Ansible源码解析：在动态清单中使用Host Variable存储ssh登录凭证

（本文基于Ansible 2.7）

前两天有位朋友问到是否可以使用用户名+口令的登录方式来代替预先分发RSA公钥到目标主机以实现免密登录的方式，这无疑是可以的，而且很简单。只需要在Inventory中给host增加两个variable，它们分别是：

• ansible_ssh_user
• ansible_ssh_pass
  并安装sshpass包，以便使用非交互的方式提供登录口令。

在lib/ansible/constants.py中定义了一个字典——MAGIC_VARIABLE_MAPPING ：

MAGIC_VARIABLE_MAPPING = dict(

    # base
    connection=('ansible_connection', ),
    module_compression=('ansible_module_compression', ),
    shell=('ansible_shell_type', ),
    executable=('ansible_shell_executable', ),

    # connection common
    remote_addr=('ansible_ssh_host', 'ansible_host'),
    remote_user=('ansible_ssh_user', 'ansible_user'),
    password=('ansible_ssh_pass', 'ansible_password'),
    port=('ansible_ssh_port', 'ansible_port'),
    pipelining=('ansible_ssh_pipelining', 'ansible_pipelining'),
    timeout=('ansible_ssh_timeout', 'ansible_timeout'),
    private_key_file=('ansible_ssh_private_key_file', 'ansible_private_key_file'),

    # networking modules
    network_os=('ansible_network_os', ),
    connection_user=('ansible_connection_user',),

    # ssh TODO: remove
    ssh_executable=('ansible_ssh_executable', ),
    ssh_common_args=('ansible_ssh_common_args', ),
    sftp_extra_args=('ansible_sftp_extra_args', ),
    scp_extra_args=('ansible_scp_extra_args', ),
    ssh_extra_args=('ansible_ssh_extra_args', ),
    ssh_transfer_method=('ansible_ssh_transfer_method', ),

    # docker TODO: remove
    docker_extra_args=('ansible_docker_extra_args', ),

    # become
    become=('ansible_become', ),
    become_method=('ansible_become_method', ),
    become_user=('ansible_become_user', ),
    become_pass=('ansible_become_password', 'ansible_become_pass'),
    become_exe=('ansible_become_exe', ),
    become_flags=('ansible_become_flags', ),

    # deprecated
    sudo=('ansible_sudo', ),
    sudo_user=('ansible_sudo_user', ),
    sudo_pass=('ansible_sudo_password', 'ansible_sudo_pass'),
    sudo_exe=('ansible_sudo_exe', ),
    sudo_flags=('ansible_sudo_flags', ),
    su=('ansible_su', ),
    su_user=('ansible_su_user', ),
    su_pass=('ansible_su_password', 'ansible_su_pass'),
    su_exe=('ansible_su_exe', ),
    su_flags=('ansible_su_flags', ),
)

这个字典使用来做变量名映射的（这句是废话，看命名就看出来了）
简单总结一下，就是如果发现有变量存在于该字典的values中，则将该变量的值赋给变量名为values对应的key的变量。如：变量中如果存在ansible_ssh_port或ansible_port，那么它的值会被赋给port。

下面是ansible源码的分析过程：
MAGIC_VARIABLE_MAPPING 这个字典主要在lib/ansible/playbook/play_context.py中的set_task_and_variable_override方法有多处使用，其中涉及本文的，在366-379行：

        attrs_considered = []
        for (attr, variable_names) in iteritems(C.MAGIC_VARIABLE_MAPPING):
            for variable_name in variable_names:
                if attr in attrs_considered:
                    continue
                # if delegation task ONLY use delegated host vars, avoid delegated FOR host vars
                if task.delegate_to is not None:
                    if isinstance(delegated_vars, dict) and variable_name in delegated_vars:
                        setattr(new_info, attr, delegated_vars[variable_name])
                        attrs_considered.append(attr)
                elif variable_name in variables:
                    setattr(new_info, attr, variables[variable_name])
                    attrs_considered.append(attr)
                # no else, as no other vars should be considered

set_task_and_variable_override这个方法在StrategyBase._execute_meta和TaskExecutor._execute中调用，variables是传入的参数。其中，TaskExecutor._execute由TaskExecutor.run调用，而TaskExecutor.run又是WorkerProcess.run中实际执行task并返回结果的核心内容（详见lib/ansible/executor/process/worker.py）,在WorkerProcess中的变量是包含了host variable的。正是在WorkerProcess.run去具体执行一个任务的时候，把inventory中的host变量ansible_ssh_user和ansible_ssh_pass的值覆盖到了PlayContext的remote_user，password。

remote_user和password这两个变量的使用，在两个connection plugin中：

lib/ansible/plugins/ssh.py中的_build_command方法,549-559行，做了sshpass环境的相关检查，就是看有没有安装这个包:

        if self._play_context.password:
            if not self._sshpass_available():
                raise AnsibleError("to use the 'ssh' connection type with passwords, you must install the sshpass program")

614-620行，拼接了登录的用户名:

        user = self._play_context.remote_user
        if user:
            self._add_args(
                b_command,
                (b"-o", b"User=" + to_bytes(self._play_context.remote_user, errors='surrogate_or_strict')),
                u"ANSIBLE_REMOTE_USER/remote_user/ansible_user/user/-u set"
            )

_bare_run方法的793-804行，写入口令：

        # If we are using SSH password authentication, write the password into
        # the pipe we opened in _build_command.

        if self._play_context.password:
            os.close(self.sshpass_pipe[0])
            try:
                os.write(self.sshpass_pipe[1], to_bytes(self._play_context.password) + b'\n')
            except OSError as e:
                # Ignore broken pipe errors if the sshpass process has exited.
                if e.errno != errno.EPIPE or p.poll() is None:
                    raise
            os.close(self.sshpass_pipe[1])

lib/ansible/plugins/paramiko_ssh.py的_connect_uncached方法，353-363行，用用户名和口令执行ssh连接：

            ssh.connect(
                self._play_context.remote_addr.lower(),
                username=self._play_context.remote_user,
                allow_agent=allow_agent,
                look_for_keys=self.get_option('look_for_keys'),
                key_filename=key_filename,
                password=self._play_context.password,
                timeout=self._play_context.timeout,
                port=port,
                **ssh_connect_kwargs
            )

以及479-486行的_connect_sftp方法（许多传输文件的操作，例如fetch模块，如果使用paramiko_ssh连接目标，就是使用sftp来实现的）：

    def _connect_sftp(self):

        cache_key = "%s__%s__" % (self._play_context.remote_addr, self._play_context.remote_user)
        if cache_key in SFTP_CONNECTION_CACHE:
            return SFTP_CONNECTION_CACHE[cache_key]
        else:
            result = SFTP_CONNECTION_CACHE[cache_key] = self._connect().ssh.open_sftp()
            return result

OK，至此在动态清单中使用Host Variable存储ssh登录凭证并使用改凭证连接目标主机的过程就说完了。其实最有参考意义的是MAGIC_VARIABLE_MAPPING 这个字典。除ansible_ssh_user和ansible_ssh_pass之外，还有其他的诸多变量，可以放置在host variable中，并起到相应的作用。