Ansible Task-clone private git无需SSH转发

Question

如果有人需要，这是我现在的剧本：

- name: Create SSH directory
  file: path=/root/.ssh state=directory

- name: Copy SHH key for Git access
  copy:
    content: "{{ git_ssh_key }}"
    dest: /root/.ssh/id_rsa
    owner: root
    group: root
    mode: 0600

# Also tried this, but it also hangs
#- name: Start SSH agent and add SSH key
#  shell: eval `ssh-agent -s` && ssh-add

- name: Get new source from GIT
  git: 
    key_file: /root/.ssh/id_rsa
    repo: "[e-mail]:user/repo.git"
    dest: "{{ staging_dir }}"
    depth: 1
    accept_hostkey: yes
    clone: yes

我使用的是Ansible 2.3.1.0，python版本=2.7.12

Answer 1

以下是使其工作的步骤（在MacOS、Ubuntu LTS上用Ansible 2.3.1和Python 2.7.10测试）：

>

生成不带密码短语的新SSH密钥对ssh-keygen-f my_ssh_key-n“。

将my_ssh_key.pub添加到存储库服务器用户配置文件中

null

---
- hosts: localhost
  gather_facts: no
  vars:
    git_ssh_public_key: "Your public ssh key"
    git_ssh_key: |
              -----BEGIN RSA PRIVATE KEY-----
              .... actual key here ....
              -----END RSA PRIVATE KEY-----
  tasks:
  - name: Copy SSH public key file
    copy: 
      content: "{{ git_ssh_public_key }}"
      dest: /root/.ssh/id_rsa.pub
      mode: 0644

  - name: Copy SSH private key file
    copy: 
      content: "{{ git_ssh_key }}"
      #src: id_rsa
      dest: /root/.ssh/id_rsa
      mode: 0600

  - name: Get new source from GIT
    git: 
      repo: "[e-mail]:user/repo.git"
      dest: "/var/www/"
      depth: 1
      accept_hostkey: yes
      clone: yes

重要保安通告

如果你想在现实世界中使用这个例子，请不要用明文保存你的私钥--使用Ansible Vault。

您也不应该使用root作为ansible用户。在没有sudo权限的情况下创建新用户会更加安全。