Avoid conflicting delegation with authorized_keys
When delegating with the authorized_key module, writes of multiple keys
against the same host's file can occur at the same time, leading to
missing keys.[0]
To avoid conflicting delegation between hosts, the registered
'keystone_pubkey' fact now contains a list of SSH keys of all hosts the
current batch of the play, rather than only the key of the current host.
The first host within each batch will handle distribution of that
batch's keys to all hosts within the play.
[0] https://github.com/ansible/ansible/issues/29693
Change-Id: I386e84eba46aa164db22618b7a6ac53b86eeeaf0
(cherry picked from commit 97428cb0a1
)
This commit is contained in:
parent
48019740f8
commit
56e5de6458
@ -17,6 +17,6 @@
|
||||
authorized_key:
|
||||
user: "{{ keystone_system_user_name }}"
|
||||
key: "{{ keystone_pubkey | b64decode }}"
|
||||
when: keystone_pubkey is defined
|
||||
when: inventory_hostname == ansible_play_batch[0]
|
||||
delegate_to: "{{ item }}"
|
||||
with_items: "{{ ansible_play_hosts }}"
|
||||
|
@ -21,4 +21,5 @@
|
||||
|
||||
- name: Register a fact for the keystone pub key
|
||||
set_fact:
|
||||
keystone_pubkey: "{{ keystone_pub.content }}"
|
||||
keystone_pubkey: "{{ ansible_play_batch | map('extract', hostvars, 'keystone_pub') | map(attribute='content') | map('b64decode') | join('\n') | b64encode }}"
|
||||
when: inventory_hostname == ansible_play_batch[0]
|
||||
|
Loading…
Reference in New Issue
Block a user