struct

Krikri::ConnectionSettings

Inherits Struct < Value < Object

The SSH connection settings ONE task's dispatch must use - resolved from the task's own vars_context (which already carries the full Ansible precedence ladder: task vars > block vars (merged into task.vars by the parser) > play vars > host/inventory vars, with -e extra vars applied last inside build_vars_context) falling back to the Host's inventory-level fields.

Real ansible-core resolves every ssh connection option through the connection plugin's var pipeline, so a task-level (or block/play level) vars: entry - or a set_fact/include_vars/register chain - changes the ACTUAL connection for that task, not just templating: ansible_user/ansible_ssh_user, ansible_password/ansible_ssh_pass/ ansible_ssh_password, ansible_port/ansible_ssh_port, ansible_host/ansible_ssh_host, ansible_ssh_private_key_file, ansible_ssh_common_args and ansible_ssh_extra_args. Each task then opens/reuses the connection keyed by the effective settings (the ControlMaster socket is per (host, user, port)).

Every consumer of an SSH transport in the task path (plugin dispatch, daemon routing, plugin upload cache keys, batch script transport, copy staging, async launch, reboot) resolves through this struct so a task never silently runs over the inventory user's connection.

The deprecated ansible_ssh_* spellings outrank the canonical names wherever BOTH are present, regardless of which precedence tier each came from: ansible-core resolves each connection option through ConfigManager._loop_entries over the plugin's flat vars: name list (ssh.py: user [ansible_user, ansible_ssh_user], host, port - same for the become plugin's password chain), and that loop keeps the LAST entry found in the one merged task-vars dict, so a role default's ansible_ssh_user: core beats an inventory ansible_user: root (tyranron.coreos_bootstrap, issue #887: ansible dialed core@ - the role is CoreOS-only - and went UNREACHABLE while this engine dialed the inventory user and got further). So every lookup here tries the legacy spelling across BOTH tiers before the canonical one. Within one name the vars context (already merged by build_vars_context) outranks the host's raw inventory vars, ansible's own order.

Constants

CONNECTION_VAR_KEYS = ["ansible_user", "ansible_ssh_user", "ansible_password", "ansible_ssh_pass", "ansible_ssh_password", "ansible_port", "ansible_ssh_port", "ansible_host", "ansible_ssh_host", "ansible_ssh_private_key_file", "ansible_ssh_common_args", "ansible_ssh_extra_args", "ansible_become", "ansible_become_user", "ansible_become_password", "ansible_become_pass", "ansible_sudo_pass"]

Every variable name that can change the actual SSH connection (or its escalation) for a task. TaskBatcher solos any task whose own task.vars carries one of these - a task that switches the connection must never share a batch round trip with a neighbor that connects differently.

Constructors

new(conn_host : String, user : String, port : Int32 | Nil, identity_file : String | Nil, password : String | Nil, common_args : Array(String), extra_args : Array(String))
Source
resolve(host : Host, vars : Hash(String, JSON::Any) | Nil) : ConnectionSettings
Source
resolve_play(host : Host, play_vars : Hash(String, JSON::Any) | Nil) : ConnectionSettings

The play-level view of a host's connection: play vars outrank inventory host vars (live-verified vs ansible-playbook 2.19.11), but a play that sets no connection vars must still see the inventory's ansible_host/ansible_port/ansible_user. Used by the play-start plugin pre-pass, which holds the raw play vars and has no rendered per-task context.

Source

Class methods

default_connection_user
Source
split_ssh_args(text : String | Nil) : Array(String)

shlex-style split of an ssh-args string (posix shell word rules: whitespace separators, single/double quoting, backslash escapes) - what ansible-core's own shlex.split does to these vars.

Source

Instance methods

common_args
Source
conn_host
Source
extra_args
Source
fingerprint

Full equality basis for batch eligibility: two steps may share one SSH round trip only when they open the exact same connection the exact same way.

Source
identity_file
Source
password
Source
port
Source
spec_key

The (host, user, port) spec every SSHManager transport and every controller-side cache (plugin upload sets, daemon processes, ControlMaster sockets, registered connection passwords) is keyed on - the exact string shape PluginManager's existing host keys use.

Source
ssh_extra_options

The -o-style argv every ssh/scp/rsync invocation for THIS connection must carry (ansible_ssh_common_args first, then ansible_ssh_extra_args, exactly like ansible-core's own ssh_common_args/ssh_extra_args connection options). One method so no call site can spell the combination itself and forget half of it - the failure mode behind issue #2, where a path built its transport argv from the identity file and port alone and let ssh walk every agent identity instead of honoring IdentitiesOnly=yes.

Source
user
Source