{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/4542","repository_url":"https://api.github.com/repos/ansible/ansible-modules-core","labels_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/4542/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/4542/comments","events_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/4542/events","html_url":"https://github.com/ansible/ansible-modules-core/issues/4542","id":173285755,"number":4542,"title":"`authorized_key` with `delegate_to` not always adding keys to `~/.ssh/authorized_keys`","user":{"login":"zachradtka","id":6179033,"avatar_url":"https://avatars.githubusercontent.com/u/6179033?v=3","gravatar_id":"","url":"https://api.github.com/users/zachradtka","html_url":"https://github.com/zachradtka","followers_url":"https://api.github.com/users/zachradtka/followers","following_url":"https://api.github.com/users/zachradtka/following{/other_user}","gists_url":"https://api.github.com/users/zachradtka/gists{/gist_id}","starred_url":"https://api.github.com/users/zachradtka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zachradtka/subscriptions","organizations_url":"https://api.github.com/users/zachradtka/orgs","repos_url":"https://api.github.com/users/zachradtka/repos","events_url":"https://api.github.com/users/zachradtka/events{/privacy}","received_events_url":"https://api.github.com/users/zachradtka/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ansible/ansible-modules-core/labels/affects_2.0","name":"affects_2.0","color":"5319e7"},{"url":"https://api.github.com/repos/ansible/ansible-modules-core/labels/bug_report","name":"bug_report","color":"fbca04"},{"url":"https://api.github.com/repos/ansible/ansible-modules-core/labels/waiting_on_maintainer","name":"waiting_on_maintainer","color":"d93f0b"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-08-25T19:13:13Z","updated_at":"2016-09-12T16:57:40Z","closed_at":null,"body":"<!--- Verify first that your issue/request is not already reported in GitHub -->\r\n\r\n##### ISSUE TYPE\r\n - Bug Report\r\n\r\n##### COMPONENT NAME\r\n\r\nauthorized_key\r\n\r\n##### ANSIBLE VERSION\r\n<!--- Paste verbatim output from “ansible --version” between quotes below -->\r\n```\r\nansible 2.0.2.0\r\n```\r\n\r\n##### CONFIGURATION\r\n<!---\r\nMention any settings you have changed/added/removed in ansible.cfg\r\n(or using the ANSIBLE_* environment variables).\r\n-->\r\n\r\n##### OS / ENVIRONMENT\r\n<!---\r\nMention the OS you are running Ansible from, and the OS you are\r\nmanaging, or say “N/A” for anything that is not platform-specific.\r\n-->\r\nN/A\r\n\r\n##### SUMMARY\r\n<!--- Explain the problem briefly -->\r\nUtilizing `delegate_to` and `authorized_key` to implement passworless SSH on a cluster does not work. Some, not all keys will get added to `~/.ssh/authorized_keys` while Ansible reports that all keys have been added.\r\n\r\n##### STEPS TO REPRODUCE\r\n<!---\r\nFor bugs, show exactly how to reproduce the problem.\r\nFor new features, show how the feature would be used.\r\n-->\r\nI have a cluster that has 4 machines. I am attempting to implement passworldless SSH on the entire cluster for a single user (e.g. the user hdfs on a Hadoop cluster). What I am trying to do is:\r\n1. Generate passwordless SSH keys on each host, if it does not already exist\r\n2. Get the public key (`id_rsa.pub`) from each machine\r\n3. Add each machines public key to every other machine's `~/.ssh/authorized_keys` file\r\n\r\n<!--- Paste example playbooks or commands between quotes below -->\r\nAn example of what I am trying to accomplish is below.