询问您是否要将主机永久保存为已知主机。因为我们是自动运行的，所以我们不能输入yes。如果您不回答，该过程将失败。

您必须防止该过程被提示中断。为此，您需要自己将主机添加到 known_hosts 文件中。为此，您使用ssh-keyscan。不幸的是 ssh-keyscan 可以产生不同格式/类型的输出。 在我的情况下，仅使用 ssh-keyscan 是不够的。我必须在命令中添加其他类型选项。生成的输出必须写入用户的.ssh 文件夹中的known_hosts 文件。在我的情况下/home/runner/.ssh/knwon_hosts

所以下一个命令是：

         ssh-keyscan -t rsa,dsa,ecdsa,ed25519 ${{secrets.SSH_HOST}} >> /home/runner/.ssh/known_hosts

现在你快到了。只需调用 ansible playbook 命令即可运行 ansible 脚本。我找到了一个新步骤，将目录更改为存储库中保存我的 ansible 文件的文件夹。

 - name: Run ansible script
        shell: bash 
        run: |
          cd infrastructure/ansible
          ansible-playbook --private-key /home/runner/.ssh/id_rsa -u ${{secrets.ANSIBLE_DEPLOY_USER}} -i hosts.yml setup-prod.yml

完整文件：

name: CI

# Controls when the workflow will run
on:
  # Triggers the workflow on push or pull request events but only for the "master" branch
  push:
    branches: [ "master" ]

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
  
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  run-playbooks:
    runs-on: ubuntu-latest
    steps: 
      - uses: actions/checkout@v3
        with:
          submodules: true
          token: ${{secrets.REPO_TOKEN}}
      - name: Setup SSH 
        shell: bash
        run: |
         eval `ssh-agent -s`
         mkdir -p /home/runner/.ssh/
         touch /home/runner/.ssh/id_rsa
         echo -e "${{secrets.SSH_KEY}}" > /home/runner/.ssh/id_rsa
         chmod 700 /home/runner/.ssh/id_rsa
         ssh-keyscan -t rsa,dsa,ecdsa,ed25519 ${{secrets.SSH_HOST}} >> /home/runner/.ssh/known_hosts
      - name: Run ansible script
        shell: bash 
        run: |
          service ssh status
          cd infrastructure/ansible
          cat setup-prod.yml
          ansible-playbook -vvv --private-key /home/runner/.ssh/id_rsa -u ${{secrets.ANSIBLE_DEPLOY_USER}} -i hosts.yml setup-prod.yml

接下来欣赏...