How to execute an ansible playbook using a jenkins pipeline script?

Question

We developed declarative pipeline code to execute an Ansible playbook. We tested the playbook from CLI and it is working properly. My playbook actually performs some shell commands on remote server.

SSH configuration between two servers has been done: I have generated an ssh key and copied it to the remote server, and I am able to ping the server.

The Error msg:

ansible-playbook /var/lib/jenkins/workspace/test1/playbook2.yml -i 
/var/lib/jenkins/workspace/test1/inventory.ini -b --become-user root
[WARNING] Ansible is in a world writable directory 
(/var/lib/jenkins/workspace/test1), ignoring it as an ansible.cfg source

fatal: [17.14.69.21]: UNREACHABLE! => {"changed": false, "msg": "Failed to 
connect to the host via ssh: Permission denied (publickey,gssapi- 
keyex,gssapi-with-mic,password).\r\n", "unreachable": true}
[17.14.69.21]: 
FATAL: command execution failed
hudson.AbortException: Ansible playbook execution failed.

I have given sudo access to Jenkins user and Jenkins is running as Jenkins user.

Answer 1

If you have Jenkins user public key, on your target hosts authorized keys file, for the user you want to login as, ssh connection authorization should work.

This is an example of Jenkinsfile step.

ansiblePlaybook colorized: true, installation: 'Ansible', inventory: 'inventory', playbook: 'playbook.yml',tags: "" , skippedTags: "", extras: "--extra-vars ' hst=targetHost "

This is Ansible Inventory example. You can define the args at the host level as well.

[targetHost]
17.14.69.21 ansible_ssh_user=sshuser

[all:vars]
ansible_connection=ssh
ansible_ssh_common_args='-o StrictHostKeyChecking=no -oHostKeyAlgorithms=+ssh-dss'

Answer 2

--become-user root

I think you are doing ssh connection between two servers as a root user. I would like to know why. I would never do this.

Assuming those servers are Unix/Linux . Since there is no details how you test with CLI.I am also curious about it.

This might help. Enable root login over SSH

Command line options --ask-become-pass, -K ask for privilege escalation password; does not imply become will be used. Note that this password will be used for all hosts. --become, -b run operations with become (no password implied) --become-method=BECOME_METHOD privilege escalation method to use (default=sudo), valid choices: [ sudo | su | pbrun | pfexec | doas | dzdo | ksu | runas | machinectl ] --become-user=BECOME_USER run operations as this user (default=root), does not imply –become/-b

Understanding Privilege Escalation

I think you just want it working :) Ansible documentation is short and brief.

Working with Inventory ansible_ssh_pass
The ssh password to use (never store this variable in plain text; always use a vault. See Variables and Vaults) ansible_ssh_private_key_file Private key file used by ssh. Useful if using multiple keys and you don’t want to use SSH agent. ansible_ssh_common_args This setting is always appended to the default command line for sftp, scp, and ssh. Useful to configure a ProxyCommand for a certain host (or group).

Working with Inventory