How to pass SSH user name and password using the Ansible pack

[mmMOLINARI]

Hi all,
I have Ansible and StackStorm running in the same Ubuntu host. I want to use my existing playbooks against RUCKUS ICX switches. The playbooks work as expected with Ansible.

For example, I am running the following playbook with Ansible:

awxuser@awxserver:~$ sudo ansible-playbook -i 10.0.0.213, -k -K -u admin icx_facts.yml
[sudo] password for awxuser: ***********
BECOME password[defaults to SSH password]: 
PLAY [all] *******************************************************************************************************************
TASK [Gathering Facts] *******************************************************************************************************
ok: [10.0.0.213]
TASK [Collect the interfaces facts] ******************************************************************************************
ok: [10.0.0.213]
TASK [debug] *****************************************************************************************************************
ok: [10.0.0.213] => {
    "result": {
        "ansible_facts": {
            "ansible_net_all_ipv4_addresses": [],
            "ansible_net_all_ipv6_addresses": [],
            "ansible_net_gather_subset": [
                "default",
                "interfaces"
            ],
            "ansible_net_hostname": null,
            "ansible_net_image": "SPR09000.bin",
            "ansible_net_interfaces": {
                "1": {
                    "ipv6": {}
                },
                "10GigabitEthernet1/3/1": {
                    "bandwidth": "optic-based",
                    "description": null,
                    "duplex": "unknown",
                    "ipv4": {},
                    "lineprotocol": "down ",
                    "macaddress": "c0c5.2092.a52d",
                    "mediatype": "EMPTY",
                    "mtu": 1500,
                    "operstatus": "down",
                    "type": "10GigabitEthernet"
                },
                "10GigabitEthernet1/3/2": {
                    "bandwidth": "optic-based",
                    "description": null,
                    "duplex": "unknown",
                    "ipv4": {},
                    "lineprotocol": "down ",
                    "macaddress": "c0c5.2092.a52d",

...... a long list of interfaces follows.

What is the equivalent command in the st2 command line? I tried the following, which is not working properly, because I do not know how to pass the SSH credentials:

awxuser@awxserver:~$ sudo st2 run ansible.playbook playbook=/home/awxuser/icx_facts.yml inventory_file=/home/awxuser/hosts
....
id: 6189f1b0d3c4ab1446edc8e7
action.ref: ansible.playbook
context.user: st2admin
parameters: 
  cwd: /opt/stackstorm/packs/ansible
  inventory_file: /home/awxuser/hosts
  playbook: /home/awxuser/icx_facts.yml
status: succeeded
start_timestamp: Tue, 09 Nov 2021 03:57:36 UTC
end_timestamp: Tue, 09 Nov 2021 03:57:43 UTC
result: 
  failed: false
  return_code: 0
  stderr: "[DEPRECATION WARNING]: Ansible will require Python 3.8 or newer on the 
controller starting with Ansible 2.12. Current version: 3.6.9 (default, Jan 26 
2021, 15:33:00) [GCC 8.4.0]. This feature will be removed from ansible-core in 
version 2.12. Deprecation warnings can be disabled by setting 
deprecation_warnings=False in ansible.cfg."
  stdout: "
PLAY [all] *********************************************************************

TASK [Gathering Facts] *********************************************************
ok: [10.0.0.213]

TASK [Collect the interfaces facts] ********************************************
ok: [10.0.0.213]

TASK [debug] *******************************************************************
ok: [10.0.0.213] => {
    "result": {
        "ansible_facts": {
            "ansible_net_all_ipv4_addresses": [],
            "ansible_net_all_ipv6_addresses": [],
            "ansible_net_gather_subset": [
                "default",
                "interfaces"
            ],
            "ansible_net_hostname": null,
            "ansible_net_image": null,
            "ansible_net_interfaces": {},
            "ansible_net_model": null,
            "ansible_net_neighbors": {
                "null": [
                    {
                        "host": null,
                        "port": null
                    }
                ]
            },
            "ansible_net_serialnum": null,
            "ansible_net_version": null
        },
        "changed": false,
        "failed": false
    }
}

PLAY RECAP *********************************************************************
10.0.0.213                 : ok=3    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
"
  succeeded: true

The playbook executes, but it is clearly not establishing the SSH connection to my switch. All the fields come empty. That's expected, because I did not provide the SSH credentials in the st2 command.

