Remove dynamic SSH key host checks

ansible.cfg

@@ -10,5 +10,5 @@ vars_plugins = ~/.ansible/plugins/vars:/usr/share/ansible/plugins/vars:lib/trell
 pipelining = True
 
 [ssh_connection]
-ssh_args = -o ForwardAgent=yes -o ControlMaster=auto -o ControlPersist=60s
+ssh_args = -o ForwardAgent=yes -o ControlMaster=auto -o ControlPersist=60s -o [email protected],[email protected],ssh-ed25519,ssh-rsa
 retries = 1

lib/trellis/plugins/callback/vars.py

@@ -10,7 +10,6 @@
 from ansible.template import Templar
 from ansible.utils.unsafe_proxy import wrap_var
 from ansible import context
-from ansible.plugins.loader import connection_loader
 
 
 class CallbackModule(CallbackBase):
@@ -92,7 +91,6 @@ def darwin_without_passlib(self):
 
     def v2_playbook_on_play_start(self, play):
         play_context = PlayContext(play=play)
-        connection = connection_loader.get('ssh', play_context, os.devnull)
 
         env = play.get_variable_manager().get_vars(play=play).get('env', '')
         env_group = next((group for key,group in iteritems(play.get_variable_manager()._inventory.groups) if key == env), False)
@@ -102,7 +100,6 @@ def v2_playbook_on_play_start(self, play):
         for host in play.get_variable_manager()._inventory.list_hosts(play.hosts[0]):
             hostvars = play.get_variable_manager().get_vars(play=play, host=host)
             self.raw_vars(play, host, hostvars)
-            host.vars['ssh_args_default'] = connection.get_option('ssh_args')
             host.vars['cli_options'] = self.cli_options()
             host.vars['cli_ask_pass'] = self._options.get('ask_pass', False)
             host.vars['cli_ask_become_pass'] = self._options.get('become_ask_pass', False)

roles/connection/tasks/main.yml

@@ -6,22 +6,11 @@
       ansible-playbook server.yml -e env={{ env | default('production') }} -u root --ask-pass
   when: dynamic_user | default(true) and ansible_user is not defined and cli_ask_pass | default(false)
 
-- name: Specify preferred HostKeyAlgorithms for unknown hosts
-  set_fact:
-    ansible_ssh_extra_args: -o HostKeyAlgorithms={{ host_key_algorithms }}
-  register: preferred_host_key_algorithms
-  when:
-    - dynamic_host_key_algorithms | default(true)
-    - not ansible_ssh_extra_args | default(None)
-    - not (ansible_host_known or ssh_config_host_known)
-
 - name: Check whether Ansible can connect as {{ dynamic_user | default(true) | ternary('root', web_user) }}
   command: |
     ansible {{ inventory_hostname }} -m raw -a whoami
     -u {{ dynamic_user | default(true) | ternary('root', web_user) }} {{ cli_options | default('') }} -vvvv
   delegate_to: localhost
-  environment:
-    ANSIBLE_SSH_ARGS: "{{ ssh_args_default }} {{ ansible_ssh_extra_args | default('') }}"
   failed_when: false
   changed_when: false
   check_mode: no
@@ -61,19 +50,6 @@
     debug:
       msg: |
         Note: Ansible will attempt connections as user = {{ ansible_user }}
-        {% if preferred_host_key_algorithms is not skipped %}
-
-        Note: The host `{{ ansible_host }}` was not detected in known_hosts
-        so Trellis prompted the host to offer a key type that will work with
-        the stronger key types Trellis configures on the server. This avoids future
-        connection failures due to changed host keys. Trellis used this SSH option:
-
-          {{ ansible_ssh_extra_args }}
-
-        To prevent Trellis from ever using this SSH option, add this to group_vars:
-
-          dynamic_host_key_algorithms: false
-        {% endif %}
 
   - name: Load become password
     set_fact: