Ansible Tower执行Playbook遇Host localhost is unreachable错误求助

Playbook结构 #

入口文件report.yaml #

- hosts: localhost
  gather_facts: false
  connection: local
  tasks:
        - name: "Execute"
          include_role:
            name: 'fusion'

fusion角色的main.yaml #

- name: "hc fusion"
      include_tasks: "hc_fusion.yaml"

fusion角色的hc_fusion.yaml #

- name: "FUSION"
  shell: ansible-playbook roles/fusion/tasks/fusion.yaml --extra-vars 'fusion_ip_ha={{item.ip}} fusion_user={{item.username}} fusion_pass={{item.password}} fecha="{{fecha.stdout}}" fusion_ansible_become_user={{item.ansible_become_user}} fusion_ansible_become_pass={{item.ansible_become_pass}}'

fusion角色的fusion.yaml #

- hosts: localhost
  vars:
    ansible_become_user: "{{fusion_ansible_become_user}}"
    ansible_become_pass: "{{fusion_ansible_become_pass}}"
  tasks:
      - name: Validate
        ignore_unreachable: yes
        shell: service had status
        delegate_to: "{{fusion_user}}@{{fusion_ip_ha}}"
        become: True
        become_method: su

错误信息 #

stdout: PLAY [localhost]
TASK [Validate] [1;31mfatal: [localhost -> gandalf@10.66.173.14]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: Warning: Permanently added '10.66.173.14' (RSA) to the list of known hosts.
gandalf@10.66.173.14: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password), "skip_reason": "Host localhost is unreachable"

已知正常场景 #

• 使用awx用户在命令行直接执行ansible-playbook roles/fusion/tasks/fusion.yaml --extra-vars XXXXXXXX可正常运行
• 从Ansible Tower所在服务器用awx用户SSH连接目标主机无需输入密码

排查方向及解决方案 #

1. 修复嵌套Playbook的环境丢失问题 #

当前通过shell模块嵌套调用ansible-playbook，Tower的上下文环境（如SSH代理、用户环境变量）无法传递给子进程，导致SSH密钥无法被正确读取。

优化方案：
删除嵌套的Playbook调用，直接在角色中编写验证逻辑：
修改hc_fusion.yaml为：

- name: "FUSION Validate"
  ignore_unreachable: yes
  shell: service had status
  delegate_to: "{{item.username}}@{{item.ip}}"
  become: True
  become_method: su
  vars:
    ansible_become_user: "{{item.ansible_become_user}}"
    ansible_become_pass: "{{item.ansible_become_pass}}"
    ansible_ssh_private_key_file: "/var/lib/awx/.ssh/id_rsa"  # 替换为awx用户实际私钥路径
  loop: "{{ your_host_list }}"  # 替换为实际主机列表变量

2. 显式指定SSH密钥路径 #

Tower执行任务时，可能未加载awx用户的完整环境，导致无法找到SSH私钥。在验证任务中直接指定密钥路径：
修改fusion.yaml的Validate任务：

- name: Validate
  ignore_unreachable: yes
  shell: service had status
  delegate_to: "{{fusion_user}}@{{fusion_ip_ha}}"
  become: True
  become_method: su
  vars:
    ansible_ssh_private_key_file: "/var/lib/awx/.ssh/id_rsa"
    ansible_become_user: "{{fusion_ansible_become_user}}"
    ansible_become_pass: "{{fusion_ansible_become_pass}}"

3. 处理主机密钥验证问题 #

错误提示显示主机密钥被首次添加，说明Tower执行用户的known_hosts无该主机记录，可能触发连接拦截。

• 手动初始化：切换到awx用户，执行ssh gandalf@10.66.173.14，确认主机密钥被添加到/var/lib/awx/.ssh/known_hosts
• 临时禁用检查（不推荐生产环境）：在任务中添加变量ansible_ssh_common_args: "-o StrictHostKeyChecking=no"

4. 确认Become权限配置 #

检查目标主机上，fusion_user是否能无密码切换到ansible_become_user，或确认fusion_ansible_become_pass变量是否正确传递。可在目标主机执行su - [ansible_become_user]验证权限。

内容的提问来源于stack exchange，提问作者cekodis681 cekodis681