is an Ansible feature to reduce the number of connections to a host.
Ansible will normally create a temporary directory under
~/.ansible (via ssh), then for each task, copy the module
source to the directory (using sftp or scp) and execute the module (ssh
With pipelining enabled, Ansible will connect only once per task using
ssh to execute python, and write the module source to its stdin. Even
with persistent ssh connections enabled, it's a noticeable improvement
to make only one ssh connection per task.
Unfortunately, pipelining is disabled by default because it is
incompatible with sudo's
requiretty setting (or su, which always requires a tty). This
is because of
a quirk of the Python interpreter,
which enters interactive mode automatically when you pipe in data from a
Update 2015-11-18: I've submitted a pull request to
make pipelining work with requiretty.
The rest of this post still remains true, but if the PR is merged, the
underlying problem will just go away.
Pipelining can be enabled globally by setting “pipelining=True”
in the ssh section of ansible.cfg, or setting
“ANSIBLE_SSH_PIPELINING=1” in the environment.
With Ansible 2 (not yet released), you can also
set ansible_ssh_pipelining in the inventory or in a playbook.
You can leave it enabled in ansible.cfg, but turn it off for
some hosts (where requiretty must remain enabled), or even
write a play with pipelining disabled in order to remove
requiretty from /etc/sudoers.
line: 'Defaults requiretty'
The above lineinfile recipe is simplistic, but it shows that
it's now possible to disable requiretty, even if it's by
replacing /etc/sudoers altogether.
Note the use of another Ansible 2 feature above: vars can also
be set for individual tasks (and
not only plays.
The ability to use “jump hosts” with Ansible is another often-requested
feature. This has been discussed repeatedly on the
has had a number of
written about it, and
have been submitted as pull requests to Ansible.
The recommended solution was to set a ProxyCommand in
~/.ssh/config. This meant duplicating inventory data and
keeping two sources of connection information in sync. It worked, but
grew rapidly less manageable with a larger inventory. Similarly, the
ssh_config inventory plugin was a makeshift solution at best.
This post describes the general mechanism provided in Ansible 2 (not yet
released) to make SSH configuration changes—including jump hosts—without
depending on any data external to Ansible.
The ssh_args setting in the ssh_connection section
of ansible.cfg is a global setting whose contents are prepended
to every command-line for ssh/scp/sftp. This behaviour has been retained
unmodified for backwards compatibility, but I don't recommend its use,
because it overrides the default persistence settings.
In addition to the above, the new ansible_ssh_common_args
inventory variable is appended to every command-line for
ssh/scp/sftp. This can be set in the inventory (for a group or a host)
or in a playbook (for a play, or block, or task). This is the place to
configure any ProxyCommand you want to use.
ansible_ssh_common_args='-o ProxyCommand="ssh -W %h:%p firstname.lastname@example.org"'
In addition to that, the new ansible_ssh_extra_args
variable is appended only to command-lines for ssh. There are analogous
ansible_scp_extra_args and ansible_sftp_extra_args
variables to change scp and sftp command-lines. This allows you to do
truly odd things like open a reverse-tunnel to the control node with
-R (which is an option only ssh accepts, not scp or sftp).
The --ssh-common-args command-line option is useful when
debugging (there's also --ssh-extra-args,
--scp-extra-args, and --sftp-extra-args). Note that
any values you set on the command-line will be overriden by the
inventory or playbook settings described above (which seems backwards,
but that's how Ansible handles other command-line options too).
Also note that
ansible_user, ansible_host, and ansible_port
are now preferred to the old ansible_ssh_* versions.
Once again, the modest user-visible changes are accompanied by major
changes internally. The
SSH connection plugin was rewritten
to be more maintainable, and an entire class of “my connection just
hangs” and other bugs (especially around privilege escalation) were
fixed in the process.