无法使用 ansible authorized_key 模块将 public 密钥添加到目标主机

Question

我可以完全访问 ServerA（单服务器）[IP: 142.5.5.55]，我有我的 public 密钥 /app/serverA/mw.pub。这个服务器有 ansible 从哪里我运行我的自动化。
我从 ansible ServerA 无密码连接到 3 个服务器 [IP: 11.1.1.220, 11.1.1.221, 11.1.1.222]，我们称这 3 个服务器为 jump_nodes
最后，我有一个叫做目标主机 [IP: 192.0.0.200, 192.0.0.201, 192.0.0.202] 的东西，我们将其命名为 dest_nodes 我们希望在其中注入 public 键 mw.pub。只有 jump_nodes 可以连接到 dest_nodes。

因此：

ServerA(ansible) ---------------------> jump_nodes --------------------> dest_nodes 
                  copy to ~/mw.pub               inject ~/mw.pub

我可以使用下面的剧本将我的 public 密钥 mw.pub 复制到 ~/mw.pub 下的所有 jump_nodes。

一切正常，但以下是失败的地方：

我现在希望将 ~/mw.pub 从跳转服务器注入目标主机，即 dest_nodes 曾经有过连接。

我的剧本：

---

- name: "Play 1"
  hosts: localhost
  gather_facts: false
  tags: always
  tasks:
    - name: Add host
      debug:
        msg: " hello "
    - set_fact:
        jump_server_list: "{{ JUMP_SERVER | trim }}"
    - set_fact:
        target_server_list: "{{ TARGET_SERVER | trim }}"

    - add_host:
        hostname: "{{ item }}"
        groups: jump_nodes
      with_items: "{{ jump_server_list.split('\n') }}"

    - add_host:
        hostname: "{{ item }}"
        groups: dest_nodes
      with_items: "{{ target_server_list.split('\n') }}"

- name: "Play 2"
  hosts: dest_nodes
  user: root
  ignore_unreachable: yes
  vars:
    ansible_ssh_extra_args: -o StrictHostKeyChecking=no
    ansible_ssh_private_key_file: /app/id_rsa

  gather_facts: true

  tasks:
    - name: Copy ssh public key to a file on jump servers
      raw: "echo {{ TARGET_KEY }}>~/mw.pub"
      run_once: True
      delegate_to: "{{ item }}"
      with_items: "{{ groups['jump_nodes'] }}"

    - name: Set authorized key taken from file
      ignore_errors: yes
      authorized_key:
        user: "{{ TARGET_USER }}"
        state: present
        key: "{{ lookup('file', '~/mw.pub') }}"
      register: keystatus
      delegate_to: "{{ item }}"
      with_items: "{{ groups['jump_nodes'] }}"

    - debug:
        msg: "CHECK STATUS {{ keystatus }}"
      ignore_errors: yes

输出：

TASK [Copy ssh public key to a file on jump servers] *******************************************************************************************************************
task path: /app/injectkeys/injectsshkeys.yml:40
<11.1.1.220> ESTABLISH SSH CONNECTION FOR USER: root
<11.1.1.220> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o 'IdentityFile="/app/id_rsa"' -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="root"' -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o ControlPath=/home/axmwapp/.ansible/cp/42c5d2e05f -tt 11.1.1.220 'echo ssh-rsa PPPPB3NzaC1yc2EPPPPDAQABAAABAQDQGeUOA0vJK1AXSp3UKK1KF4VnFzmcrCoM4Ha7jx49DGPkGuNgS4ZKYYGiAl7FDhwtysvUF6JSl1l3Gxrki3nLDmGYUHbzNCU0qghOw85gbr++W+b+VfEZEnzTE8VPjAgR/JvQItLd2F8PGGlZBwDUXOIvuw8Acqft0nErDkPkKApJcn302qHtOc9R1mFff/GuD6WL6gjPF0gZsEkxHq+FObdsuUzndon0SR3SPeoF/oKA2CVy15+ea6wZnAYqCCppbdgZYR9uSZlMnvwMGT2g3Au+kL2dls3aRYQm6ZH0IrOpfn8M+BaPCcpWppE64XSPZlkU+3mIe2riG4IyIE75 it@shop.com>~/mw.pub'
<11.1.1.220> (0, '', 'Shared connection to 11.1.1.220 closed.\r\n')
changed: [192.0.0.200 -> 11.1.1.220] => (item=11.1.1.220) => {
    "ansible_loop_var": "item",
    "changed": true,
    "item": "11.1.1.220",
    "rc": 0,
    "stderr": "Shared connection to 11.1.1.220 closed.\r\n",
    "stderr_lines": [
        "Shared connection to 11.1.1.220 closed."
    ],
    "stdout": "",
    "stdout_lines": []
}

