Using dns_name

[spiglee]

I am trying to understand how to use the new dns_name option that was implemented in the following feature addition in order to reach out to a host via FQDN rather than IP for making a Kerberos connection to a host. Being that FQDN is required when using Kerberos, this is necessary to make this work for dynamic ansible inventories. The documentation I feel has gaps in explaining how to use this. Can anyone provide an example of how to make this work?

#394

My example netbox_inventory.yml file:

plugin: netbox.netbox.nb_inventory
api_endpoint: http://hostname:8000
token: tokenishere
validate_certs: False
config_context: False
dns_name: True
interfaces: True
group_by:

• tags
  query_filters:
• tag: windows

My group_vars all.yaml file:

ansible_user: [email protected]
ansible_password: password-here
ansible_connection: winrm
ansible_port: 5986
ansible_winrm_transport: kerberos
ansible_winrm_server_cert_validation: validate
ansible_winrm_ca_trust_path: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

I don't know what else I need to put in place to make it use the dns_name when running a playbook rather than the IP. What am I missing?

[nahun]

Hello,
Setting the dns_name option only creates a host variable named dns_name with the value from the device or virtual machine's primary IP. To force Ansible to use the dns_name instead of the inventory_hostname to connect to you need to set the ansible_host variable. You should be able to set it in your group_vars like this:

ansible_host: "{{ dns_name }}"

[spiglee]

I did add the entry of "dns_name: True" into my dynamic inventory file where the other Netbox items are, such as Netbox api_endpoint and token (and other settings). When I run an ansible-inventory against it, it does come back and return the proper values for my hosts right under the top level for each hostname next to an entry named "dns_name": "host.fqdn.here". So it looks like the dns_name: true entry is working.

However, When I add the above to my group_vars (I'm just working with an all.yaml file for now) along with the rest of my various ansible entries like you see in my original post, it still is not working. When I do something simple like a win_ping and pass -vvvv, it clearly shows that it's trying to connect to an IP and not the FQDN. This is still causing problems if I try to use Kerberos due to the need for FQDN. If I change the above ansible_winrm_* settings from kerberos to ntlm for the transport, it works fine, but I'm sure that's just due to the fact that ntlm works fine with IP. Here is what my group_vars looks like right now:

---
ansible_user: [email protected]
ansible_password: password
ansible_connection: winrm
ansible_port: 5986
ansible_winrm_transport: kerberos
ansible_host: "{{dns_name}}"
ansible_winrm_server_cert_validation: ignore
ansible_winrm_ca_trust_path: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

Something else must be getting missed here.

[nahun]

To test, try adding the ansible_host var to a host_vars file for a specific host. Might be it doesn't work with group_vars like that.

[spiglee]

I created an XXXXX.yaml file named after one of my hosts and put this in it and this particular host did in fact use the dns_name:

ansible_host: "{{ dns_name }}"

I guess this is just turning into some Ansible 101 type stuff for me now. I need to figure out how to get this applied to all hosts of a particular group or from a particular inventory, then. If I have to create a host_vars file for every host then I 100% defeat the purpose of even having a dynamic inventory. I'll keep searching for my answer, but this is at least progress in making this option work now.

[drehelis]

I've submitted #434 that should fix this from the nb_inventory module perspective. I'm not entirely sure this is the right approach thought.

[spiglee]

Ah, well that explains it. I must have misunderstood that this solved my particular issue after having submitted my original issue a couple of months back related to this: #378

[nahun]

@spiglee, sorry I should have been clear on that. And your use case is definitely something that should be covered I think.

[drehelis]

@nahun, If users would still want to expose dns_name in host_vars without having ansible use it in ansible_host, they could use interfaces: true in conjunction with dns_name: false. This should work according to your PR, right? Not the most elegant way but still something :-)

[nahun]

Heh, thats true, but something I wouldn't want to rely on. I would add another option to have it use dns_name as the ansible_host.

[FragmentedPacket]

Yeah I'm totally sorry about all this confusion and closing the original issue for setting the DNS name as the ansible host.

I will comment on @autogun PR since we will want a separate option for this.

[FragmentedPacket]

@spiglee This should be fixed in the 2.1.0 release of the collection which I'm working on releasing now.

It should be available by tomorrow.

[FragmentedPacket]

Thanks to @autogun for the contribution to make this possible!

[spiglee]

It appears that I just need to add "ansible_host_dns_name" to the inventory file and set to "True" and this will work, correct? That's what I just did and it appears now that I am getting inventory back and it's using the FQDN.

[FragmentedPacket]

Correct. It requires an additional option.

[spiglee]

Perfect, looks like it is working as I was hoping it would. I appreciate the work done to get this into place!