Bug: Check whether Ansible can connect as <user>
– passes when SSH connection fails
#1466
Open
5 tasks done
Labels
Terms
Description
What's wrong?
The
Check whether Ansible can connect as [...]
task succeeds although the SSH connection actually fails (like an auth error).This means that SSH connection problems during the the provision and deploy playbooks will not be caught immediately.
What have you tried?
For testing I ensured that SSH connections will fail to the target system (disabled the SSH agent). Manual SSH connections then indeed fail.
Ansible also now fails with connecting, but only further down the line, here at the
Gathering facts
step.The
Check whether Ansible can connect as [...]
task still passes. In ansible playbook verbose mode thestdout
is shown that contains the SSH authentication errors and the final error that the SSH connection indeed failed: (See log section).Minimal test case (playbook) (e.g.
test-connection.yml
):ansible-playbook test-connection.yml -e env=staging
(Make it very verbose (
-vvvv
) so the values ofstdout
andstderr
can be inspected).What insights have you gained?
Although the SSH command actually fails and while the
stderr
is empty, thestdout
contains the SSH errors, the current task passes, asfailed_when: false
apparently doesn't apply as intended when theansible
raw module fails to connect in this test command.The exit code for a failing raw ansible SSH test command is non-zero, for a successful SSH connection it is zero (
0
):The current implementation in Trellis uses the
stdout
of that command to check for SSH host key issues, but it doesn't catch SSH connection errors.Possible solutions
Make the
Check whether Ansible can connect as [...]
task fail for non-zero exit codes (that indicates an error) (failed_when: connection_status.rc != 0
instead offailed_when: false
):Temporary workarounds
As the playbook will fail later in case of a SSH connection error, no workaround is necessary. But the task that has the name
Check whether Ansible can connect as [...]
should ensure that the SSH connection is actually possible and catch this issue before proceeding any further.Steps To Reproduce
trellis
CLI or invokingansible-playbook
directly.Note that the
Check whether Ansible can connect as [...]
task will pass, and only in the subsequent steps the playbook fails due to a SSH connection error.Expected Behavior
The
Check whether Ansible can connect as [...]
task and hence the playbook at that point should fail as the SSH connection failed.Actual Behavior
The
Check whether Ansible can connect as [...]
taskpasses (
OK`), the playbook will fail later, after that.Relevant Log Output
Versions
Add built-in fail2ban filters (#1375)
The text was updated successfully, but these errors were encountered: