Ansible Setting through Multiple Bastion Hosts

Use Case Description

In some network environments, the Ansible master on which the playbook resides does not have direct routing towards the Target host. The picture below shows an example of such a use case.

Scenario where Ansible multi-hop is required

The Ansible Master does not have the IP reachability of the Target host. It needs to access multiple nodes before reaching the target.

Possible Solution

One solution for this scenario is the usage of Bastion host or Transient host using the -J (ProxyJump) option of SSH configuration.

Possible Solution

One way to implement this solution is by implementing an SSH tunnel passing through the transient host up to the target host. A local port binding is also created with -L flag:

ssh  -J user_1@transient_host1:port_1 -p port_2 user_2@transient_host2  -L LOCAL_PORT:TARGET_HOST_IP:TARGET_HOST_PORT

Then we can directly enter into Target Host using the local binding:

ssh user_target_host@localhost -p LOCAL_PORT

In this way, we can run Ansible playbooks on the local host configuring Ansible variables accordingly:

ansible_host: localhost
ansible_user: user_target_host
ansible_port: LOCAL_PORT
ansible_password: password_target_host

By setting up the SSH tunnel in this manner, the tunnel is built through each transient host (bastion1 and bastion2) up to the target.

The local port binding on the Ansible master machine ensures that traffic is forwarded correctly through the chain of bastion hosts to the target host.