[SOLVED] Can't ping Terraform created droplets with Ansible

Issue

Using Terraform I have created 3 droplets on DigitalOcean. While doing it, in folder I have been writing SSH key and creating inventory.txt file.

Here is how it look in Terraform code:

resource "local_file" "servers_ipv4" {
  content   = join("\n", [
    for idx, s in module.openvpn_do_infrastructure_module.servers_ipv4:
      <<EOT
${var.droplet_names[idx]} ansible_host=${s} ansible_user=root ansible_ssh_private_key=openvpn_do_ssh.key
      EOT
  ])
  filename  = "${path.module}/ansible/inventory.txt"
}

resource "local_file" "ssh_keys" {
  content   = module.openvpn_do_infrastructure_module.ssh_keys
  filename  = "${path.module}/ansible/openvpn_do_ssh.key"
}

Then, I have ansible folder. After execution of the script and creating droplets in this folder I have 3 files. First file, is just ansible.cfg:

[defaults]
host_key_checking   = false
inventory           = ./inventory.txt

The other 2 are created by Terraform. It's SSH key - openvpn_do_ssh.key and inventory.txt:

certificate-authority-server ansible_host=123.123.123.121 ansible_user=root ansible_ssh_private_key=openvpn_do_ssh.key

openvpn-server ansible_host=123.123.123.122 ansible_user=root ansible_ssh_private_key=openvpn_do_ssh.key

nextcloud-server ansible_host=123.123.123.123 ansible_user=root ansible_ssh_private_key=openvpn_do_ssh.key

And here is the problem. When I do ansible all -m ping, I get errors:

certificate-authority-server | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: [email protected]: Permission denied (publickey).",
    "unreachable": true
}
nextcloud-server | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: [email protected]: Permission denied (publickey).",
    "unreachable": true
}
openvpn-server | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: [email protected]: Permission denied (publickey).",
    "unreachable": true
}

Also, I can connect to those droplets with SSH and everything is just fine. Even when I change permission to .key file, I still have the same error. I was trying to get more logs with -vvv flags, and here is the most interesting info I found:

ESTABLISH SSH CONNECTION FOR USER: root
...
<123.123.123.121> (255, b'', b"Warning: Permanently added '123.123.123.121' (ED25519) to the list of known hosts.\r\[email protected]: Permission denied (publickey).\r\n")
<123.123.123.121> (255, b'', b'[email protected]: Permission denied (publickey).\r\n')

Solution

I have solved this problem. This is what has helped me:

1. First of all, I have changed the extension of SSH key file from .key to .pem.
2. To ansible.cfg I have added next line:

[defaults]
host_key_checking   = false
inventory           = ./inventory.txt
inventory           = ./inventory.txt
private_key_file    = ./openvpn_do_ssh.pem

3. The last thing I have done, is adding read-only file_permission for SSH key.

resource "local_file" "ssh_keys" {
  content   = module.openvpn_do_infrastructure_module.ssh_keys
  filename  = "${path.module}/ansible/openvpn_do_ssh.pem"
  content         = module.openvpn_do_infrastructure_module.ssh_keys
  filename        = "${path.module}/ansible/openvpn_do_ssh.pem"
  file_permission = "0400"
}

Hope it can help someone...

Answered By - dokichan

Answer Checked By - Senaida (WPSolving Volunteer)