Ansible: how to run a play with hosts with different passwords?

ONLINECAST

2 min read

·

07-10-2024

5

0

Share

Ansible: Running Plays with Diverse Host Passwords

Problem: You need to run an Ansible play on multiple hosts, each with a unique password. This can be tricky, as Ansible typically relies on a single password for all hosts.

Solution: There are several approaches to handling different host passwords in Ansible:

1. Using Vault:

• Concept: Ansible Vault allows you to encrypt sensitive information, including passwords, within your playbook.
• Implementation:
  • Create a vault file: Use ansible-vault encrypt to create a vault file containing all your host passwords.
  • Reference the vault: In your playbook, reference the vault file using the vault: directive.
  • Decrypt at runtime: Ansible will prompt for the vault password at runtime, allowing you to securely decrypt the passwords for each host.

Example:

---
- hosts: all
  become: true
  vars_files:
    - vault.yml
  tasks:
    - name: Install package
      package:
        name: nginx
        state: present
      become: true

• Where:
  • vault.yml is the name of your vault file.
  • become: true ensures that the tasks are run with elevated privileges.

2. Dynamic Inventory with Custom Script:

• Concept: Instead of relying on a static inventory file, you can create a custom script that dynamically generates an inventory based on your needs. This script can fetch host information, including passwords, from various sources like a database or configuration file.
• Implementation:
  • Create a custom script: Write a script that gathers host information and generates an inventory in the format expected by Ansible.
  • Configure Ansible: Set the inventory parameter in your Ansible configuration file to point to your custom script.

Example:

#!/usr/bin/env python3

import json

hosts = {
    "host1": {
        "ansible_host": "192.168.1.1",
        "ansible_port": 22,
        "ansible_user": "user1",
        "ansible_password": "password1"
    },
    "host2": {
        "ansible_host": "192.168.1.2",
        "ansible_port": 22,
        "ansible_user": "user2",
        "ansible_password": "password2"
    }
}

print(json.dumps(hosts))

• Where: This Python script outputs JSON data, representing the inventory format.
• Configuration:
  • In your Ansible configuration file, set inventory to point to this script.

3. Host-specific Variables:

• Concept: Utilize Ansible's host-specific variables to define individual passwords for each host.
• Implementation:
  • Define variables: Create a variable file (e.g., host_vars/hostname.yml) for each host, and define the ansible_password variable within it.
  • Include the variables: In your playbook, use the include_vars directive to include these host-specific variable files.

Example:

host_vars/host1.yml

ansible_password: password1

host_vars/host2.yml

ansible_password: password2

Playbook:

---
- hosts: all
  become: true
  tasks:
    - name: Install package
      package:
        name: nginx
        state: present
      become: true
    - include_vars:
        file: "{{ ansible_hostname }}.yml"

Considerations:

• Security: While all methods offer ways to manage passwords, remember that storing passwords in plain text is inherently risky. Encrypt your vault file, use strong passwords, and follow best practices for secure password management.
• Scalability: Dynamic Inventory becomes essential when managing a large number of hosts, especially if their credentials change frequently.

Additional Value:

• Alternative Methods: Explore other methods like using SSH keys or leveraging third-party tools for managing credentials if your environment requires advanced authentication.
• Automation: Integrate the chosen approach into your existing automation workflows, leveraging Ansible's powerful features for managing your infrastructure effectively.

By carefully choosing the right method and implementing secure practices, you can effectively manage and execute Ansible plays on hosts with diverse passwords, ensuring seamless automation and efficient infrastructure management.