TASK [Set authorized key taken from file] ******************************************************************************************************************************
task path: /app/injectkeys/injectsshkeys.yml:46
[WARNING]: Unable to find '~/mw.pub' in expected paths (use -vvvvv to see paths)

fatal: [192.0.0.200]: FAILED! => {
    "msg": "An unhandled exception occurred while running the lookup plugin 'file'. Error was a <class 'ansible.errors.AnsibleError'>, original message: could not locate file in lookup: ~/mw.pub"
}
...ignoring

TASK [debug] ***********************************************************************************************************************************************************
task path: /app/injectkeys/injectsshkeys.yml:57
ok: [192.0.0.200] => {
    "msg": "CHECK STATUS {'msg': u\"An unhandled exception occurred while running the lookup plugin 'file'. Error was a <class 'ansible.errors.AnsibleError'>, original message: could not locate file in lookup: ~/mw.pub\", 'failed': True}"
}
META: ran handlers
META: ran handlers

下面是我运行剧本

ansible-playbook /app/injectkeys/injectsshkeys.yml -f 5 -e JUMP_SERVER='11.1.1.220' -e TARGET_SERVER='192.0.0.200' -e TARGET_USER='root' -e TARGET_KEY="'ssh-rsa PPPPB3NzaC1yc2EPPPPDAQABAAABAQDQGeUOA0vJK1AXSp3UKK1KF4VnFzmcrCoM4Ha7jx49DGPkGuNgS4ZKYYGiAl7FDhwtysvUF6JSl1l3Gxrki3nLDmGYUHbzNCU0qghOw85gbr++W+b+VfEZEnzTE8VPjAgR/JvQItLd2F8PGGlZBwDUXOIvuw8Acqft0nErDkPkKApJcn302qHtOc9R1mFff/GuD6WL6gjPF0gZsEkxHq+FObdsuUzndon0SR3SPeoF/oKA2CVy15+ea6wZnAYqCCppbdgZYR9uSZlMnvwMGT2g3Au+kL2dls3aRYQm6ZH0IrOpfn8M+BaPCcpWppE64XSPZlkU+3mIe2riG4IyIE75 it@shop.com'" -vvv

正如您从输出中看到的，它正在 dest_nodes 上寻找 ~/mw.pub，尽管 delegate_to: jump_nodes 即它在 dest_nodes 192.0 上寻找 ~/mw.pub .0.200 当它应该在它存在的 11.1.1.220 上查找然后在 192.0.0.200 上注入它时。

你能建议我如何解决这个问题吗？

Answer 1

来自 lookup plugins

上的文档

Like all templating, these plugins are evaluated on the Ansible control machine, not on the target/remote.

所以它实际上不是在目标主机上而是在控制器上查找。

如果您需要从目标获取文件，您将不得不使用fetch prior to lookup the local copy or slurp将内容放入变量中。

无法使用 ansible authorized_key 模块将 public 密钥添加到目标主机

Unable to add public key to target host using ansible authorized_key module

ssh

ssh-keys

authorized-keys

ansible