Is it possible in ansible to make local_action
task being run ONLY once while running playbook against a group of hosts?
Here is the problem:
hosts:
- macbooks
- localhost
tasks:
#...<some_remote_tasks>...#
- local_action: command
ssh-keygen -o -a 100 -t ed25519 -f {{ ssh_key }} -q -N ''
become: yes
Result:
fatal: [laptop -> localhost]: FAILED! => {"changed": true, "cmd": ["ssh-keygen", "-o", "-a", "100", "-t", "ed25519", "-f", "/etc/ssh/id_ed25519-HostCA", "-q", "-N", "", "-C", "SSH Host Certificate Authority for cypherpunk.synology.me"], "delta": "0:00:00.014818", "end": "2018-06-01 17:02:41.599111", "msg": "non-zero return code", "rc": 1, "start": "2018-06-01 17:02:41.584293", "stderr": "", "stderr_lines": [], "stdout": "/etc/ssh/id_ed25519-HostCA already exists.\nOverwrite (y/n)? ", "stdout_lines": ["/etc/ssh/id_ed25519-HostCA already exists.", "Overwrite (y/n)? "]}
changed: [localhost -> localhost]
And this makes sense because any task in a playbook has to be run for each managed host.
But because it is a local action, it runs first time as expected creating the key file. Second time the file already exists and ansible gets an error: "/etc/ssh/id_ed25519-HostCA already exists. Overwrite (y/n)?"
with return code 1
. So really it must be run only once (at least in this situation).
I could do something like:
- local_action: shell >
[[ ! -f {{ ssh_key }} ]] && \
ssh-keygen -o -a 100 -t ed25519 -f {{ ssh_key }} -q -N ''; \
exit 0
become: yes
But I wonder if there is an ansible-recommended solution? How would you guys solve this?
Best Answer
Maybe you should check: run_once & delegate_to
Doc: https://docs.ansible.com/ansible/latest/user_guide/playbooks_delegation.html
Kind regards,
C