ansible - Repo will not clone, "Permission Denied", using git module -
i've looked @ similar questions, not found answer yet.
i can ssh in server (ubuntu 16.04) , clone git repo manually. leaves me believe isn't sshforwardagent issue.
the error pretty typical:
"cloning bare repository '/home/deploy/apps/myproject/production/cached-copy'...", "permission denied (publickey).", "fatal: not read remote repository.",
ansible.cnf:
[ssh_connection] ssh_args = -o forwardagent=yes
the role looks this:
- name: update bare git repository become_user: "{{ deploy_user }}" git: repo: "git@github.com:myuser/myproject.git" dest: "{{ deploy_to }}/cached-copy" version: "{{ branch }}" bare: yes update: yes accept_hostkey: yes ssh_opts: "-o stricthostkeychecking=no -o forwardagent=yes"
the verbose output ansible is:
"changed": false, "cmd": "/usr/bin/git clone --bare '' /home/deploy/apps/myproject/production/cached-copy", "failed": true, "invocation": { "module_args": { "accept_hostkey": true, "bare": true, "clone": true, "depth": null, "dest": "/home/deploy/apps/myproject/production/cached-copy", "executable": null, "force": false, "key_file": null, "recursive": true, "reference": null, "refspec": null, "remote": "origin", "repo": "git@github.com:myuser/myproject.git", "ssh_opts": "-o stricthostkeychecking=no -o forwardagent=yes", "track_submodules": false, "umask": null, "update": true, "verify_commit": false, "version": "master"
use of myuser , myproject retract such information.
one thing looks suspect cmd
not contain repo url, normal?
if change -o forwardagent=yes
-a
different error: timeout (12s) waiting privilege escalation prompt
.
also know agentforward working because if ssh in server , ssh -t git@github.com
expected "you've authenticated, github not provide shell access.".
please note not want install private key on server.
update: here gist of verbose output: https://gist.github.com/krisleech/8bfbf817c237258a672b3b3393fea8dd
on other hand seems work fine:
- name: "test github" command: ssh -t git@github.com
from verbose output see that:
- first, ssh remote box
admin
user ,forwardagent=yes
- then, sudo
deploy
run ansible task (git module)
this scenario described in comments, when doing sudo (with usual settings) disable ssh agent access.
to make work, either need ssh deploy
user directly (and not admin->deploy
), or setup sudo
on destination box allow keeping environment variables, see this answer details.
add
defaults env_keep+=ssh_auth_sock
sudoers
Comments
Post a Comment