From 276c4507591195529785181a2a30df9a4aa3d4e5 Mon Sep 17 00:00:00 2001 From: bozzo Date: Thu, 25 Jun 2020 17:14:38 +0200 Subject: [PATCH] Use `connection: local` when `delegate_to: localhost` (#6322) This will avoid SSH connection on the local host --- roles/bastion-ssh-config/tasks/main.yml | 2 ++ roles/download/tasks/download_container.yml | 1 + roles/download/tasks/download_file.yml | 1 + roles/download/tasks/prep_download.yml | 3 +++ roles/kubernetes/client/tasks/main.yml | 3 +++ roles/kubernetes/preinstall/tasks/0030-pre_upgrade.yml | 3 +++ roles/kubernetes/preinstall/tasks/0090-etchosts.yml | 1 + roles/kubespray-defaults/tasks/fallback_ips.yml | 1 + roles/kubespray-defaults/tasks/fallback_ips_gather.yml | 1 + roles/kubespray-defaults/tasks/no_proxy.yml | 1 + scripts/collect-info.yaml | 1 + tests/cloud_playbooks/delete-aws.yml | 1 + 12 files changed, 19 insertions(+) diff --git a/roles/bastion-ssh-config/tasks/main.yml b/roles/bastion-ssh-config/tasks/main.yml index 7ea39bbd8..cf558087c 100644 --- a/roles/bastion-ssh-config/tasks/main.yml +++ b/roles/bastion-ssh-config/tasks/main.yml @@ -3,6 +3,7 @@ set_fact: bastion_ip: "{{ hostvars[groups['bastion'][0]]['ansible_host'] | d(hostvars[groups['bastion'][0]]['ansible_ssh_host']) }}" delegate_to: localhost + connection: local # As we are actually running on localhost, the ansible_ssh_user is your local user when you try to use it directly # To figure out the real ssh user, we delegate this task to the bastion and store the ansible_user in real_user @@ -13,6 +14,7 @@ - name: create ssh bastion conf become: false delegate_to: localhost + connection: local template: src: ssh-bastion.conf dest: "{{ playbook_dir }}/ssh-bastion.conf" diff --git a/roles/download/tasks/download_container.yml b/roles/download/tasks/download_container.yml index fbf0831d2..234bf1f95 100644 --- a/roles/download/tasks/download_container.yml +++ b/roles/download/tasks/download_container.yml @@ -25,6 +25,7 @@ stat: path: "{{ image_path_cached }}" delegate_to: localhost + connection: local delegate_facts: no register: cache_image changed_when: false diff --git a/roles/download/tasks/download_file.yml b/roles/download/tasks/download_file.yml index 86727dafc..648f43353 100644 --- a/roles/download/tasks/download_file.yml +++ b/roles/download/tasks/download_file.yml @@ -25,6 +25,7 @@ state: directory recurse: yes delegate_to: localhost + connection: local delegate_facts: false run_once: true become: false diff --git a/roles/download/tasks/prep_download.yml b/roles/download/tasks/prep_download.yml index 34bcaa2b9..8e1d131ca 100644 --- a/roles/download/tasks/prep_download.yml +++ b/roles/download/tasks/prep_download.yml @@ -20,6 +20,7 @@ - name: prep_download | On localhost, check if passwordless root is possible command: "true" delegate_to: localhost + connection: local run_once: true register: test_become changed_when: false @@ -34,6 +35,7 @@ - name: prep_download | On localhost, check if user has access to docker without using sudo shell: "{{ image_info_command_on_localhost }}" delegate_to: localhost + connection: local run_once: true register: test_docker changed_when: false @@ -92,6 +94,7 @@ recurse: yes mode: 0755 delegate_to: localhost + connection: local delegate_facts: no run_once: true become: false diff --git a/roles/kubernetes/client/tasks/main.yml b/roles/kubernetes/client/tasks/main.yml index 663415475..bbb1ce0e0 100644 --- a/roles/kubernetes/client/tasks/main.yml +++ b/roles/kubernetes/client/tasks/main.yml @@ -36,6 +36,7 @@ mode: "0750" state: directory delegate_to: localhost + connection: local become: no run_once: yes when: kubeconfig_localhost @@ -88,6 +89,7 @@ dest: "{{ artifacts_dir }}/admin.conf" mode: 0640 delegate_to: localhost + connection: local become: no run_once: yes when: kubeconfig_localhost @@ -112,4 +114,5 @@ become: no run_once: yes delegate_to: localhost + connection: local when: kubectl_localhost and kubeconfig_localhost diff --git a/roles/kubernetes/preinstall/tasks/0030-pre_upgrade.yml b/roles/kubernetes/preinstall/tasks/0030-pre_upgrade.yml index 9bace42dc..62a863808 100644 --- a/roles/kubernetes/preinstall/tasks/0030-pre_upgrade.yml +++ b/roles/kubernetes/preinstall/tasks/0030-pre_upgrade.yml @@ -3,6 +3,7 @@ stat: path: "{{ inventory_dir }}/../credentials" delegate_to: localhost + connection: local register: old_credential_dir become: no @@ -10,6 +11,7 @@ stat: path: "{{ inventory_dir }}/credentials" delegate_to: localhost + connection: local register: new_credential_dir become: no when: old_credential_dir.stat.exists @@ -19,6 +21,7 @@ args: creates: "{{ inventory_dir }}/credentials" delegate_to: localhost + connection: local become: no when: - old_credential_dir.stat.exists diff --git a/roles/kubernetes/preinstall/tasks/0090-etchosts.yml b/roles/kubernetes/preinstall/tasks/0090-etchosts.yml index 9edab21f5..5b34d2d75 100644 --- a/roles/kubernetes/preinstall/tasks/0090-etchosts.yml +++ b/roles/kubernetes/preinstall/tasks/0090-etchosts.yml @@ -9,6 +9,7 @@ {% endif %} {% endfor %} delegate_to: localhost + connection: local delegate_facts: yes run_once: yes diff --git a/roles/kubespray-defaults/tasks/fallback_ips.yml b/roles/kubespray-defaults/tasks/fallback_ips.yml index 930885a6a..ad8523db8 100644 --- a/roles/kubespray-defaults/tasks/fallback_ips.yml +++ b/roles/kubespray-defaults/tasks/fallback_ips.yml @@ -21,6 +21,7 @@ {{ item }}: "{{ found.get('address', '127.0.0.1') }}" {% endfor %} delegate_to: localhost + connection: local delegate_facts: yes become: no run_once: yes diff --git a/roles/kubespray-defaults/tasks/fallback_ips_gather.yml b/roles/kubespray-defaults/tasks/fallback_ips_gather.yml index c5f5b7427..2d2d000d6 100644 --- a/roles/kubespray-defaults/tasks/fallback_ips_gather.yml +++ b/roles/kubespray-defaults/tasks/fallback_ips_gather.yml @@ -7,4 +7,5 @@ gather_subset: '!all,network' filter: "ansible_default_ipv4" delegate_to: "{{ delegate_host_to_gather_facts }}" + connection: "{{ (delegate_host_to_gather_facts == 'localhost') | ternary('local', omit) }}" delegate_facts: yes diff --git a/roles/kubespray-defaults/tasks/no_proxy.yml b/roles/kubespray-defaults/tasks/no_proxy.yml index 82613882d..01c6e9ddf 100644 --- a/roles/kubespray-defaults/tasks/no_proxy.yml +++ b/roles/kubespray-defaults/tasks/no_proxy.yml @@ -19,6 +19,7 @@ {%- endif -%} 127.0.0.1,localhost,{{ kube_service_addresses }},{{ kube_pods_subnet }} delegate_to: localhost + connection: local delegate_facts: yes become: no run_once: yes diff --git a/scripts/collect-info.yaml b/scripts/collect-info.yaml index 15f1c627f..4c203648e 100644 --- a/scripts/collect-info.yaml +++ b/scripts/collect-info.yaml @@ -133,6 +133,7 @@ dest: "{{ dir|default('.') }}/logs.tar.gz" remove: true delegate_to: localhost + connection: local become: false run_once: true diff --git a/tests/cloud_playbooks/delete-aws.yml b/tests/cloud_playbooks/delete-aws.yml index bffb8c60f..b72caf0ee 100644 --- a/tests/cloud_playbooks/delete-aws.yml +++ b/tests/cloud_playbooks/delete-aws.yml @@ -15,3 +15,4 @@ region: "{{ ansible_ec2_placement_region }}" wait: True delegate_to: localhost + connection: local