ansible/docs/man/man1/ansible.1.asciidoc.in

262 lines
6.6 KiB
Text
Raw Normal View History

ansible(1)
=========
:doctype:manpage
:man source: Ansible
:man version: %VERSION%
:man manual: System administration commands
NAME
----
ansible - run a task on a target host(s)
SYNOPSIS
--------
ansible <host-pattern> [-m module_name] [-a args] [options]
DESCRIPTION
-----------
*Ansible* is an extra-simple tool/framework/API for doing \'remote things'.
This is the adhoc command that allows for a \'single task playbook' run.
ARGUMENTS
---------
*host-pattern*::
A name of a group in the inventory, a shell-like glob selecting
hosts in inventory or any combination of the two separated by commas.
OPTIONS
-------
2015-07-22 08:56:50 +00:00
*-a* \'_ARGUMENTS_', *--args=*\'_ARGUMENTS_'::
2012-08-15 14:13:38 +00:00
2015-07-22 08:56:50 +00:00
The 'ARGUMENTS' to pass to the module.
*-b*, *--become*::
Use privilege escalation (specific one depends on become_method),
this does not imply prompting for passwords.
*-K*, *--ask-become-pass*::
Ask for privilege escalation password.
2015-07-22 08:56:50 +00:00
*-k*, *--ask-pass*::
Prompt for the connection password, if it is needed for the transport used.
For example, using ssh and not having a key-based authentication with ssh-agent.
2015-07-22 08:56:50 +00:00
*--ask-su-pass*::
Prompt for su password, used with --su (deprecated, use become).
2015-07-22 08:56:50 +00:00
*--ask-sudo-pass*::
2015-07-22 08:56:50 +00:00
Prompt for the password to use with --sudo, if any (deprecated, use become).
2015-07-22 08:56:50 +00:00
*--ask-vault-pass*::
Prompt for vault password.
*-B* 'NUM', *--background=*'NUM'::
Run commands in the background, killing the task after 'NUM' seconds.
*--become-method=*'BECOME_METHOD'::
Privilege escalation method to use (default=sudo),
valid choices: [ sudo | su | pbrun | pfexec | runas | doas | dzdo ]
2015-07-22 08:56:50 +00:00
*--become-user=*'BECOME_USER'::
Run operations as this user (default=root).
2015-07-22 08:56:50 +00:00
*-C*, *--check*::
Do not make any changes on the remote system, but test resources to see what might
have changed. Note this can not scan all possible resource types and is only
a simulation.
2015-07-22 08:56:50 +00:00
*-c* 'CONNECTION', *--connection=*'CONNECTION'::
Connection type to use. Most common options are 'paramiko' (SSH), 'ssh', 'winrm'
2015-07-22 08:56:50 +00:00
and 'local'. 'local' is mostly useful for crontab or kickstarts.
*-e* 'EXTRA_VARS, *--extra-vars=*'EXTRA_VARS'::
2015-07-22 08:56:50 +00:00
Extra variables to inject into a playbook, in key=value key=value format or
as quoted YAML/JSON (hashes and arrays). To load variables from a file, specify
the file preceded by @ (e.g. @vars.yml).
*-f* 'NUM', *--forks=*'NUM'::
Level of parallelism. 'NUM' is specified as an integer, the default is 5.
2015-07-22 08:56:50 +00:00
*-h*, *--help*::
2015-07-22 08:56:50 +00:00
Show help message and exit.
*-i* 'PATH', *--inventory=*'PATH'::
The 'PATH' to the inventory, which defaults to '/etc/ansible/hosts'.
2016-06-29 18:31:25 +00:00
Alternatively you can use a comma separated list of hosts or single host with trailing comma 'host,'.
2015-07-22 08:56:50 +00:00
*-l* 'SUBSET', *--limit=*'SUBSET'::
Further limits the selected host/group patterns.
2016-02-18 07:29:58 +00:00
You can prefix it with '~' to indicate that the pattern is a regex.
2015-07-22 08:56:50 +00:00
*--list-hosts*::
Outputs a list of matching hosts; does not execute anything else.
*-m* 'NAME', *--module-name=*'NAME'::
Execute the module called 'NAME'.
