{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible/issues/11908","labels_url":"https://api.github.com/repos/ansible/ansible/issues/11908/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible/issues/11908/comments","events_url":"https://api.github.com/repos/ansible/ansible/issues/11908/events","html_url":"https://github.com/ansible/ansible/pull/11908","id":100079644,"number":11908,"title":"Add ansible_ssh_extra_args inventory variable","user":{"login":"amenonsen","id":23628,"avatar_url":"https://avatars.githubusercontent.com/u/23628?v=3","gravatar_id":"","url":"https://api.github.com/users/amenonsen","html_url":"https://github.com/amenonsen","followers_url":"https://api.github.com/users/amenonsen/followers","following_url":"https://api.github.com/users/amenonsen/following{/other_user}","gists_url":"https://api.github.com/users/amenonsen/gists{/gist_id}","starred_url":"https://api.github.com/users/amenonsen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amenonsen/subscriptions","organizations_url":"https://api.github.com/users/amenonsen/orgs","repos_url":"https://api.github.com/users/amenonsen/repos","events_url":"https://api.github.com/users/amenonsen/events{/privacy}","received_events_url":"https://api.github.com/users/amenonsen/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ansible/ansible/labels/feature_pull_request","name":"feature_pull_request","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-08-10T14:25:50Z","updated_at":"2015-08-11T14:59:40Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/ansible/ansible/pulls/11908","html_url":"https://github.com/ansible/ansible/pull/11908","diff_url":"https://github.com/ansible/ansible/pull/11908.diff","patch_url":"https://github.com/ansible/ansible/pull/11908.patch"},"body":"This PR does two things: (1) adds an ``ansible_ssh_extra_args`` inventory variable, and (2) makes it possible to override on the command-line. When it's set, the specified arguments are added to the ssh command for a host/group/everyone. This is applied in addition to any ``ssh_args`` configured in ``ansible.cfg``, so there's no need to repeat the default ``ControlPath`` settings. (Note that ``ssh_args`` **cannot** be set as an inventory variable, so it's all hosts or nothing.)\r\n\r\nThe primary use of this feature is to specify a per-host or per-group ``ProxyCommand`` in the inventory to use a \"jump host\". Of course, it may have other uses as well, depending on the complexity of the ssh configuration.\r\n\r\nThis is an oft-requested feature, and it's the minimum common feature to both PRs #9122 (by @sivel) and #9477 (by @nitzmahone), which seek to make it easier to use by assembling the proxy command from simpler settings. Both of those PRs are currently outdated, not being worked on actively, and complex enough that they seem unlikely to make it to v2. In contrast, this PR is very low-impact, and I've tested that it's sufficient to set a jump host. It also will not conflict with the more user-friendly change attempted in the PRs referenced above, should they be resurrected in future.\r\n\r\nI consulted @bcoca on the implementation via IRC, and he seemed to agree that this was the least intrusive way to implement the desired feature."},"comment":{"url":"https://api.github.com/repos/ansible/ansible/issues/comments/129919228","html_url":"https://github.com/ansible/ansible/pull/11908#issuecomment-129919228","issue_url":"https://api.github.com/repos/ansible/ansible/issues/11908","id":129919228,"user":{"login":"amenonsen","id":23628,"avatar_url":"https://avatars.githubusercontent.com/u/23628?v=3","gravatar_id":"","url":"https://api.github.com/users/amenonsen","html_url":"https://github.com/amenonsen","followers_url":"https://api.github.com/users/amenonsen/followers","following_url":"https://api.github.com/users/amenonsen/following{/other_user}","gists_url":"https://api.github.com/users/amenonsen/gists{/gist_id}","starred_url":"https://api.github.com/users/amenonsen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amenonsen/subscriptions","organizations_url":"https://api.github.com/users/amenonsen/orgs","repos_url":"https://api.github.com/users/amenonsen/repos","events_url":"https://api.github.com/users/amenonsen/events{/privacy}","received_events_url":"https://api.github.com/users/amenonsen/received_events","type":"User","site_admin":false},"created_at":"2015-08-11T14:59:39Z","updated_at":"2015-08-11T14:59:39Z","body":"@nitzmahone Thanks for taking a look.\r\n\r\nCould you please expand on your concerns about merging ssh args? I just went through every option documented in the ``ssh_config(5)`` manpage. The majority are yes/no; some take an integer; some take an alphanumeric word; some take comma-separated lists of alphanumeric words; some take paths, perhaps with patterns. None of those is a problem. The port forwarding and tunnelling options are only very slightly more complex. ``ProxyCommand`` and ``LocalCommand`` are the only two that seem at all esoteric in terms of the values they accept, and ``ProxyCommand`` is only passed to the local ssh process, so it's not exactly a quoting hazard either.\r\n\r\nAnd on the other hand, even if we were to use only an ``ansible_ssh_args`` inventory variable, it wouldn't be all-or-nothing, because ``ssh.py`` is going to merge extra ``-o Blah`` arguments in **anyway**. So the only practical effect of insisting on doing it that way would be to force everyone to repeat ``ControlPath`` settings EVERY time they want to set a ProxyCommand (or live without ``ControlPath``, I suppose). I cannot see how that is desirable.\r\n\r\nSure, someone might screw up the quoting while setting ``ansible_ssh_extra_args`` in an inventory file, but that applies equally to ``ansible_ssh_args``, and they would end up with either a YAML parsing error (more likely) or a local ssh error and have to look at what's being executed with ``-vvvv``. Maybe not fun, but it's certainly not been nightmarish for me (and I even have this one two-level jump host setup that I hate, but can't get rid of either).\r\n\r\nCould you outline a specific situation in which you are concerned that adding user-specified extra ``-o`` args would cause more problems than adding the standard ``-o`` args to a user-specified ``ansible_ssh_args``? I confess I don't follow what you mean with ``-F``, since that just uses an alternate configuration file (and that works fine for me, with or without this patch). Is it the ``shlex`` stuff you're worried about? Because we'd have to keep doing that even if we only set ``ansible_ssh_args``.\r\n\r\nP.S. I'm curious, what do you have in mind in terms of first-class support for agent forwarding? I mean, it's just a yes/no setting. What would Ansible have to do with it?"}}