Seven years ago, I wrote a quick post on bootstrapping servers into Ansible. The basic gist of the post was that you can use variables on the Ansible command-line to specify hosts that aren’t part of your inventory or log in via a different user (useful if the host doesn’t yet have a dedicated Ansible user account because you want to use Ansible to create that account). Recently, though, I encountered a situation where this approach doesn’t work, and in this post I’ll describe the workaround.

In one of the Slack communities I frequent, someone asked about using the approach described in the original blog post. However, they were having issues connecting. Specifically, this error was cropping up in the Ansible output (names have been changed to protect the innocent):

fatal: [new-server.int.domain.test]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: [email protected]: Permission denied (publickey,password).", "unreachable": true}

Now, this is odd, because the Ansible command-line being executed included the parameters I mentioned in the original blog post:

ansible-playbook bootstrap.yml -i inventory/hosts -K --extra-vars "hosts=new-server.int.domain.test user=john"

For some reason, though, it was ignoring that parameter and attempting to connect as ansible. At first, I thought this was just an SSH error, but the person assured me that they were definitely able to SSH into the specified host as the specified user.

That was when we found the difference between this environment and the environment I’d used: in this environment, the ansible_user variable was defined in the specified inventory file. I hadn’t defined ansible_user. Could that be it?

I asked the person to try specifying ansible_user instead of user on the command line, like so:

ansible-playbook bootstrap.yml -i inventory/hosts -K --extra-vars "hosts=new-server.int.domain.test ansible_user=john"

It worked!

So, the key takeaway is: if you’re thinking of using this bootstrapping technique with your Ansible environment, be sure to specify ansible_user on the Ansible command-line if you’ve defined ansible_user in your inventory. Otherwise, you should be able to just use user.

Credit for finding this issue with the approach I described in the original blog post, and for testing the workaround, goes to James Cox. Thanks James! As always, feel free to reach out to me on Twitter—or find me in any of the Slack communities I regularly visit—and ask questions, provide feedback, or just say hello. I’d love to hear from you.

…

Read MoreFollow Up: Bootstrapping Servers into Ansible

Welcome to Technology Short Take #151, the first Technology Short Take of 2022. I hope everyone had a great holiday season and that 2022 is off to a wonderful start! I have a few more links than normal this time around, although I didn’t find articles in a couple categories. Don’t worry—I’ll keep my eyes peeled and my RSS reader ready to pull in new articles in those categories for next time. And now for the content!

Networking

• Mike Fiedler explores differences in ways for container-to-container communication to occur.
• Aidan Steele examines how VPC sharing could potentially improve security and reduce cost.
• What do you think microsegmentation means?
• Nick Schmidt talks about using GitOps with the NSX Advanced Load Balancer.

Servers/Hardware

• The Next Platform takes a look at Amazon’s Graviton3 processor.
• Ru Singh provides a review of his M1-based MacBook Air.
• Here’s a great review of the Framework laptop.
• Losing to Apple—whose M-series chips are widely regarded as faster and more efficient than Intel’s chips—has apparently stung the chip giant into revving up the innovation engine. These details on their 12th-generation H processors shows that Intel appears to be intent to regain the lead. Time will tell how successful they are.
• Chris Evans revisits the discussion regarding Arm processor architectures in the public cloud.
• And, speaking of Arm processor architectures in the public cloud, here’s another look at Amazon’s Graviton2 and Graviton3 chips, as discussed in a pair of re:Invent talks.

Security

• Kat Traxler considers the impact of the Log4J vulnerability in cloud-based environments.
• I was very glad to see this blog post about the financial future of the GnuPG project.
• The story of a developer deliberately polluting their open source projects—as outlined here for the “colors.js” and “faker.js” libraries hosted on NPM—is a software supply chain issue that I suspect many organizations hadn’t considered. Now they’re going to have to start accounting for this possibility.
• Cross-platform malware. Ugh.
• Orca Security discusses the “Superglue” vulnerability in AWS Glue.

Cloud Computing/Cloud Management

• Benoît Bouré explains how to use short-lived credentials to access AWS resources from GitHub Actions.
• Ivan Velichko has a detailed article on Kubernetes API resources, kinds, and objects.
• Sander Rodenhuis wrote an article on security policies in Kubernetes. The post focuses on Otomi, which in turn leverages Open Policy Agent and Gatekeeper.
• Michael Gasch pontificates on Knative’s missteps in this post from June 2021.
• Yann Léger and Alisdair Broshar talk about the technology stack behind the Koyeb Serverless Engine.
• Lydia Leong has a great idea: why not improve cloud resilience using things that actually work, instead of chasing the multi-cloud failover unicorn? There’s some useful and practical advice here, in my opinion.
• Via the Kubernetes blog, Rory McCune of Aqua Security provides some guidelines for securing admission controllers.

Operating Systems/Applications

• I recently had a need to do a multicast DNS lookup, and this article was critical in figuring out how to use dig to do it.
• If you need a quick start for HashiCorp Vault, this one worked really well for me. I found it easier/better than the documentation on the HashiCorp web site, in fact.
• Dennis Felsing shares some thoughts on switching to macOS after 15 years on Linux.
• Running Docker on an M1 Max-based system? This article may provide some useful information.
• Here’s some information on why Microsoft Exchange stopped delivering e-mail messages on January 1, 2022.
• Mark Brookfield has started a series on automating SSL certificate issuance and renewal using HashiCorp Vault Agent, here’s part 1.
• Julia Evans has a quick post on finding a domain’s authoritative name servers. I was already familiar with this process, but I appreciate that there are lots of folks out there who may not have had to ever do this.
• Here’s a handy list of secret phone codes you can use. Some of these I already knew, but a few of them were new to me. Neat.
• The founder of the Nginx project recently stepped away from the project. Read more here.
• BIOS updates without a reboot, and under Linux first? Yes please!

That’s all for now. I hope this was useful in some way! If you have any feedback for me—constructive criticism, praise, suggestions for where I can find more articles (especially if the site supports RSS!), feel free to reach out. I’d love to hear from you! You can reach me on Twitter, or hit me up in any one of a number of different Slack communities.

…

Read MoreTechnology Short Take 151