From 06584ee3aa43c666b4bbedf06186182003c1db9f Mon Sep 17 00:00:00 2001
From: Alexander Block <ablock84@gmail.com>
Date: Fri, 9 Dec 2016 10:38:17 +0100
Subject: [PATCH] Add support for bastion hosts
---
.gitignore | 1 +
ansible.cfg | 2 ++
cluster.yml | 7 ++++++-
inventory/inventory.example | 3 +++
roles/bastion-ssh-config/tasks/main.yml | 18 ++++++++++++++++
.../templates/ssh-bastion.conf | 21 +++++++++++++++++++
6 files changed, 51 insertions(+), 1 deletion(-)
create mode 100644 roles/bastion-ssh-config/tasks/main.yml
create mode 100644 roles/bastion-ssh-config/templates/ssh-bastion.conf
diff --git a/.gitignore b/.gitignore
index 506313fe0..8eae4884b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@ temp
.idea
*.tfstate
*.tfstate.backup
+/ssh-bastion.conf
\ No newline at end of file
diff --git a/ansible.cfg b/ansible.cfg
index f0e4ef652..86e1d6a22 100644
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -1,5 +1,7 @@
[ssh_connection]
pipelining=True
+ssh_args = -F ./ssh-bastion.conf -o ControlMaster=auto -o ControlPersist=30m
+control_path = ~/.ssh/ansible-%%r@%%h:%%p
[defaults]
host_key_checking=False
gathering = smart
diff --git a/cluster.yml b/cluster.yml
index 6f8e63505..98862aa13 100644
--- a/cluster.yml
+++ b/cluster.yml
@@ -1,4 +1,9 @@
---
+- hosts: localhost
+ gather_facts: False
+ roles:
+ - bastion-ssh-config
+
- hosts: all
any_errors_fatal: true
gather_facts: false
@@ -16,7 +21,7 @@
any_errors_fatal: true
gather_facts: true
-- hosts: all:!network-storage
+- hosts: all:!network-storage:!bastion
any_errors_fatal: true
roles:
- { role: kubernetes/preinstall, tags: preinstall }
diff --git a/inventory/inventory.example b/inventory/inventory.example
index ab085ad4a..c08e84ae6 100644
--- a/inventory/inventory.example
+++ b/inventory/inventory.example
@@ -7,6 +7,9 @@
# node5 ansible_ssh_host=95.54.0.16 # ip=10.3.0.5
# node6 ansible_ssh_host=95.54.0.17 # ip=10.3.0.6
+# ## configure a bastion host if your nodes are not publicly reachable
+# bastion ansible_ssh_host=xxx.xxx.xxx.xxx
+
# [kube-master]
# node1
# node2
diff --git a/roles/bastion-ssh-config/tasks/main.yml b/roles/bastion-ssh-config/tasks/main.yml
new file mode 100644
index 000000000..d1aae5ca8
--- /dev/null
+++ b/roles/bastion-ssh-config/tasks/main.yml
@@ -0,0 +1,18 @@
+---
+- set_fact:
+ has_bastion: "{{ 'bastion' in groups['all'] }}"
+
+- set_fact:
+ bastion_ip: "{{ hostvars['bastion']['ansible_ssh_host'] }}"
+ when: has_bastion
+
+# As we are actually running on localhost, the ansible_ssh_user is your local user when you try to use it directly
+# To figure out the real ssh user, we delegate this task to the bastion and store the ansible_ssh_user in real_user
+- set_fact:
+ real_user: "{{ ansible_ssh_user }}"
+ delegate_to: bastion
+ when: has_bastion
+
+- name: create ssh bastion conf
+ become: false
+ template: src=ssh-bastion.conf dest="{{ playbook_dir }}/ssh-bastion.conf"
diff --git a/roles/bastion-ssh-config/templates/ssh-bastion.conf b/roles/bastion-ssh-config/templates/ssh-bastion.conf
new file mode 100644
index 000000000..6bcc65dad
--- /dev/null
+++ b/roles/bastion-ssh-config/templates/ssh-bastion.conf
@@ -0,0 +1,21 @@
+{% if has_bastion %}
+{% set vars={'hosts': ''} %}
+{% set user='' %}
+
+{% for h in groups['all'] %}
+{% if h != 'bastion' %}
+{% if vars.update({'hosts': vars['hosts'] + ' ' + hostvars[h]['ansible_ssh_host']}) %}{% endif %}
+{% endif %}
+{% endfor %}
+
+Host {{ bastion_ip }}
+ Hostname {{ bastion_ip }}
+ StrictHostKeyChecking no
+ ControlMaster auto
+ ControlPath ~/.ssh/ansible-%r@%h:%p
+ ControlPersist 5m
+
+Host {{ vars['hosts'] }}
+ ProxyCommand ssh -W %h:%p {{ real_user }}@{{ bastion_ip }}
+ StrictHostKeyChecking no
+{% endif %}
\ No newline at end of file
--
GitLab