*-M* 'DIRECTORY', *--module-path=*'DIRECTORY'::
The 'DIRECTORY' search path to load modules from. The default is
'/usr/share/ansible'. This can also be set with the ANSIBLE_LIBRARY
environment variable.
2015-07-22 08:56:50 +00:00
*-o*, *--one-line*::
2015-07-22 08:56:50 +00:00
Try to output everything on one line.
2015-07-22 08:56:50 +00:00
*-P* 'NUM', *--poll=*'NUM'::
2015-07-22 08:56:50 +00:00
Poll a background job every 'NUM' seconds. Requires *-B*.
2015-07-22 08:56:50 +00:00
*--private-key=*'PRIVATE_KEY_FILE'::
2015-07-22 08:56:50 +00:00
Use this file to authenticate the connection.
2015-07-22 08:56:50 +00:00
*-S*, *--su*::
2015-07-22 08:56:50 +00:00
Run operations with su (deprecated, use become).
*-R* 'SU_USER', *--se-user=*'SUDO_USER'::
Run operations with su as this user (default=root) (deprecated, use become).
*-s*, *--sudo*::
Run the command as the user given by -u and sudo to root (deprecated, use become).
*--ssh-common-args=*''-o ProxyCommand="ssh -W %h:%p ..." ...''::
Squashed commit of the following: commit 9921bb9d2002e136c030ff337c14f8b7eab0fc72 Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Mon Aug 10 20:19:44 2015 +0530 Document --ssh-extra-args command-line option commit 8b25595e7b1cc3658803d0821fbf498c18ee608a Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Thu Aug 13 13:24:57 2015 +0530 Don't disable GSSAPI/Pubkey authentication when using --ask-pass This commit is based on a bug report and PR by kolbyjack (#6846) which was subsequently closed and rebased as #11690. The original problem was: «The password on the delegated host is different from the one I provided on the command line, so it had to use the pubkey, and the main host doesn't have a pubkey on it yet, so it had to use the password.» (This commit is revised and included here because #11690 would conflict with the changes in #11908 otherwise.) Closes #11690 commit 119d0323892c65e8169ae57e42bbe8e3517551a3 Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Thu Aug 13 11:16:42 2015 +0530 Be more explicit about why SSH arguments are added This adds vvvvv log messages that spell out in detail where each SSH command-line argument is obtained from. Unfortunately, we can't be sure if, say, self._play_context.remote_user is obtained from ANSIBLE_REMOTE_USER in the environment, remote_user in ansible.cfg, -u on the command line, or an ansible_ssh_user setting in the inventory or on a task or play. In some cases, e.g. timeout, we can't even be sure if it was set by the user or just a default. Nevertheless, on the theory that at five v's you can use all the hints available, I've mentioned the possible sources in the log messages. Note that this caveat applies only to the arguments that ssh.py adds by itself. In the case of ssh_args and ssh_extra_args, we know where they are from, and say so, though we can't say WHERE in the inventory they may be set (e.g. in host_vars or group_vars etc.). commit b605c285baf505f75f0b7d73cb76b00d4723d02e Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Tue Aug 11 15:19:43 2015 +0530 Add a FAQ entry about ansible_ssh_extra_args commit 49f8edd035cd28dd1cf8945f44ec3d55212910bd Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Mon Aug 10 20:48:50 2015 +0530 Allow ansible_ssh_args to be set as an inventory variable Before this change, ssh_args could be set only in the [ssh_connection] section of ansible.cfg, and was applied to all hosts. Now it's possible to set ansible_ssh_args as an inventory variable (directly, or through group_vars or host_vars) to selectively override the global setting. Note that the default ControlPath settings are applied only if ssh_args is not set, and this is true of ansible_ssh_args as well. So if you want to override ssh_args but continue to set ControlPath, you'll need to repeat the appropriate options when setting ansible_ssh_args. (If you only need to add options to the default ssh_args, you may be able to use the ansible_ssh_extra_args inventory variable instead.) commit 37c1a5b6794cee29a7809ad056a86365a2c0f886 Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Mon Aug 10 19:42:30 2015 +0530 Allow overriding ansible_ssh_extra_args on the command-line This patch makes it possible to do: ansible somehost -m setup \ --ssh-extra-args '-o ProxyCommand="ssh -W %h:%p -q user@bouncer.example.com"' This overrides the inventory setting, if any, of ansible_ssh_extra_args. Based on a patch originally by @Richard2ndQuadrant. commit b023ace8a8a7ce6800e29129a27ebe8bf6bd38e0 Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Mon Aug 10 19:06:19 2015 +0530 Add an ansible_ssh_extra_args inventory variable This can be used to configure a per-host or per-group ProxyCommand to connect to hosts through a jumphost, e.g.: inventory: [gatewayed] foo ansible_ssh_host=192.0.2.1 group_vars/gatewayed.yml: ansible_ssh_extra_args: '-o ProxyCommand="ssh -W %h:%p -q bounceuser@gateway.example.com"' Note that this variable is used in addition to any ssh_args configured in the [ssh_connection] section of ansible.cfg (so you don't need to repeat the ControlPath settings in ansible_ssh_extra_args).
