Ansible 1.6 + Vagrant 1.6 ssh forwarding doesn't look like it's working

Question

Provisioning with a git task on vagrant + ansible doesn't appear to be working, guessing the problem is ssh-forwarding.

If I ssh into the box, I can git clone just fine. I can look with ssh-add -L and see my key has indeed been forwarded.

When I run vagrant provision though, I get:

failed: [ss_app] => {"changed": false, "cmd": "/usr/bin/git ls-remote git@github.com:org/app.git -h refs/heads/master", "failed": true, "item": "", "rc": 128}
stderr: Permission denied (publickey).
fatal: The remote end hung up unexpectedly

On the task:

- name: install from git
  git: >
    repo={{ app.repo }} 
    dest={{ app.home }} 
    version={{ app.version }} 
    accept_hostkey=yes
    update=yes

With this in my ansible.cfg:

[defaults]
transport = ssh

[ssh_connection]
ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes -A

I've also tried using:

Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
  config.vm.provision "ansible" do |ansible|
    ansible.playbook = "provision.yml"
    ansible.inventory_path = "hosts/vagrant"
    ansible.sudo = true
    ansible.host_key_checking = false
    ansible.verbose =  'vvvv'
    ansible.extra_vars = { 
                           ansible_ssh_user: 'vagrant', 
                           ansible_connection: 'ssh',
                           ansible_ssh_args: '-o ForwardAgent=yes'
                         }
end

Per some other stack overflow questions. None of these work, though.

Thoughts?

---

Edit:

# -*- mode: ruby -*-
# vi: set ft=ruby :

# Vagrantfile API/syntax version. Don't touch unless you know what you're doing!
VAGRANTFILE_API_VERSION = "2"

Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
  config.vm.provision "ansible" do |ansible|
    ansible.playbook = "provision.yml"
    ansible.inventory_path = "hosts/vagrant"
    ansible.sudo = true
    ansible.host_key_checking = false
    ansible.verbose =  'vvvv'
    ansible.extra_vars = { 
                           ansible_ssh_user: 'vagrant', 
                           ansible_connection: 'ssh',
                           ansible_ssh_args: '-o ForwardAgent=yes -A'
                         }
    # ansible.limit = 'all'
  end

  config.ssh.forward_agent = true

  config.vm.define :ss_app do |ss_app_config|
    ss_app_config.vm.box = "precise64"
    ss_app_config.vm.box_url = "http://cloud-images.ubuntu.com/vagrant/precise/current/precise-server-cloudimg-amd64-vagrant-disk1.box"

    ss_app_config.vm.network :private_network, ip: "10.1.100.100"
    ss_app_config.vm.network :forwarded_port, guest: 22, host: 2222, id: 'ssh', auto_correct: true

    ss_app_config.ssh.forward_agent = true

    ss_app_config.vm.provider :virtualbox do |virtualbox|
      virtualbox.customize ["modifyvm", :id, "--memory", "1024"]
    end
  end
end

^^ There's more of my Vagrantfile.

And here's the command being run: /usr/bin/git ls-remote git@github.com:org/app.git -h refs/heads/master

If I login via vagrant ssh then run that command, it works fine, only fails during the provision.

Answer 1

I had the same issue myself just the past few days. The solutions you have tried are overly-complicated as some of them were for earlier versions of Vagrant and Ansible.

Here is something simpler and cleaner:

1. Set sudo: no to the "install from git" task. (For sudo by default, You can leave ansible.sudo = true in Vagrantfile or do sudo: yes at the play for other tasks)
2. Make sure ss_app_config.ssh.forward_agent = true is there
3. Remove from your Vagrantfile, ansible.host_key_checking, ansible.extra_vars as they are not required for ssh agent forwarding.
4. Remove ansible.cfg file, not needed

Hopefully, it works for you.

Answer 2

My solution to a similar issue was to make SSH agent-forward works with sudo with the following ansible tasks:

- name: Copy sudoers file for safety
  command: cp -f /etc/sudoers /etc/sudoers.tmp

- name: Create sudoers file backup
  command: cp -f /etc/sudoers /etc/sudoers.bak

- name: Create admins group
  group: name=admins system=yes state=present

- name: make sure we can sudo as admin group
  lineinfile: dest=/etc/sudoers.tmp state=present regexp='^%admin' line='%admin ALL=(ALL) ALL'

- name: Make sure ssh-agent works via sudo
  lineinfile: dest=/etc/sudoers.tmp state=present regexp='^Defaults env_keep\+\=SSH_AUTH_SOCK' line='Defaults env_keep+=SSH_AUTH_SOCK'

- name: Final sudoers file check
  shell: visudo -q -c -f /etc/sudoers.tmp && cp -f /etc/sudoers.tmp /etc/sudoers

Answer 3

You can (should) enable SSH-Forwarding via Vagrant settings:

Vagrant.configure("2") do |config|

  config.vm.box = "..."

  config.ssh.forward_agent = true

  config.vm.provision "ansible" do |ansible|
    ansible.playbook = "playbook.yml"
    ansible.verbose = 'v'
  end

end

Note that as of Vagrant 1.6.0 (with ansible.verbose enabled), the ansible-playbook command used by Vagrant is showed (useful for debugging).

If you still have problem, could you please provide a Vagrantfile example and the ansible-playbook command generated by your vagrant provision run?