Bug 1501271 - ansible_ssh_user is overwritten by openshift_aws_build_ami_ssh_user
Summary: ansible_ssh_user is overwritten by openshift_aws_build_ami_ssh_user
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 3.7.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: 3.7.0
Assignee: Kenny Woodson
QA Contact: Wenkai Shi
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-10-12 10:07 UTC by Wenkai Shi
Modified: 2017-11-28 22:16 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
undefined
Clone Of:
Environment:
Last Closed: 2017-11-28 22:16:57 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:3188 0 normal SHIPPED_LIVE Moderate: Red Hat OpenShift Container Platform 3.7 security, bug, and enhancement update 2017-11-29 02:34:54 UTC

Description Wenkai Shi 2017-10-12 10:07:26 UTC
Description of problem:
Follow the document /usr/share/ansible/openshift-ansible/playbooks/aws/README.md to provisioning cluster in AWS with none-root user(ec2-user). Set "ansible_ssh_user=ec2-user" in hosts file, it has no effect because ansible_ssh_user overwritten by openshift_aws_build_ami_ssh_user in /usr/share/ansible/openshift-ansible/playbooks/aws/openshift-cluster/build_ami.yml:37.

Version-Release number of the following components:
openshift-ansible-3.7.0-0.148.0.git.0.b35eb14.el7
ansible-2.3.2.0-2.el7

How reproducible:
100%

Steps to Reproduce:
1. Follow the document /usr/share/ansible/openshift-ansible/playbooks/aws/README.md to provisioning cluster in AWS with none-root user(ec2-user).
# cat hosts
...
[OSEv3:vars]
ansible_ssh_user=ec2-user
...
2. Run provisioning playbook
# ansible-playbook -i hosts -vvv /usr/share/ansible/openshift-ansible/playbooks/aws/openshift-cluster/build_ami.yml -e @provisioning_vars.yml
3.

Actual results:
# ansible-playbook -i hosts -vvv /usr/share/ansible/openshift-ansible/playbooks/aws/openshift-cluster/build_ami.yml -e @provisioning_vars.yml
...
TASK [set the user to perform installation] **************************************************************************************************************************************************
task path: /usr/share/ansible/openshift-ansible/playbooks/aws/openshift-cluster/build_ami.yml:35
ok: [xxx.compute-1.amazonaws.com] => {
    "ansible_facts": {
        "ansible_ssh_user": "root"
    }, 
    "changed": false
}
META: ran handlers
META: ran handlers
...
TASK [Gathering Facts] ***********************************************************************************************************************************************************************
Using module file /usr/lib/python2.7/site-packages/ansible/modules/system/setup.py
<xxx.compute-1.amazonaws.com> ESTABLISH SSH CONNECTION FOR USER: root
<xxx.compute-1.amazonaws.com> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=root -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/%C xxx.compute-1.amazonaws.com '/bin/sh -c '"'"'/usr/bin/python && sleep 0'"'"''
<xxx.compute-1.amazonaws.com> (0, 'Please login as the user "ec2-user" rather than the user "root".\n\n', "Warning: Permanently added 'xxx.compute-1.amazonaws.com,...' (ECDSA) to the list of known hosts.\r\n")
fatal: [xxx.compute-1.amazonaws.com]: FAILED! => {
    "changed": false, 
    "failed": true, 
    "module_stderr": "Warning: Permanently added 'xxx.compute-1.amazonaws.com,...' (ECDSA) to the list of known hosts.\r\n", 
    "module_stdout": "Please login as the user \"ec2-user\" rather than the user \"root\".\n\n", 
    "msg": "MODULE FAILURE", 
    "rc": 0
}
	to retry, use: --limit @/usr/share/ansible/openshift-ansible/playbooks/aws/openshift-cluster/build_ami.retry

PLAY RECAP ***********************************************************************************************************************************************************************************
xxx.compute-1.amazonaws.com : ok=1    changed=0    unreachable=0    failed=1   
localhost                  : ok=21   changed=1    unreachable=0    failed=0   
...

Expected results:
Installer should use ec2-user.

Additional info:
# grep -nir "openshift_aws_build_ami_ssh_user" .
./playbooks/aws/openshift-cluster/build_ami.yml:37:      ansible_ssh_user: "{{ openshift_aws_build_ami_ssh_user | default('root') }}"

Comment 1 Wenkai Shi 2017-10-18 07:41:42 UTC
This should be resolved or document on 3.7 cause related user story is target release 3.7.

Comment 3 Kenny Woodson 2017-10-19 13:41:16 UTC
Proposed fix is here. https://github.com/openshift/openshift-ansible/pull/5794

Will update when it gets merged.

Comment 5 Wenkai Shi 2017-11-02 03:26:37 UTC
Verified with version openshift-ansible-3.7.0-0.189.0.git.0.d497c5e.el7, the user is correct.

# ansible-playbook -i hosts -vvv /usr/share/ansible/openshift-ansible/playbooks/aws/openshift-cluster/build_ami.yml -e @provisioning_vars.yml
...
TASK [set the user to perform installation] **************************************************************************************************************************************************
task path: /usr/share/ansible/openshift-ansible/playbooks/aws/openshift-cluster/build_ami.yml:27
ok: [ec2-xx-xx-xx-xx.compute-1.amazonaws.com] => {
    "ansible_facts": {
        "ansible_ssh_user": "ec2-user", 
        "openshift_node_bootstrap": true, 
        "openshift_node_image_prep_packages": [
            "cloud-utils-growpart"
        ]
    }, 
    "changed": false, 
    "failed": false
}
...

Comment 8 errata-xmlrpc 2017-11-28 22:16:57 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:3188


Note You need to log in before you can comment on or make changes to this bug.