2015-09-03 15:26:56 +00:00
Add the specified arguments to any sftp/scp/ssh command-line. Useful to
set a ProxyCommand to use a jump host, but any arguments that are
accepted by all three programs may be specified.
*--sftp-extra-args=*''-f ...''::
Add the specified arguments to any sftp command-line.
*--scp-extra-args=*''-l ...''::
Add the specified arguments to any scp command-line.
*--ssh-extra-args=*''-R ...''::
Add the specified arguments to any ssh command-line.
Squashed commit of the following: commit 9921bb9d2002e136c030ff337c14f8b7eab0fc72 Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Mon Aug 10 20:19:44 2015 +0530 Document --ssh-extra-args command-line option commit 8b25595e7b1cc3658803d0821fbf498c18ee608a Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Thu Aug 13 13:24:57 2015 +0530 Don't disable GSSAPI/Pubkey authentication when using --ask-pass This commit is based on a bug report and PR by kolbyjack (#6846) which was subsequently closed and rebased as #11690. The original problem was: «The password on the delegated host is different from the one I provided on the command line, so it had to use the pubkey, and the main host doesn't have a pubkey on it yet, so it had to use the password.» (This commit is revised and included here because #11690 would conflict with the changes in #11908 otherwise.) Closes #11690 commit 119d0323892c65e8169ae57e42bbe8e3517551a3 Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Thu Aug 13 11:16:42 2015 +0530 Be more explicit about why SSH arguments are added This adds vvvvv log messages that spell out in detail where each SSH command-line argument is obtained from. Unfortunately, we can't be sure if, say, self._play_context.remote_user is obtained from ANSIBLE_REMOTE_USER in the environment, remote_user in ansible.cfg, -u on the command line, or an ansible_ssh_user setting in the inventory or on a task or play. In some cases, e.g. timeout, we can't even be sure if it was set by the user or just a default. Nevertheless, on the theory that at five v's you can use all the hints available, I've mentioned the possible sources in the log messages. Note that this caveat applies only to the arguments that ssh.py adds by itself. In the case of ssh_args and ssh_extra_args, we know where they are from, and say so, though we can't say WHERE in the inventory they may be set (e.g. in host_vars or group_vars etc.). commit b605c285baf505f75f0b7d73cb76b00d4723d02e Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Tue Aug 11 15:19:43 2015 +0530 Add a FAQ entry about ansible_ssh_extra_args commit 49f8edd035cd28dd1cf8945f44ec3d55212910bd Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Mon Aug 10 20:48:50 2015 +0530 Allow ansible_ssh_args to be set as an inventory variable Before this change, ssh_args could be set only in the [ssh_connection] section of ansible.cfg, and was applied to all hosts. Now it's possible to set ansible_ssh_args as an inventory variable (directly, or through group_vars or host_vars) to selectively override the global setting. Note that the default ControlPath settings are applied only if ssh_args is not set, and this is true of ansible_ssh_args as well. So if you want to override ssh_args but continue to set ControlPath, you'll need to repeat the appropriate options when setting ansible_ssh_args. (If you only need to add options to the default ssh_args, you may be able to use the ansible_ssh_extra_args inventory variable instead.) commit 37c1a5b6794cee29a7809ad056a86365a2c0f886 Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Mon Aug 10 19:42:30 2015 +0530 Allow overriding ansible_ssh_extra_args on the command-line This patch makes it possible to do: ansible somehost -m setup \ --ssh-extra-args '-o ProxyCommand="ssh -W %h:%p -q user@bouncer.example.com"' This overrides the inventory setting, if any, of ansible_ssh_extra_args. Based on a patch originally by @Richard2ndQuadrant. commit b023ace8a8a7ce6800e29129a27ebe8bf6bd38e0 Author: Abhijit Menon-Sen <ams@2ndQuadrant.com> Date: Mon Aug 10 19:06:19 2015 +0530 Add an ansible_ssh_extra_args inventory variable This can be used to configure a per-host or per-group ProxyCommand to connect to hosts through a jumphost, e.g.: inventory: [gatewayed] foo ansible_ssh_host=192.0.2.1 group_vars/gatewayed.yml: ansible_ssh_extra_args: '-o ProxyCommand="ssh -W %h:%p -q bounceuser@gateway.example.com"' Note that this variable is used in addition to any ssh_args configured in the [ssh_connection] section of ansible.cfg (so you don't need to repeat the ControlPath settings in ansible_ssh_extra_args).
