Ansible：在动态 ec2 上设置用户

Question

我似乎没有连接到远程主机。为什么不呢？

命令行：ansible-playbook -i "127.0.0.1," -c local playbook.yml

这是剧本。角色 create_ec2_instance 创建在 playbook (ansible/playbook.yml) 的第二部分中使用的变量 ec2hosts：

# Create instance
- hosts: 127.0.0.1
  connection: local
  gather_facts: false
  roles:
    - create_ec2_instance

# Configure and install all we need
- hosts: ec2hosts
  remote_user: admin
  gather_facts: false
  roles:
    - show-hosts
    - prepare-target-system
    - install-project-dependencies
    - install-project

这只是一个简单的 ec2 模块创建。这可以按需要工作。 (ansible/roles/create-ec2-instance/tasks/main.yml)：

- name: Create instance
  ec2:
    region: "{{ instance_values['region'] }}"
    zone: "{{ instance_values['zone'] }}"
    keypair: "{{ instance_values['key_pair'] }}"
    group: "{{ instance_values['security_groups'] }}"
    instance_type: "{{ instance_values['instance_type'] }}"
    image: "{{ instance_values['image_id'] }}"
    count_tag: "{{ instance_values['name'] }}"
    exact_count: 1
    wait: yes
    instance_tags:
      Name: "{{ instance_values['name'] }}"
  when: ec2_instances.instances[instance_values['name']]|default("") == ""
  register: ec2_info

- name: Wait for instances to listen on port 22
  wait_for:
    state: started
    host: "{{ ec2_info.instances[0].public_dns_name }}"
    port: 22
  when: ec2_info|changed

- name: Add new instance to ec2hosts group
  add_host:
    hostname: "{{ ec2_info.instances[0].public_ip }}"
    groupname: ec2hosts
    instance_id: "{{ ec2_info.instances[0].id }}"
  when: ec2_info|changed

我已经包含了额外的透明度方法，尽管这些方法非常基本（ansible/roles/show-hosts/tasks/main.yml）：

- name: List hosts
  debug: msg="groups={{groups}}"
  run_once: true

我们有（ansible/roles/prepare-target-system/tasks/main.yml）：

- name: get the username running the deploy
  local_action: command whoami
  register: username_on_the_host

- debug: var=username_on_the_host

- name: Add necessary system packages
  become: yes
  become_method: sudo
  package: "name={{item}} state=latest"
  with_items:
    - software-properties-common
    - python-software-properties
    - devscripts
    - build-essential
    - libffi-dev
    - libssl-dev
    - vim

编辑：我已经更新到remote_user 上面和下面是错误输出：

TASK [prepare-target-system : debug] *******************************************
task path: <REDACTED>/ansible/roles/prepare-target-system/tasks/main.yml:5
ok: [35.166.52.247] => {
    "username_on_the_host": {
        "changed": true,
        "cmd": [
            "whoami"
        ],
        "delta": "0:00:00.009067",
        "end": "2017-01-07 08:23:42.033551",
        "rc": 0,
        "start": "2017-01-07 08:23:42.024484",
        "stderr": "",
        "stdout": "brianbruggeman",
        "stdout_lines": [
            "brianbruggeman"
        ],
        "warnings": []
    }
}

TASK [prepare-target-system : Ensure that we can update apt-repository] ********
task path: /<REDACTED>/ansible/roles/prepare-target-system/tasks/Debian.yml:2
Using module file <REDACTED>/.envs/dg2/lib/python2.7/site-packages/ansible/modules/core/packaging/os/apt.py
<35.166.52.247> ESTABLISH LOCAL CONNECTION FOR USER: brianbruggeman
<35.166.52.247> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769 `" && echo ansible-tmp-1483799022.33-268449475843769="` echo $HOME/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769 `" ) && sleep 0'
<35.166.52.247> PUT /var/folders/r9/kv1j05355r34570x2f5wpxpr0000gn/T/tmpK2__II TO <REDACTED>/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769/apt.py
<35.166.52.247> EXEC /bin/sh -c 'chmod u+x <REDACTED>/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769/ <REDACTED>/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769/apt.py && sleep 0'
<35.166.52.247> EXEC /bin/sh -c 'sudo -H -S -n -u root /bin/sh -c '"'"'echo BECOME-SUCCESS-owktjrfvqssjrqcetaxjkwowkzsqfitq; /usr/bin/python <REDACTED>/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769/apt.py; rm -rf "<REDACTED>/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769/" > /dev/null 2>&1'"'"' && sleep 0'
failed: [35.166.52.247] (item=[u'software-properties-common', u'python-software-properties', u'devscripts', u'build-essential', u'libffi-dev', u'libssl-dev', u'vim']) => {
    "failed": true,
    "invocation": {
        "module_name": "apt"
    },
    "item": [
        "software-properties-common",
        "python-software-properties",
        "devscripts",
        "build-essential",
        "libffi-dev",
        "libssl-dev",
        "vim"
    ],
    "module_stderr": "sudo: a password is required\n",
    "module_stdout": "",
    "msg": "MODULE FAILURE"
}
  to retry, use: --limit @<REDACTED>/ansible/<redacted playbook>.retry

PLAY RECAP *********************************************************************
127.0.0.1                  : ok=6    changed=2    unreachable=0    failed=0
35.166.52.247              : ok=3    changed=1    unreachable=0    failed=1

Answer 1

使用become:

remote_user: ansible
become: true
become_user: root

Ansible 文档：Become (Privilege Escalation)

例如：在我的脚本中，我以用户“ansible”连接到远程主机（因为 ssh 对 root 禁用），然后成为“root”。很少，我以“ansible”身份连接，然后成为“apache”用户。所以，remote_user 指定要连接的用户名，become_user 是连接后的用户名。

用户 ansible 的 PS 无密码 sudo：

- name: nopasswd sudo for ansible user
  lineinfile: "dest=/etc/sudoers state=present regexp='^{{ ansible_user }}' line='{{ ansible }} ALL=(ALL) NOPASSWD: ALL'"

这是已知的解决方法，请参见此处：Specify sudo password for Ansible