fix(proxmox_lxc_provision): post-clone privilege escalation and SSH key regen var name
The user-module tasks in post-clone.yml were running without become, so modifying /etc/passwd failed with 'usermod: Permission denied' when the connection user (e.g. admin) was non-root. Add become: true to both password tasks. Block-level become is avoided because the known_hosts task in the same file is delegate_to: localhost and should not sudo on the controller. Also fix the variable name passed to the system_setup ssh tasks_from: post-clone.yml was setting 'regenerate_ssh_keys', but ssh.yml gates on 'regenerate_ssh_host_keys'. The mismatch caused cloned containers to silently keep the source template's SSH host keys.
This commit is contained in:
@@ -4,6 +4,7 @@
|
||||
name: root
|
||||
password: "{{ lxc_root_password | password_hash('sha512') }}"
|
||||
update_password: always
|
||||
become: true
|
||||
when: lxc_root_password is defined
|
||||
|
||||
- name: Change user password
|
||||
@@ -11,6 +12,7 @@
|
||||
name: "{{ lxc_user_name }}"
|
||||
password: "{{ lxc_user_password | password_hash('sha512') }}"
|
||||
update_password: always
|
||||
become: true
|
||||
when: lxc_user_password is defined
|
||||
|
||||
- name: Regenerate SSH host keys
|
||||
@@ -18,7 +20,7 @@
|
||||
name: system_setup
|
||||
tasks_from: ssh
|
||||
vars:
|
||||
regenerate_ssh_keys: true
|
||||
regenerate_ssh_host_keys: true
|
||||
|
||||
- name: Remove previous entry from known hosts
|
||||
ansible.builtin.known_hosts:
|
||||
|
||||
Reference in New Issue
Block a user