Unable to execute script/command on a different node

[skp15]

Hello,

I followed the instructions here - https://docs.rundeck.com/docs/manual/creating-jobs.html#node-dispatching-and-filtering to execute a command on a different node other than the Rundeck node.

Even though I select this node (Node B), the job runs on the local node. Am I doing something incorrect or can you please suggest me any other alternative approach?

Regards,

[rac...@rundeck.com]

Hi,

Which Rundeck version are you using? Could you share the job definition example to test? (please include the node filter).

Regards!

[skp15]

I am using Rundeck 4.8.0.

For now, I am testing to dispatch on one other node. But eventually, I want to have 13 nodes that matches the filter. The only key word in all these 13 instances is "mirth".

I am trying to run a simple "uname -a" on that external node.

Attached is the job definition.

[rac...@rundeck.com]

Hi,

I've checked your job definition, try changing your filter by:

`name: your-node`

If you want to match to multiple nodes use a wildcard like: `mynode.*`.

You can see the node filter syntax here.

Greetings.

[skp15]

It selecting the right node after I apply the filter but it's still running locally. I am not sure where I am going wrong.

[rac...@rundeck.com]

Hi,

Could you share your model source file? (resources.yaml or resources.xml) Please hide or change any sensitive information.

Regards.

[skp15]

Hi,

Where do I find that? Also, is there anything incorrect in the images that I have captured above?

[rac...@rundeck.com]

It seems correct. Probably your remote node is using the localhost info.

To see your available model sources Go to Project Settings > Edit Nodes.

(you can see the available remote nodes on the "Sources" tab and you can see/edit the file content on the Edit tab > Modify button.

More info here.

Regards.

[skp15]

I have 3 node sources. One is the local source, one for EC2 from the same AWS account as where Rundeck is hosted, and another source for a different AWS account in the same organization.

How can I check that remote node is using the localhost info? And how to modify that?

[rac...@rundeck.com]

Hi!

Check my last message:

To see your available model sources Go to Project Settings > Edit Nodes.

(you can see the available remote nodes on the "Sources" tab and you can see/edit the file content on the Edit tab > Modify button.)

Another possible cause could be the default node executor, probably it's defined as a "local".  Go to Project Settings > Edit Configuration > Default Node Executor (tab) and check the default node executor defined, make sure to use SSH (or SSHJ). Take a look at this.

Pretty sure that's the reason.

Let me know! Greetings!

[skp15]

Yes, that's the problem.

Looks like if I change the `Default Node Executor` for one project, all the other projects were updated to this setting.

Also, I want to SSH into about 15 nodes/EC2 instances. How do I go about this?

[rac...@rundeck.com]

The best approach is to use the EC2 model source (available here). Please, take a look at this.

With this plugin, you can use your AWS creds/cert and set a map of nodes in your Rundeck instance.

Hope it helps!

[skp15]

I already have listed the set of nodes. I can see it under the `Nodes` section in the project.

I want to run remote commands on these nodes. I don't have AWS creds/cert of the another account where I have to run remote commands on. So, I think SSH is the better option?

Should I allow the Rundeck local node to have permissions to run SSH on the remote nodes?

Here's the screenshot of remote node sources.

[rac...@rundeck.com]

Yes, the traditional SSH way should work in that case. Just make sure to configure the Security Groups correctly (to access EC2 instances).

Greetings!

[skp15]

Will try that.

Thank you!

[skp15]

I created the ssh keys from within the Rundeck machine and added the public key under the authorized_keys of the node that I want to authenticate to, but I am receiving this error when I run the job.

Failed: AuthenticationFailure: Authentication failure connecting to node: "node-name". Could not authenticate.

Any suggestions?

[rac...@rundeck.com]

Hi,

1. Make sure to access the remote machine from the rundeck server "manually".

2. Try changing the SSH node executor, if you're using an ed25519 key, a good solution is to use SSHJ instead of the default SSH node executor.

3. Make sure that you're well defined the model source, take a look at this step-by-step guide.

Regards.

[skp15]

Hello,

1. Yes, I am able to SSH into the remote machine from Rundeck server manually.
2. I am using RSA key and updated the private key to -----BEGIN RSA PRIVATE KEY-----
3. I am using the model source as AWS EC2 resources and not from resources.yaml/xml file. Is that okay?
4. I have stored the SSH keys under keys/Rundeck, will the uppercase R make any issue?

Also, the SSH keys are getting deleted if the Rundeck container/machine is restarted. Any suggestions to have permanent SSH keys?

[rac...@rundeck.com]

Hi, could you test using the resources.yaml/xml way? like any other usual ssh node.

[skp15]

Hi,

Is this the right documentation to follow for that effort?

https://stackoverflow.com/questions/71740625/rundeck-4-0-0-remote-node-command-execution-using-ssh/71740876#71740876

Also, should I generate the SSH keys from as a root user or as `rundeck` user? What does the Rundeck job assume its role as when it SSHs to the remote nodes?

There's no `/var/lib/rundeck/` directory as many documents mention in my installation. What's the alternative?

[rac...@rundeck.com]

Hello!

What kind of instance are you using? If you're using a docker image instance the path is /home/rundeck. (Basically, the docker image is a war-based instance).

Regards.

[skp15]

Rundeck is installed from a docker image as a ECS service.

So, I have to create the ssh-rsa key under /home/rundeck? Also, when the Rundeck job tries to SSH into the EC2 instance, what user will it be trying to SSH as? Is it 'rundeck' or 'root' or something else?

[rac...@rundeck.com]

Hi!

I have to create the ssh-rsa key under /home/rundeck?

You can create it directly but the best way is to create a volume with your own keys (the target node needs the rundeck server public key in their user autorized_keys file). Take a look at this.

Also, when the Rundeck job tries to SSH into the EC2 instance, what user will it be trying to SSH as? Is it 'rundeck' or 'root' or something else?

That's defined in the model source file (the "username" attribute in the node definition). Check these example.

--

Maybe this is a good starting point to understand how to configure a Rundeck Docker image.

And this to learn more about Rundeck + SSH protocol.

Greetings.

[skp15]

Thank you for the constant guidance.

I have the setup working as required.

[rac...@rundeck.com]

Awesome! Cheers!