0

Ansible playbook via Jenkins job

For my CI/CD pipeline, I'm using Jenkins to execute an Ansible playbook using the Ansible plugin. Jenkins and ansible are running on the same GCP instance (Debian 10). Ansible is running the playbook against another GCP instance (Also Debian 10) via the private network. When I run the playbook manually using my default GCP user, everything works flawlessly. However, when Jenkins is trying to run the playbook or when I'm running the playbook manually as the jenkins user, playbook execution hangs whenever become is set to yes.

Ansible stdout

22m 19s
[WindBox_main@2] $ ansible-playbook ./ansible/playbook.yml -i ./ansible/hosts

PLAY [all] *********************************************************************

TASK [Gathering Facts] *********************************************************
ok: [10.156.0.2]

TASK [docker_stack : Ping host] ************************************************
ok: [10.156.0.2]

TASK [docker_stack : Ping host with become] ************************************

I have the ansible become password stored in a vars file (I know, it should be in the vault), and I verified that ansible is able to access this variable. The private key used by ansible to establish an ssh connection has the same owner and group as the vars file and ssh connection is not a problem.

Manually establishing an ssh connection with the jenkins user and private key works as expected, so does the sudo command when logged in as the ansible-cicd user.

Initial research has pointed me towards this post, stating that the process running on the remote host might be waiting for user input, this does not seem likely as this is not happening when running as my default user. I assume that remotely everything is running as the ansible-cicd user, as specified in the hosts file.

I assume it is some sort of permission problem. It does not look like it's any of the files mentioned below. Is there something I am missing? Does ansible's become require local sudo access?

Any help would be greatly appreciated.

Files

hosts

[dockermanager]
10.156.0.2 ansible_user=ansible-cicd ansible_ssh_private_key_file=/var/lib/jenkins/.ssh/id_rsa

[dockermanager:vars]
ansible_python_interpreter=/usr/bin/python3
ansible_connection=ssh

playbook.yml

---

- hosts: all

  vars:
    ansible_python_interpreter: /usr/bin/python3
    ansible_connection: local
  vars_files:
    - /etc/ansible/secrets.yml
  roles:
  - docker_stack

roles/docker_stack/main.yml (shortened for brevity, but these are the first 2 steps)

---

- name: Ping host
  ansible.builtin.ping:

- name: Ping host with become
  ansible.builtin.ping:
  become: yes

/var/lib/jenkins/.ssh/

total 20
drwx------  2 jenkins jenkins 4096 Nov 23 22:12 .
drwxr-xr-x 26 jenkins jenkins 4096 Nov 25 15:27 ..
-rw-------  1 jenkins jenkins 1831 Nov 25 15:19 id_rsa
-rw-r--r--  1 jenkins jenkins  405 Nov 25 15:19 id_rsa.pub
-rw-r--r--  1 jenkins jenkins  666 Nov 25 15:13 known_hosts

/etc/ansible/

total 16
drwxr-xr-x  2 ansible ansible 4096 Nov 24 13:42 .
drwxr-xr-x 80 root    root    4096 Nov 25 15:09 ..
-rw-r--r--  1 jenkins jenkins   62 Nov 24 13:42 secrets.yml
2
  • 1
    Hi Fabian welcome to SO. You asked about "local sudo" but your playbook has ansible_connection: local so it is likely not using the ansible_connection=ssh from your inventory as shown in the variable precedence docs. I would at least recommend removing that from the vars: block. Good luck Commented Nov 25, 2021 at 18:25
  • Amazing, thank you so much. Removing the ansible_connection: local solved it. That also explains all the strange behaviour. Commented Nov 25, 2021 at 19:08

1 Answer 1

0

As mentioned by @mdaniel in the comments, the ansible_connection variable was defined twice (in hosts and in playbook) and ssh was overridden by local, meaning ansible never actually connected to my remote machine.

Removing ansible_collection: local from the playbook vars solved the problem.

Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.