The ability to use “jump hosts” with Ansible is another often-requested
feature. This has been discussed repeatedly on the
mailing list
and
on Stackoverflow,
has had a number of
howto
articles
written about it, and
multiple
independent
implementations
have been submitted as pull requests to Ansible.
The recommended solution was to set a ProxyCommand in
~/.ssh/config. This meant duplicating inventory data and
keeping two sources of connection information in sync. It worked, but
grew rapidly less manageable with a larger inventory. Similarly, the
ssh_config inventory plugin was a makeshift solution at best.
This post describes the general mechanism provided in Ansible 2 (not yet
released) to make SSH configuration changes—including jump hosts—without
depending on any data external to Ansible.
SSH configuration
The ssh_args setting in the ssh_connection section
of ansible.cfg is a global setting whose contents are prepended
to every command-line for ssh/scp/sftp. This behaviour has been retained
unmodified for backwards compatibility, but I don't recommend its use,
because it overrides the default persistence settings.
In addition to the above, the new ansible_ssh_common_args
inventory variable is appended to every command-line for
ssh/scp/sftp. This can be set in the inventory (for a group or a host)
or in a playbook (for a play, or block, or task). This is the place to
configure any ProxyCommand you want to use.
[gatewayed_hosts:vars]
ansible_ssh_common_args='-o ProxyCommand="ssh -W %h:%p someuser@jumphost.example.com"'
In addition to that, the new ansible_ssh_extra_args
variable is appended only to command-lines for ssh. There are analogous
ansible_scp_extra_args and ansible_sftp_extra_args
variables to change scp and sftp command-lines. This allows you to do
truly odd things like open a reverse-tunnel to the control node with
-R (which is an option only ssh accepts, not scp or sftp).
The --ssh-common-args command-line option is useful when
debugging (there's also --ssh-extra-args,
--scp-extra-args, and --sftp-extra-args). Note that
any values you set on the command-line will be overriden by the
inventory or playbook settings described above (which seems backwards,
but that's how Ansible handles other command-line options too).
Also note that
ansible_user, ansible_host, and ansible_port
are now preferred to the old ansible_ssh_* versions.
Internal changes
Once again, the modest user-visible changes are accompanied by major
changes internally. The
SSH connection plugin was rewritten
to be more maintainable, and an entire class of “my connection just
hangs” and other bugs (especially around privilege escalation) were
fixed in the process.