Ansible - 如何在没有“主机真实性”提示的情况下通过 ssh 进入实例？

Question

我正在使用 ansible 创建几个 ec2 实例，将文件复制到那些新创建的服务器并在这些服务器上运行命令。问题是创建服务器后，我仍然需要在以下 ssh 提示符中输入 yes：

TASK [Adding /etc/rc.local2 to consul servers] *********************************
changed: [localhost -> 172.31.52.147] => (item={u'ip': u'172.31.52.147', u'number': 0})
The authenticity of host '172.31.57.20 (172.31.57.20)' can't be established.
ECDSA key fingerprint is 5e:c3:2e:52:10:29:1c:44:6f:d3:ac:10:78:10:01:89.
Are you sure you want to continue connecting (yes/no)? yes
changed: [localhost -> 172.31.57.20] => (item={u'ip': u'172.31.57.20', u'number': 1})
The authenticity of host '172.31.57.19 (172.31.57.19)' can't be established.
ECDSA key fingerprint is 4e:71:15:fe:c9:ec:3f:54:65:e8:a1:66:74:92:f4:ff.
Are you sure you want to continue connecting (yes/no)? yes

我怎样才能让 ansible 忽略此提示并自动回答是？以下是我的剧本供参考：

---
- hosts: localhost
  connection: local
  gather_facts: false
  sudo: yes

  vars_files:
    - ami-keys.yml
    - ami-image.yml    

  tasks:

    - name: create 3 consul servers
      ec2:
         aws_access_key: '{{ aws_access_key }}'
         aws_secret_key: '{{ aws_secret_key }}'
         key_name: terra
         group: default
         instance_type: t2.micro
         image: '{{ ami }}'
         region: '{{ region }}'
         wait: true
         exact_count: 3
         count_tag:
            Name: consul-server
         instance_tags:
            Name: consul-server
      register: ec2


    - name: Wait for SSH to come up
      wait_for: host={{ item }} port=22 delay=1 timeout=480 state=started
      with_items:
        - "{{ ec2['tagged_instances'][0]['private_ip'] }}"
        - "{{ ec2['tagged_instances'][1]['private_ip'] }}"
        - "{{ ec2['tagged_instances'][2]['private_ip'] }}"

    # shows the json data for the instances created
    - name: consul server ec2 instance json data
      debug:
       msg: "{{ ec2['tagged_instances'] }}"

    # bootstrapping
    - name: Adding /etc/rc.local2 to consul servers
      template:
       src: template/{{ item.number }}.sh
       dest: /etc/rc.local2
      delegate_to: "{{ item.ip }}"
      with_items:
        - ip: "{{ ec2['tagged_instances'][0]['private_ip'] }}"
          number: 0
        - ip: "{{ ec2['tagged_instances'][1]['private_ip'] }}"
          number: 1
        - ip: "{{ ec2['tagged_instances'][2]['private_ip'] }}" 
          number: 2
      ignore_errors: true

    - name: give /etc/rc.local2 permissions to run and starting swarm
      shell: "{{ item[1] }}"
      delegate_to: "{{ item[0] }}"
      with_nested:
       - [ "{{ ec2['tagged_instances'][0]['private_ip'] }}", 
           "{{ ec2['tagged_instances'][1]['private_ip'] }}", 
           "{{ ec2['tagged_instances'][2]['private_ip'] }}" ]
       - [ "sudo chmod +x /etc/rc.local2",
           "sleep 10",
           "consul reload",
           "docker run --name swarm-manager -d -p 4000:4000 --restart=unless-stopped \
           swarm manage -H :4000 \
           --replication --advertise \
           $(hostname -i):4000 \
           consul://$(hostname -i):8500" ]
      ignore_errors: true

注意：我已经试过运行了：

ansible-playbook -e 'host_key_checking=False' consul-server.yml

它不会删除提示。

进入/etc/ansible/ansible.cfg 并取消注释host_key_checking=False 行确实会删除提示，但是我想避免这样做，而是在我运行我的剧本时在我的剧本或命令行中输入一些内容。

Answer 1

常见的建议是在 Ansible 配置中设置 host_key_checking=False。这是一个坏主意，因为它假定您的网络连接永远不会受到威胁。

在您首次创建服务器时仅假设网络不是 MitMed 的更好方法是使用 ssh-keyscan 将服务器的指纹添加到已知主机文件中：

- name: accept new ssh fingerprints                                         
    shell: ssh-keyscan -H {{ item.public_ip }} >> ~/.ssh/known_hosts          
    with_items: '{{ ec2.instances }}'