Does semaphore not support having different credentials in a single inventory?

[Elekam]

Hello,

Im new to semaphore and have been wondering how to handle hosts having different ssh-keys, usernames and sudo passwords inside an inventory?

Is it expected/required that all hosts inside a single inventory have the same credentials or how do you give semaphore the correct credentials for the different hosts?

When I create an inventory it gives me the option to give a single user credential and sudo credential, so I assume that is the case?

Thanks a lot in advance!

[fiftin]

Currently it is not possible.

I research ability to implement this and didn't find solution. We use ssh-agent and it is not possible to provide multiple SSH keys for single call of ansible-playbook.

[fiftin]

GitHub Copilot suggestions:

To address the issue of managing hosts with different SSH keys, usernames, and sudo passwords within a single inventory in Semaphore, you can consider the following approaches:

1. Multiple Inventories:

   • Create separate inventories for different sets of credentials. Each inventory would have its own credentials, and you can manage hosts accordingly.

2. Dynamic Inventory Script:

   • Use a dynamic inventory script that can fetch host-specific credentials from a source like a database or an external vault. This script can provide the correct credentials for each host dynamically when running ansible-playbook.

3. Ansible Vault:

   • Store different SSH keys, usernames, and sudo passwords encrypted with Ansible Vault and configure playbooks to decrypt and use these credentials as needed.

4. SSH Configurations:

   • Utilize .ssh/config to define host-specific SSH configurations. This file can specify different keys, usernames, and other options for different hosts.

5. Custom SSH Agent:

   • Implement a custom SSH agent that can handle multiple keys and provide the appropriate key for each host during the Ansible playbook execution.

[typkrft]

In my case I needed different sudo passwords per host. I created secrets in a group var and referenced them in the inventory.

server:
  hosts:
    some-server:
      ansible_host: 10.x.x.x
      ansible_become_password: '{{ lookup("env", "some_secret") }}'

The ability to use signed CA certs would be great. At least in my case I've set up my signed certs to authenticate with Pam ssh agent auth on each server avoiding the need to use a password for sudo when using a signed cert.

[Kai78]

Wouldn't it be possible with ssh agent restrictions as described here: https://www.openssh.com/agent-restrict.html

[Sheenam3]

A practical solution for SSH logins via semaphore playbook is to utilize a shared SSH key, ensuring it is copied to every host. This task can be automated using Ansible. By implementing this method, you eliminate the need for entering an ID and password for SSH access.