<p>Hi i keep getting this error when using ansible via kubespray and I am wondering how to over come it</p>
<pre><code>
TASK [bootstrap-os : Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux)] ********************************************************************************************************************************************************************************************************
task path: /home/dc/xcp-projects/kubespray/roles/bootstrap-os/tasks/main.yml:50

&lt;192.168.10.55&gt; (1, b'\x1b[1;31m==== AUTHENTICATING FOR org.freedesktop.hostname1.set-hostname ===\r\n\x1b[0mAuthentication is required to set the local host name.\r\nMultiple identities can be used for authentication:\r\n 1.  test\r\n 2.  provision\r\n 3.  dc\r\nChoose identity to authenticate as (1-3): \r\n{&quot;msg&quot;: &quot;Command failed rc=1, out=, err=\\u001b[0;1;31mCould not set property: Connection timed out\\u001b[0m\\n&quot;, &quot;failed&quot;: true, &quot;invocation&quot;: {&quot;module_args&quot;: {&quot;name&quot;: &quot;node3&quot;, &quot;use&quot;: null}}}\r\n', b'Shared connection to 192.168.10.55 closed.\r\n')
&lt;192.168.10.55&gt; Failed to connect to the host via ssh: Shared connection to 192.168.10.55 closed.
&lt;192.168.10.55&gt; ESTABLISH SSH CONNECTION FOR USER: provision
&lt;192.168.10.55&gt; SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o 'IdentityFile=&quot;/home/dc/.ssh/xcp_server_k8s_nodes/xcp-k8s-provision-key&quot;' -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User=&quot;provision&quot;' -o ConnectTimeout=10 -oStrictHostKeyChecking=no -o ControlPath=/home/dc/.ansible/cp/c6d70a0b7d 192.168.10.55 '/bin/sh -c '&quot;'&quot;'rm -f -r /home/provision/.ansible/tmp/ansible-tmp-1614373378.5434802-17760837116436/ &gt; /dev/null 2&gt;&amp;1 &amp;&amp; sleep 0'&quot;'&quot;''
&lt;192.168.10.56&gt; (0, b'', b'')
fatal: [node2]: FAILED! =&gt; {
    &quot;changed&quot;: false,
    &quot;invocation&quot;: {
        &quot;module_args&quot;: {
            &quot;name&quot;: &quot;node2&quot;,
            &quot;use&quot;: null
        }
    },
    &quot;msg&quot;: &quot;Command failed rc=1, out=, err=\u001b[0;1;31mCould not set property: Method call timed out\u001b[0m\n&quot;
}

</code></pre>
<p>my inventory file is as follows</p>
<pre><code>all:
  hosts:
    node1:
      ansible_host: 192.168.10.54
      ip: 192.168.10.54
      access_ip: 192.168.10.54
    node2:
      ansible_host: 192.168.10.56
      ip: 192.168.10.56
      access_ip: 192.168.10.56
    node3:
      ansible_host: 192.168.10.55
      ip: 192.168.10.55
      access_ip: 192.168.10.55
  children:
    kube-master:
      hosts:
        node1:
        node2:
    kube-node:
      hosts:
        node1:
        node2:
        node3:
    etcd:
      hosts:
        node1:
        node2:
        node3:
    k8s-cluster:
      children:
        kube-master:
        kube-node:
    calico-rr:
      hosts: {}
</code></pre>
<p>I also have a file which provision the users in the following manner</p>
<pre><code>- name: Add a new user named provision
  user:
    name: provision
    create_home: true
    shell: /bin/bash
    password: &quot;{{ provision_password }}&quot;
    groups: sudo
    append: yes

- name: Add a new user named dc
  user:
    name: dc
    create_home: true
    shell: /bin/bash
    password: &quot;{{ provision_password }}&quot;
    groups: sudo
    append: yes

- name: Add provision user to the sudoers
  copy:
    dest: &quot;/etc/sudoers.d/provision&quot;
    content: &quot;provision  ALL=(ALL)  NOPASSWD: ALL&quot;

- name: Add provision user to the sudoers
  copy:
    dest: &quot;/etc/sudoers.d/dc&quot;
    content: &quot;dc  ALL=(ALL)  NOPASSWD: ALL&quot;


- name: Disable Root Login
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^PermitRootLogin'
    line: &quot;PermitRootLogin no&quot;
    state: present
    backup: yes

  notify:
    - Restart ssh
</code></pre>
<p>I have run the ansible command in the following manner</p>
<pre><code>ansible-playbook -i kubespray/inventory/mycluster/hosts.yaml --user=&quot;provision&quot;  --ssh-extra-args=&quot;-oStrictHostKeyChecking=no&quot; --key-file &quot;/home/dc/.ssh/xcp_server_k8s_nodes/xcp-k8s-provision-key&quot; kubespray/cluster.yml -vvv
</code></pre>
<p>as well as</p>
<pre><code>ansible-playbook -i kubespray/inventory/mycluster/hosts.yaml --user=&quot;provision&quot;  --ssh-extra-args=&quot;-oStrictHostKeyChecking=no&quot; --key-file &quot;/home/dc/.ssh/xcp_server_k8s_nodes/xcp-k8s-provision-key&quot; --become-user=&quot;provision&quot; kubespray/cluster.yml -vv
</code></pre>
<p>both yield the same error an interestingly escalation seems to succeed on earlier points</p>
<p>after reading this article
<a href="https://askubuntu.com/questions/542397/change-default-user-for-authentication">https://askubuntu.com/questions/542397/change-default-user-for-authentication</a>
I have decided to add the users to the sudo group but the error still persists</p>
<p>looking into the main.yaml file position suggested by the error it seems to be this code possibly causing issues?</p>
<pre><code># Workaround for https://github.com/ansible/ansible/issues/42726
# (1/3)
- name: Gather host facts to get ansible_os_family
  setup:
    gather_subset: '!all'
    filter: ansible_*

- name: Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux)
  hostname:
    name: &quot;{{ inventory_hostname }}&quot;
  when:
    - override_system_hostname
    - ansible_os_family not in ['Suse', 'Flatcar Container Linux by Kinvolk', 'ClearLinux'] and not is_fedora_coreos
</code></pre>
<p>The OS'es of the hosts are ubuntu 20.04.02 server
is there anything more I can do?</p>

user3700919
<p>From Kubespray documentation:</p>
<pre class="lang-sh prettyprint-override"><code># Deploy Kubespray with Ansible Playbook - run the playbook as root
# The option `--become` is required, as for example writing SSL keys in /etc/,
# installing packages and interacting with various systemd daemons.
# Without --become the playbook will fail to run!
ansible-playbook -i inventory/mycluster/hosts.yaml  --become --become-user=root cluster.yml
</code></pre>
<p>As stated, the <code>--become</code> is mandatory, it allows to do privilege escalation for most of the system modifications (like setting the hostname) that Kubespray performs.</p>
<p>With <code>--user=provision</code> you're just setting the SSH user, but it will need privilege escalation anyway.
With <code>--become-user=provision</code> you're just saying that privilege escalation will escalade to 'provision' user (but you would need <code>--become</code> to do the privilege escalation).
In both cases, unless 'provision' user has root permissions (not sure putting it in <code>root</code> group is enough), it won't be enough.</p>
<p>For the user 'provision' to be enough, you need to make sure that it can perform a <code>hostnamectl &lt;some-new-host&gt;</code> without being asked for authentication.</p>
