cloudalchemy / ansible-node-exporter

Provision basic metrics exporter for prometheus monitoring tool
MIT License
501 stars 270 forks source link

Fix privilege escalation ('become') on localhost. #246

Closed eliba closed 2 years ago

eliba commented 3 years ago

For some context: In my local setup, passwords ansible_password and ansible_become_password get automatically set through group_vars/all.yml:

ansible_password: "{{ lookup('passwordstore', 'IT/system_logins/' + inventory_hostname + '/' + ansible_user) }}"
ansible_become_password: "{{ lookup('passwordstore', 'IT/system_logins/' + inventory_hostname + '/' + ansible_user) }}"

Those vars are preserved when doing delegate_to: localhost and tasks fail when the requested password does not exist. (AFAIK localhost is not part of group all, but since it gets delegated from one of the hosts in ansible_play_batch, those vars are preserved)

If such a password entry exists, the task runs through flawlessly (although the password does not get used), but if the password entry does not exist, the lookup plugin will fail.

Thanks for the work that went into this role already, it is a great one that gets the job done!

stale[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

eliba commented 2 years ago

tickling the stale bot