How to run Ansible-Playbook from Gitlab-CI?

Question

I am trying to create a pipeline in Gitlab-ci to run an ansible-playbook. Here is my .gitlab-ci.yml file:

    image: "my_ansible_image"
    
    before_script:
        - eval $(ssh-agent -s)
        - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
        - mkdir -p ~/.ssh
        - chmod 700 ~/.ssh    
    
    build:
        script:
          - ansible-playbook -i inventory -u root --private-key "$SSH_PRIVATE_KEY" playbook.yml -vv

The playbook is trying to execute a simple ping module:

---
   - name: Ping test ## name of the first task
     ping:  ##ping is a special case that do not requieres any attributs

From some reason the ssh connection is always failing with following error:

$ ansible-playbook -i inventory -u root --private-key /builds/my_name/rhe7_set-up-rpm/private_key playbook.yml -vv
[WARNING]: Ansible is being run in a world writable directory
(/builds/aramniko/rhe7_set-up-rpm), ignoring it as an ansible.cfg source. For
more information see
https://docs.ansible.com/ansible/devel/reference_appendices/config.html#cfg-in-
world-writable-dir
ansible-playbook 2.9.11
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.8/site-packages/ansible
  executable location = /usr/local/bin/ansible-playbook
  python version = 3.8.3 (default, Jul 26 2020, 02:36:32) [GCC 9.2.0]
No config file found; using defaults
PLAYBOOK: playbook.yml *********************************************************
1 plays in playbook.yml
PLAY [Set-UP] ******************************************************************
TASK [Gathering Facts] *********************************************************
task path: /builds/my_name/rhe7_set-up-rpm/playbook.yml:2
fatal: [XXXXXXXXX]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: Warning: Permanently added 'XXXXXXXX' (ECDSA) to the list of known hosts.\r\nno such identity: /builds/my_name/rhe7_set-up-rpm/private_key: No such file or directory\r\nroot@XXXXXXXXXX: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).", "unreachable": true}
PLAY RECAP *********************************************************************
XXXXXXXXXXX               : ok=0    changed=0    unreachable=1    failed=0    skipped=0    rescued=0    ignored=0 

How can i solve this issue?

EDIT Solution was to add the following to before_script:

        - ssh-keyscan DNS/Remote_IP
        - echo "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
        - chmod 644 ~/.ssh/known_hosts

Phenylalanine

Answer 1

You should verify your host keys by running ssh-keyscan on the private server and copying the results to a GitLab variable called SSH_KNOWN_HOSTS. In your pipeline you need to copy that to the ~/.ssh/known_hosts file in the pipeline environment. Instructions are here: https://docs.gitlab.com/ee/ci/ssh_keys/#verifying-the-ssh-host-keys.

On a side note, you should consider creating a secure directory to store your config file in. See: https://docs.ansible.com/ansible/latest/reference_appendices/config.html

Tacket

Hi @DV82XL, the ssh key are created localy and saved in ENV_VAR "$SSH_PRIVATE_KEY". The issue here is that it is coming from docker container and a new IP that host does not know. – Phenylalanine

Right. Sorry @Andrew Ramnikov. I added some info regarding known_hosts file. Are you currently setting this up? If not, that's probably the issue. Let me know if that fixes your problem. – Tacket

Worked ... many thanks. I edit my question above on how to set it correctly. – Phenylalanine

Answer 2

An easier option is just creating an ansible.cfg file and add those configs and others like remote_user, inventory, private_key_file etc..

#ansible.cfg
[defaults]
host_key_checking = False

Astyanax

Answer 3

No need to create ansible.cfg file, just add ANSIBLE_HOST_KEY_CHECKING global variable in your .gitlab-ci.yml file:

variables:
  ANSIBLE_HOST_KEY_CHECKING: "False"

or in the build job:

    build:
        variables:
          ANSIBLE_HOST_KEY_CHECKING: "False"
        script:
          - ansible-playbook -i inventory -u root --private-key "$SSH_PRIVATE_KEY" playbook.yml -vv

Ziegfeld