There is a field to provide the user in the StackStorm Web UI, but not one for the SSH password. I tried using extra_vars, and pointing private_key to the location where my host keys are (it's /home/awxuser/.ssh/known_hosts in my setup). Nothing worked. I always get a response with empty fields.

Any guidance on how to pass the SSH credentials will be appreciated.

Thanks,
Marcelo

[mmMOLINARI]

Here is some additional information: after a change in the playbook to make it collect all data, now I am seeing a message about paramiko failing to authenticate the host:

TASK [debug] *******************************************************************
ok: [10.0.0.213] => {
"result": {
"ansible_facts": {
"ansible_net_all_ipv4_addresses": [],
"ansible_net_all_ipv6_addresses": [],
"ansible_net_config": "paramiko: The authenticity of host '10.0.0.213' can't be established.
The ssh-rsa key fingerprint is b'005bd935bbc83849c7e36139c7c4738a'.",
"ansible_net_filesystems": "flash",
"ansible_net_filesystems_info": {
"flash": {}
},
"ansible_net_gather_subset": [
"hardware",
"default",
"config",
"interfaces"
],
"ansible_net_hostname": null,
"ansible_net_image": null,
"ansible_net_interfaces": {},
"ansible_net_model": null,
"ansible_net_neighbors": {

I already added host_key_checking = False to the [defaults] section in ansible.cfg, and also removed and generated a new host key. The problem persists. I am using the following command line:

st2 run ansible.playbook playbook=/home/awxuser/icx_facts.yml inventory_file="/home/awxuser/hosts" user=admin private_key=~/.ssh/known_hosts

Thanks again!

[amanda11]

Which ansible.cfg have you altered, is it for the user that StackStorm actions run as?

Alternatively you could pass using the env parameter, e.g.

st2 run ansible.playbook playbook=/home/awxuser/icx_facts.yml inventory_file="/home/awxuser/hosts" user=admin private_key=~/.ssh/known_hosts env='{"ANSIBLE_HOST_KEY_CHECKING":"False"}'

[mmMOLINARI]

It worked with the env parameter in the command line!
I had changed the .ansible.cfg file used by Ansible AWX at my home directory. What's the location for the ansible.cfg file used by the StackStorm user? I am running the commands as st2admin

[mmMOLINARI]

Here is how to pass credentials using the command line (assuming they are not inside the playbook):
st2 run ansible.playbook playbook=/home/awxuser/icx_facts.yml inventory_file="/home/awxuser/hosts" env='{"ANSIBLE_HOST_KEY_CHECKING":"False"}' extra_vars='["ansible_user=admin","ansible_password=your_password"]'

[mmMOLINARI]

Hi,
Now I am having trouble trying to add the environment variable to the ansible.playbook action in the StackStorm Web UI:

When I ran the workflow it complains a boolean value is not accepted:
(
"output": null,
"errors": [
{
"type": "error",
"message": "Execution failed. See result for details.",
"task_id": "icx_facts",
"result": {
"error": "expected str, bytes or os.PathLike object, not bool",
"traceback": " File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2actions/container/base.py", line 132, in _do_run\n (status, result, context) = runner.run(action_params)\n File "/opt/stackstorm/st2/lib/python3.6/site-packages/local_runner/local_shell_script_runner.py", line 52, in run\n return self._run(action=action)\n File "/opt/stackstorm/st2/lib/python3.6/site-packages/local_runner/base.py", line 206, in _run\n read_stderr_buffer=stderr,\n File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2common/util/green/shell.py", line 150, in run_command\n bufsize=bufsize,\n File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2common/util/concurrency.py", line 82, in subprocess_popen\n return subprocess.Popen(*args, **kwargs)\n File "/opt/stackstorm/st2/lib/python3.6/site-packages/eventlet/green/subprocess.py", line 58, in init\n subprocess_orig.Popen.init(self, args, 0, *argss, **kwds)\n File "/usr/lib/python3.6/subprocess.py", line 729, in init\n restore_signals, start_new_session)\n File "/usr/lib/python3.6/subprocess.py", line 1275, in _execute_child\n env_list.append(k + b'=' + os.fsencode(v))\n File "/usr/lib/python3.6/os.py", line 800, in fsencode\n filename = fspath(filename) # Does type-checking of filename.\n"
}
}
]
}

What is the correct syntax to add the environment variable in the UI?
Thanks!

[mmMOLINARI]

easy fix. enclosed false in " "