\r\n\r\nFor clarity, the variables I am using are defined as:\r\n* `user` is a user\r\n* `user_home_dir` is the users home directory\r\n* `hosts` is a group named \"hosts\" in the inventory file\r\n```\r\n- name: Ensure SSH keys don't already exist\r\n  stat:\r\n    path: \"{{ user_home_dir }}/.ssh/id_rsa\"\r\n  become: yes\r\n  become_user: \"{{ user }}\"\r\n  become_method: sudo\r\n  register: ssh_key\r\n  tags:\r\n    - ssh-keys\r\n\r\n- name: Generate SSH keys for passwordless SSH\r\n  shell: ssh-keygen -N '' -f {{ user_home_dir }}/.ssh/id_rsa\r\n  become: yes\r\n  become_user: \"{{ user }}\"\r\n  become_method: sudo\r\n  when: ssh_key.stat.exists == False\r\n\r\n- name: Get `id_rsa.pub`\r\n  shell: cat {{ user_home_dir }}/.ssh/id_rsa.pub\r\n  register: id_rsa_pub\r\n\r\n# TODO: For debug purposes only\r\n- name: DEBUG Check Keys\r\n  debug:\r\n    msg: \"{{ id_rsa_pub.stdout }}\"\r\n\r\n- name: Add authorized key to all hosts\r\n  authorized_key: \r\n    user: \"{{ user }}\"\r\n    key: \"{{ id_rsa_pub.stdout }}\"\r\n  delegate_to: \"{{ item }}\"\r\n  with_items: \"{{ groups['hosts'] }}\"\r\n  when: id_rsa_pub.stdout is defined\r\n\r\n```\r\n\r\n<!--- You can also paste gist.github.com links for larger files -->\r\n\r\n##### EXPECTED RESULTS\r\n<!--- What did you expect to happen when running the steps above? -->\r\nI expected all hosts to contain the public key of all other hosts. The easiest way to check this is to cat `.ssh/authorized_keys` on each hosts. If this did work, I would expect the following (Assuming hosts: host_A, host_B, host_C, host_D).\r\n\r\nThe authorized keys on host_A:\r\n```\r\n[user@host_A ~]$ cat .ssh/authorized_keys\r\nssh-rsa <key_redacted> user@host_D\r\nssh-rsa <key_redacted> user@host_C\r\nssh-rsa <key_redacted> user@host_A\r\nssh-rsa <key_redacted> user@host_B\r\n```\r\n\r\nThe authorized keys on host_B:\r\n```\r\n[user@host_B ~]$ cat .ssh/authorized_keys\r\nssh-rsa <key_redacted> user@host_D\r\nssh-rsa <key_redacted> user@host_C\r\nssh-rsa <key_redacted> user@host_A\r\nssh-rsa <key_redacted> user@host_B\r\n```\r\n\r\nThe authorized keys on host_C:\r\n```\r\n[user@host_C ~]$ cat .ssh/authorized_keys\r\nssh-rsa <key_redacted> user@host_D\r\nssh-rsa <key_redacted> user@host_C\r\nssh-rsa <key_redacted> user@host_A\r\nssh-rsa <key_redacted> user@host_B\r\n```\r\n\r\nThe authorized keys on host_D:\r\n```\r\n[user@host_D ~]$ cat .ssh/authorized_keys\r\nssh-rsa <key_redacted> user@host_D\r\nssh-rsa <key_redacted> user@host_C\r\nssh-rsa <key_redacted> user@host_A\r\nssh-rsa <key_redacted> user@host_B\r\n```\r\n\r\n##### ACTUAL RESULTS\r\n<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->\r\nThe results vary every time the command is run. What is problematic is that Ansible reports that all hosts have added the public keys from all other hosts. The output of the command is below.\r\n\r\n<!--- Paste verbatim command output between quotes below -->\r\n```\r\nTASK [role_name : Add authorized key to all hosts] ***********\r\nchanged: [host_A -> host_A] => (item=host_A)\r\nchanged: [host_B -> host_A] => (item=host_A)\r\nchanged: [host_D -> host_A] => (item=host_A)\r\nchanged: [host_C -> host_A] => (item=host_A)\r\nchanged: [host_A -> host_B] => (item=host_B)\r\nchanged: [host_B -> host_B] => (item=host_B)\r\nchanged: [host_D -> host_B] => (item=host_B)\r\nchanged: [host_C -> host_B] => (item=host_B)\r\nchanged: [host_D -> host_C] => (item=host_C)\r\nchanged: [host_C -> host_C] => (item=host_C)\r\nchanged: [host_B -> host_C] => (item=host_C)\r\nchanged: [host_A -> host_C] => (item=host_C)\r\nchanged: [host_D -> host_D] => (item=host_D)\r\nchanged: [host_A -> host_D] => (item=host_D)\r\nchanged: [host_C -> host_D] => (item=host_D)\r\nchanged: [host_B -> host_D] => (item=host_D)\r\n```\r\n\r\nLooking at each hosts `authorized_keys` file shows that only one host (host_B) has all of the other hosts keys:\r\n\r\nThe authorized keys on host_A:\r\n```\r\n[user@host_A ~]$ cat .ssh/authorized_keys\r\nssh-rsa <key_redacted> user@host_A\r\n```\r\n\r\nThe authorized keys on host_B:\r\n```\r\n[user@host_B ~]$ cat .ssh/authorized_keys\r\nssh-rsa <key_redacted> user@host_D\r\nssh-rsa <key_redacted> user@host_C\r\nssh-rsa <key_redacted> user@host_A\r\nssh-rsa <key_redacted> user@host_B\r\n```\r\n\r\nThe authorized keys on host_C:\r\n```\r\n[user@host_C ~]$ cat .ssh/authorized_keys\r\nssh-rsa <key_redacted> user@host_C\r\n```\r\n\r\nThe authorized keys on host_D:\r\n```\r\n[user@host_D ~]$ cat .ssh/authorized_keys\r\nssh-rsa <key_redacted> user@host_D\r\n```\r\n\r\nTo further give evidence that there is an error, when I run the playbook again, the `authorized_key` module should report a status `ok` for each action that was already completed. The result of a subsequent run shows that some of the statuses are `changed`.\r\n\r\n```\r\nchanged: [host_B -> host_A] => (item=host_A)\r\nchanged: [host_C -> host_A] => (item=host_A)\r\nok: [host_A -> host_A] => (item=host_A)\r\nchanged: [host_D -> host_A] => (item=host_A)\r\nok: [host_A -> host_B] => (item=host_B)\r\nok: [host_B -> host_B] => (item=host_B)\r\nok: [host_C -> host_B] => (item=host_B)\r\nok: [host_D -> host_B] => (item=host_B)\r\nchanged: [host_B -> host_C] => (item=host_C)\r\nchanged: [host_A -> host_C] => (item=host_C)\r\nok: [host_C -> host_C] => (item=host_C)\r\nchanged: [host_D -> host_C] => (item=host_C)\r\nchanged: [host_B -> host_D] => (item=host_D)\r\nchanged: [host_A -> host_D] => (item=host_D)\r\nchanged: [host_C -> host_D] => (item=host_D)\r\nok: [host_D -> host_D] => (item=host_D)\r\n```\r\n\r\nFor brevity, only checking host_A's authorized keys file reveals that after a second run, host_C's public key is still missing.\r\n```\r\n[user@host_A ~]$ cat .ssh/authorized_keys\r\nssh-rsa <key_redacted> user@host_D\r\nssh-rsa <key_redacted> user@host_A\r\nssh-rsa <key_redacted> user@host_B\r\n```\r\n\r\n##### WORKAROUND\r\n\r\nBecause of this error, I have created the following workaround. Instead of using the `authorized_key` module, I just run a simple `shell` command.\r\n\r\n```\r\n- name: Add authorized key to all hosts\r\n  shell: echo {{ id_rsa_pub.stdout }} >> {{ user_home_dir }}/.ssh/authorized_keys\r\n  delegate_to: \"{{ item }}\"\r\n  with_items: \"{{ groups['hosts'] }}\"\r\n  become: yes\r\n  become_user: \"{{ user }}\"\r\n  become_method: sudo\r\n  when: id_rsa_pub.stdout is defined\r\n```\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/comments/246414238","html_url":"https://github.com/ansible/ansible-modules-core/issues/4542#issuecomment-246414238","issue_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/4542","id":246414238,"user":{"login":"ansibot","id":6585283,"avatar_url":"https://avatars.githubusercontent.com/u/6585283?v=3","gravatar_id":"","url":"https://api.github.com/users/ansibot","html_url":"https://github.com/ansibot","followers_url":"https://api.github.com/users/ansibot/followers","following_url":"https://api.github.com/users/ansibot/following{/other_user}","gists_url":"https://api.github.com/users/ansibot/gists{/gist_id}","starred_url":"https://api.github.com/users/ansibot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ansibot/subscriptions","organizations_url":"https://api.github.com/users/ansibot/orgs","repos_url":"https://api.github.com/users/ansibot/repos","events_url":"https://api.github.com/users/ansibot/events{/privacy}","received_events_url":"https://api.github.com/users/ansibot/received_events","type":"User","site_admin":false},"created_at":"2016-09-12T16:57:40Z","updated_at":"2016-09-12T16:57:40Z","body":"@ansible, ping. This issue is still waiting on your response.\n[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)\n<!--- boilerplate: issue_renotify_maintainer --->"}}
{"actor":{"display_login":"ansibot"}}