Package: teleport-ansible
Teleport Inventory DocumentationThis is a very simple package which will use Teleport as a dynamic inventory
source for Ansible. The script assumes you've logged in and have access to the
teleport service. Examples of all the base requirements are provided within this
readme.Checkouthttps://cloudnull.io/2022/09/ansible-inventory-via-teleportfor a more
indepth review of integrating Teleport with Ansible.Using the teleport-ansible inventory scriptThe script will read machines and return JSON information from teleport. Once the
return information is sourced, it will format the inventory using the node name
as the target host and the labels as hostvars and groups.Using teleport-ansible requires a little setup, mostly client side for Teleport itself.Installing teleport-ansible and using itInstalling theteleport-ansibleinventory script can be accomplished withpip.pipinstallteleport-ansibleThe teleport-inventory script can also be installed using the git repository directly.pipinstallgit+https://github.com/cloudnull/teleport-ansibleIf you don't want to install the script, you can also simply download the script using
the hard link and run it from wherever you want.curlhttps://raw.githubusercontent.com/cloudnull/teleport-ansible/master/teleport-inventory.py-oteleport-inventory.pyExample SSH configuration connect through TeleportCreate a compatible SSH configuration for Teleport.exportTELEPORT_DOMAIN=teleport.example.comexportTELEPORT_USER=cloudnull
cat>~/.ssh/teleport.cfg<<EOFHost * !${TELEPORT_DOMAIN}UserKnownHostsFile "${HOME}/.tsh/known_hosts"IdentityFile "${HOME}/.tsh/keys/${TELEPORT_DOMAIN}/${TELEPORT_USER}"CertificateFile "${HOME}/.tsh/keys/${TELEPORT_DOMAIN}/${TELEPORT_USER}-ssh/${TELEPORT_DOMAIN}-cert.pub"PubkeyAcceptedKeyTypes +ssh-rsa-cert-v01@openssh.comPort 3022CheckHostIP noProxyCommand "$(which tsh)" proxy ssh --cluster=${TELEPORT_DOMAIN} --proxy=${TELEPORT_DOMAIN} %r@%h:%pEOFThe above ssh configuration needs to have all variables replaced to work.Example Ansible SetupWhen running this inventory, Ansible requires some basic instructions which can
be set via environment variables or through an Ansible config file.exportANSIBLE_SCP_IF_SSH=FalseexportANSIBLE_SSH_ARGS="-F${HOME}/.ssh/teleport.cfg"exportANSIBLE_INVENTORY_ENABLED=scriptexportANSIBLE_HOST_KEY_CHECKING=FalseexportANSIBLE_INVENTORY="$(command-vteleport-ansible)"The ${HOME}/.ssh/teleport.cfg file is generated by using thetsh configcommand then customized based on individual needs.Example login processtshlogin--proxy=teleport.example.com--user=teleport-admin

Ifbrowserwindowdoesnotopenautomatically,openitbyclickingonthelink:http://127.0.0.1:42337/83facfc0-e899-44dc-aa6c-32179e3d5b0b
>ProfileURL:https://teleport.example.com:443Loggedinas:teleport-adminCluster:teleport.example.comRoles:accessLogins:root,ubuntu,debian,fedora,centos,-teleport-internal-joinKubernetes:enabledValiduntil:2022-09-1608:03:05-0500CDT[validfor12h0m0s]Extensions:permit-agent-forwarding,permit-port-forwarding,permit-ptyThe above tsh login will provide access to the teleport cluster, which
will allow you to run inventory script which will return an Ansible
inventory JSON.Example inventory returnRunning the teleport inventory commandteleport-inventorywill return something
like this.>>>{..."_meta":{..."hostvars":{..."alluvial-0":{..."ansible_user":"ubuntu",..."teleport_id":1663292578982084621,..."arch":"x86_64",..."codename":"jammy",..."environment":"dev"...},..."compute-0":{..."ansible_user":"carter",..."teleport_id":1663292546493240726,..."arch":"x86_64",..."codename":"jammy",..."environment":"prod"...},..."curator-0":{..."ansible_user":"debian",..."teleport_id":1663292584620339609,..."arch":"x86_64",..."codename":"bullseye",..."environment":"prod"...},..."plexmediaserver-0":{..."ansible_user":"debian",..."teleport_id":1663292540612813467,..."arch":"x86_64",..."codename":"bullseye",..."environment":"prod"...},..."rtmprelay-0":{..."ansible_user":"debian",..."teleport_id":1663292583673456110,..."arch":"x86_64",..."codename":"bullseye",..."environment":"prod"...},..."teleport-0":{..."ansible_user":"debian",..."teleport_id":1663292588270337453,..."arch":"x86_64",..."codename":"bullseye",..."environment":"prod"...},..."thelounge-0":{..."ansible_user":"debian",..."teleport_id":1663292533524229273,..."arch":"x86_64",..."codename":"bullseye",..."environment":"prod"...},..."unbound-0":{..."ansible_user":"debian",..."teleport_id":1663292535344206453,..."arch":"x86_64",..."codename":"bullseye",..."environment":"prod"...},..."unifi-0":{..."ansible_user":"debian",..."teleport_id":1663292528952201832,..."arch":"x86_64",..."codename":"bullseye",..."environment":"prod"...},..."wireguard-0":{..."ansible_user":"debian",..."teleport_id":1663292535570354336,..."arch":"x86_64",..."codename":"bullseye",..."environment":"prod"...}...}...},..."all":{..."hosts":[..."alluvial-0",..."compute-0",..."curator-0",..."plexmediaserver-0",..."rtmprelay-0",..."teleport-0",..."thelounge-0",..."unbound-0",..."unifi-0",..."wireguard-0"...],..."children":[]...},..."x86_64":{..."hosts":[..."alluvial-0",..."compute-0",..."curator-0",..."plexmediaserver-0",..."rtmprelay-0",..."teleport-0",..."thelounge-0",..."unbound-0",..."unifi-0",..."wireguard-0"...],..."children":[]...},..."jammy":{..."hosts":[..."alluvial-0",..."compute-0"...],..."children":[]...},..."dev":{..."hosts":[..."alluvial-0"...],..."children":[]...},..."teleport_cloudnull_dev":{..."hosts":[..."wireguard-0"...],..."children":[]...},..."prod":{..."hosts":[..."compute-0",..."curator-0",..."plexmediaserver-0",..."rtmprelay-0",..."teleport-0",..."thelounge-0",..."unbound-0",..."unifi-0",..."wireguard-0"...],..."children":[]...},..."bullseye":{..."hosts":[..."curator-0",..."plexmediaserver-0",..."rtmprelay-0",..."teleport-0",..."thelounge-0",..."unbound-0",..."unifi-0",..."wireguard-0"...],..."children":[]...}...}Once the ssh config is in place, the Ansible configuration is set, and
teleport is logged in, Ansible can be run natively.Example Ansible Ad-Hoc commandYou'll notice that the command is SUPER basic. There's nothing special here.ansible-mpingallExample Ansible Playbook commandJust like the ad-hoc command, there's nothing special when running playbooks either.ansible-playbookexample-playbook.yaml