summaryrefslogtreecommitdiff
path: root/ansible/roles/trove-setup/tasks/known-hosts-setup.yml
diff options
context:
space:
mode:
Diffstat (limited to 'ansible/roles/trove-setup/tasks/known-hosts-setup.yml')
-rw-r--r--ansible/roles/trove-setup/tasks/known-hosts-setup.yml19
1 files changed, 12 insertions, 7 deletions
diff --git a/ansible/roles/trove-setup/tasks/known-hosts-setup.yml b/ansible/roles/trove-setup/tasks/known-hosts-setup.yml
index a8d18f7..b3e268a 100644
--- a/ansible/roles/trove-setup/tasks/known-hosts-setup.yml
+++ b/ansible/roles/trove-setup/tasks/known-hosts-setup.yml
@@ -1,10 +1,15 @@
# Depends on:
# - check.yml
+# Uses sshknownhosts module from:
+# https://github.com/bfmartin/ansible-sshknownhosts
---
-# If UPSTREAM_TROVE is not defined, the jinja2 'default' filter will
-# replace it with an empty string. ssh-keyscan skips empty hostnames,
-# so it will run only with 'localhost'
-- name: Add localhost and UPSTREAM_TROVE to /etc/ssh/ssh_known_hosts
- shell: |
- ssh-keyscan localhost {{ UPSTREAM_TROVE|default('')|quote }} > /etc/ssh/ssh_known_hosts
- creates=/etc/ssh/ssh_known_hosts
+- name: Add localhost to /etc/ssh/ssh_known_hosts
+ sshknownhosts: host=localhost state=present
+
+# We avoid trying to scan UPSTREAM_TROVE's host keys unless the user explicitly
+# configured Lorry Controller to access it over SSH. It's possible that the
+# Trove is behind a proxy that blocks SSH traffic, and if this step fails then
+# the whole trove-setup.service will fail.
+- name: Add {{ UPSTREAM_TROVE }} to /etc/ssh/ssh_known_hosts
+ sshknownhosts: host={{ UPSTREAM_TROVE }} state=present
+ when: UPSTREAM_TROVE_PROTOCOL == ssh