2015-09-03 15:26:56 +00:00
2015-07-22 08:56:50 +00:00
*-U* 'SUDO_USERNAME', *--sudo-user=*'SUDO_USERNAME'::
Sudo to 'SUDO_USERNAME' default is root. (deprecated, use become).
2015-07-22 08:56:50 +00:00
*-t* 'DIRECTORY', *--tree=*'DIRECTORY'::
Save contents in this output 'DIRECTORY', with the results saved in a
file named after each host.
*-T* 'SECONDS', *--timeout=*'SECONDS'::
Connection timeout to use when trying to talk to hosts, in 'SECONDS'.
*-u* 'USERNAME', *--user=*'USERNAME'::
Use this 'USERNAME' to login to the target host, instead of the current user.
2015-07-22 08:56:50 +00:00
*--vault-password-file=*'VAULT_PASSWORD_FILE'::
2012-09-06 22:42:18 +00:00
A file containing the vault password to be used during the decryption of vault encrypted files.
Be sure to keep this file secured if it is used. If the file is executable,
it will be run and its standard output will be used as the password.
2015-07-22 08:56:50 +00:00
*-v*, *--verbose*::
Verbose mode, more output from successful actions will be shown.
Give up to three times for more output.
2015-07-22 08:56:50 +00:00
*--version*::
2015-07-22 08:56:50 +00:00
Show program version number and exit.
INVENTORY
---------
Ansible stores the hosts it can potentially operate on in an inventory.
This can be an ini-like file, a script, directory or a list.
The ini syntax is one host per line. Groups headers are allowed and
are included on their own line, enclosed in square brackets that start the line.
Ranges of hosts are also supported. For more information and
2014-02-11 15:55:10 +00:00
additional options, see the documentation on http://docs.ansible.com/.
ENVIRONMENT
-----------
2014-02-11 15:50:10 +00:00
The following environment variables may be specified.
ANSIBLE_INVENTORY -- Override the default ansible inventory file
ANSIBLE_LIBRARY -- Override the default ansible module library path
ANSIBLE_CONFIG -- Override the default ansible config file
Many more are available for most options in ansible.cfg
FILES
-----
/etc/ansible/hosts -- Default inventory file
/usr/share/ansible/ -- Default module library
/etc/ansible/ansible.cfg -- Config file, used if present
~/.ansible.cfg -- User config file, overrides the default config if present
AUTHOR
------
Ansible was originally written by Michael DeHaan.
See the AUTHORS file for a complete list of contributors.
COPYRIGHT
---------
Copyright © 2012, Michael DeHaan
Ansible is released under the terms of the GPLv3 License.
SEE ALSO
--------
*ansible-playbook*(1), *ansible-pull*(1), *ansible-doc*(1), *ansible-vault*(1), *ansible-galaxy*(1)
Extensive documentation is available in the documentation site:
<http://docs.ansible.com>. IRC and mailing list info can be found
in file CONTRIBUTING.md, available in: <https://github.com/ansible/ansible>