google.cloud.iap connection – connect via SSH through Google Cloud’s Identity Aware Proxy (IAP)
Note
This connection plugin is part of the google.cloud collection (version 1.8.0).
You might already have this collection installed if you are using the ansible package.
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install google.cloud.
To use it in a playbook, specify: google.cloud.iap.
Synopsis
This connection plugin behaves almost like the stock SSH plugin, but it creates a new IAP process per host in the inventory so connections are tunneled through it.
Parameters
Parameter |
Comments |
|---|---|
This is the location to save SSH’s ControlPath sockets, it uses SSH’s variable substitution. Be aware that this setting is ignored if Configuration:
|
|
This sets the directory to use for ssh control path if the control path setting is null. Also, provides the ``%(directory)s`` variable for the control path setting. Default: Configuration:
|
|
A file to read the access token from. The credentials of the active account (if exists) will be ignored. Configuration:
|
|
Google cloud account to use for invocation. Configuration:
|
|
If set, points to non-standard gcloud configuration. Configuration:
|
|
Path to the gcloud executable, defaults to whatever is found in the PATH environment variable. Configuration:
|
|
The Google Cloud project ID to use for this invocation. If omitted, then the current active project is assumed. Configuration:
|
|
The Google Cloud zone to use for the instance(s). Configuration:
|
|
Google Cloud instance name to connect to. Default: Configuration:
|
|
Determines if SSH should reject or not a connection after checking host keys. Choices:
Configuration:
|
|
Path to the UserKnownHosts file storing SSH fingerprints. Defaults to the same file used by `gcloud compute ssh` Default: Configuration:
|
|
Authentication password for the Configuration:
|
|
Mechanism to use for handling ssh password prompt Choices:
Configuration:
|
|
Pipelining reduces the number of connection operations required to execute a module on the remote server, by executing many Ansible modules without actual file transfers. This can result in a very significant performance improvement when enabled. However this can conflict with privilege escalation ( Choices:
Configuration:
|
|
PKCS11 SmartCard provider such as opensc, e.g. /usr/local/lib/opensc-pkcs11.so Default: Configuration:
|
|
Remote port to connect to. Configuration:
|
|
Private key contents in PEM format. Requires the Configuration:
|
|
Path to private key file to use for authentication. Default: Configuration:
|
|
Private key passphrase, dependent on This does NOT have any effect when used with Configuration:
|
|
Number of attempts to connect. Ansible retries connections only if it gets an SSH error with a return code of 255. Any errors with return codes other than 255 indicate an issue with program execution. Default: Configuration:
|
|
User name with which to login to the remote server, normally set by the remote_user keyword. If no user is supplied, Ansible will let the SSH client binary choose the user as it normally. Configuration:
|
|
This defines the location of the scp binary. It defaults to Default: Configuration:
|
|
Extra exclusive to the Default: Configuration:
|
|
When set to When set to Choices:
Configuration:
|
|
This defines the location of the sftp binary. It defaults to Default: Configuration:
|
|
Extra exclusive to the Default: Configuration:
|
|
arguments to pass to all ssh cli tools. Default: Configuration:
|
|
common extra args for all ssh cli tools. Default: Configuration:
|
|
This defines the location of the SSH binary. It defaults to This option is usually not required, it might be useful when access to system SSH is restricted, or when using SSH wrappers to connect to remote hosts. Default: Configuration:
|
|
Extra exclusive to the SSH CLI. Default: Configuration:
|
|
Preferred method to use when transferring files over ssh Choices:
Configuration:
|
|
Password prompt that Supported by sshpass 1.06 and up when Defaults to Defaults to Default: Configuration:
|
|
This is the default amount of time we will wait while establishing an SSH connection. It also controls how long we can wait to access reading the connection once established (select on the socket). Default: Configuration:
|
|
add -tt to ssh commands to force tty allocation. Choices:
Configuration:
|
|
Requested verbosity level for the SSH CLI. Default: Configuration:
|
Note
Configuration entries listed above for each entry type (Ansible variable, environment variable, and so on) have a low to high priority order. For example, a variable that is lower in the list will override a variable that is higher up. The entry types are also ordered by precedence from low to high priority order. For example, an ansible.cfg entry (further up in the list) is overwritten by an Ansible variable (further down in the list).
Notes
Note
This plugin requires you to have configured gcloud authentication prior to using it. You can change the active configuration used, but the plugin won’t auth for you.
This plugin is mostly a wrapper to the ``ssh`` CLI utility and the exact behavior of the options depends on this tool. This means that the documentation provided here is subject to be overridden by the CLI tool itself.
Many options default to
Nonehere but that only means we do not override the SSH tool’s defaults and/or configuration. For example, if you specify the port in this plugin it will override anyPortentry in your.ssh/config.The ssh CLI tool uses return code 255 as a ‘connection error’, this can conflict with commands/tools that also return 255 as an error code and will look like an ‘unreachable’ condition or ‘connection error’ to this plugin.