diff options
Diffstat (limited to 'ansible/roles/trove-setup/tasks/known-hosts-setup.yml')
-rw-r--r-- | ansible/roles/trove-setup/tasks/known-hosts-setup.yml | 19 |
1 files changed, 12 insertions, 7 deletions
diff --git a/ansible/roles/trove-setup/tasks/known-hosts-setup.yml b/ansible/roles/trove-setup/tasks/known-hosts-setup.yml index a8d18f7..b3e268a 100644 --- a/ansible/roles/trove-setup/tasks/known-hosts-setup.yml +++ b/ansible/roles/trove-setup/tasks/known-hosts-setup.yml @@ -1,10 +1,15 @@ # Depends on: # - check.yml +# Uses sshknownhosts module from: +# https://github.com/bfmartin/ansible-sshknownhosts --- -# If UPSTREAM_TROVE is not defined, the jinja2 'default' filter will -# replace it with an empty string. ssh-keyscan skips empty hostnames, -# so it will run only with 'localhost' -- name: Add localhost and UPSTREAM_TROVE to /etc/ssh/ssh_known_hosts - shell: | - ssh-keyscan localhost {{ UPSTREAM_TROVE|default('')|quote }} > /etc/ssh/ssh_known_hosts - creates=/etc/ssh/ssh_known_hosts +- name: Add localhost to /etc/ssh/ssh_known_hosts + sshknownhosts: host=localhost state=present + +# We avoid trying to scan UPSTREAM_TROVE's host keys unless the user explicitly +# configured Lorry Controller to access it over SSH. It's possible that the +# Trove is behind a proxy that blocks SSH traffic, and if this step fails then +# the whole trove-setup.service will fail. +- name: Add {{ UPSTREAM_TROVE }} to /etc/ssh/ssh_known_hosts + sshknownhosts: host={{ UPSTREAM_TROVE }} state=present + when: UPSTREAM_TROVE_PROTOCOL == ssh |