Use proxmox_ssh_root_key for pct-delegation SSH, not ambient identity #4

Merged

jsanchezd merged 1 commit from fix/proxmox-delegate-ssh-key into main

2026-10-06 14:50:25 +00:00

sysadmin commented

2026-10-06 14:38:28 +00:00

Contributor

Found while testing the Semaphore task template: delegate_to: proxmox_api_host tasks never actually used proxmox_ssh_root_key (resolved from OpenBao a few lines earlier) for the connection -- they relied on whatever default SSH identity happened to be loaded in the calling shell. Works fine from an operator's own machine, fails opaquely (UNREACHABLE, no_log hides the real error) from a headless runner with no ambient identity at all.

Verified live: fetched the stored key and confirmed it authenticates as root on srv-proxmox01 before wiring it in.

🤖 Generated with Claude Code

https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

Found while testing the Semaphore task template: `delegate_to: proxmox_api_host` tasks never actually used `proxmox_ssh_root_key` (resolved from OpenBao a few lines earlier) for the connection -- they relied on whatever default SSH identity happened to be loaded in the calling shell. Works fine from an operator's own machine, fails opaquely (`UNREACHABLE`, no_log hides the real error) from a headless runner with no ambient identity at all. Verified live: fetched the stored key and confirmed it authenticates as root on srv-proxmox01 before wiring it in. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

sysadmin added 1 commit

2026-10-06 14:38:28 +00:00

Use proxmox_ssh_root_key for pct-delegation SSH, not ambient identity

Ansible Lint / ansible-lint (pull_request) Successful in 41s

Details

f5ffa45b3b

delegate_to: proxmox_api_host tasks registered the Proxmox node with
ansible_user: root but no key, relying entirely on whatever default SSH
identity was loaded in the shell running ansible-playbook. That's always
been true on an operator's own machine (already authorized as root) but
never true for a headless runner -- confirmed live via Semaphore, which
failed with an opaque UNREACHABLE and no further detail (no_log hides the
real error). proxmox_ssh_root_key was already being resolved from OpenBao
a few lines earlier in this same task but never actually used.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp