Ansible | Luis Cacho

How to find the last element in an array using jsonpath

Thu, 22 Jun 2023 00:00:00 +0000

- name: Get Operator StartingCSV - {{ operator_name }}
 command: oc get packagemanifest {{ operator_name }} -n openshift-marketplace -o jsonpath='{.status.channels[-1:].currentCSV}'
 changed_when: false
 register: reg_operator_csv

Populate an Ansible Fact from a loop

Thu, 22 Jun 2023 00:00:00 +0000

tasks:
 - name: Get list of elements from list_vars
 set_fact:
 my_new_list: "{{ my_new_list | default([]) | union([item]) }}"
 loop: "{{ list_vars }}"

 - name: Get list of elements from list_vars 
 set_fact:
 my_new_list: "{{ my_new_list | default([]) + [item] }}"
 loop: "{{ list_vars }}"

Sum numbers over loop

Tue, 29 Nov 2022 00:00:00 +0000

- set_fact:
 total: "{{ total|default(0)|int + item|int }}"
 loop:
 - 1
 - 4
 - 3

- debug: var=total

References:

¹ Sum numbers over loop

https://stackoverflow.com/questions/50543108/ansible-can-i-sum-numbers-over-loop ↩︎

Ansible variable with dot in name

Wed, 09 Mar 2022 00:00:00 +0000

Given the next variable outoput, we want to get the value for user_namespace.enable

- debug:
 msg: "{{ ansible_cmdline }}"

Give us:

"msg": {
 "BOOT_IMAGE": "/vmlinuz-...",
 "LANG": "...",
 "crashkernel": "...",
 "namespace.unpriv_enable": "...",
 "quiet": ...,
 "rd.lvm.lv": "...",
 "rhgb": ...,
 "ro": ...,
 "root": "...",
 "user_namespace.enable": "1"
}

To access it we need to do:

- debug:
 msg: "{{ ansible_cmdline['user_namespace.enable'] }}"

References:

¹ Stackoverflow solution
² Ansible Documentation

Jinja Loops

Wed, 25 Aug 2021 00:00:00 +0000

Initial example

{% set count = 1 %}
{% for i in p %}
 {{ count }}
 {% set count = count + 1 %}
{% endfor %}

Ansible example to access each item within the output of a previous command:

- name: Gather Nodes Status
 ansible.builtin.command: oc get node {{ item }} -o=jsonpath='{@.metadata.name}{range @.status.conditions[*]}{@.status}{end}'
 changed_when: false
 loop: "{{ ocp_nodes.stdout_lines }}"
 register: ocp_nodes_status

{% set count = 0 %}
{% for i in ocp_nodes_status.results | map(attribute='stdout_lines') %}
 {% for j in ocp_nodes_status.results[count].stdout_lines %}
 {{ j }}
 {% endfor %}
 {% set count = count + 1 %}
{% endfor %}

Select and Sum dictionary values selecting a pattern

Tue, 24 Aug 2021 00:00:00 +0000

The Dictionary

FS:
 - nom_FS: /appm/oracle/product
 nom_LV: lv_product
 size_FS: 5
 owner_FS: oracle
 group_FS: dba
 vg_name: vgapplis

 - nom_FS: /appm/oracle/product/12.1.0.2
 nom_LV: lv_12102
 size_FS: 15
 owner_FS: oracle
 group_FS: dba
 vg_name: vgapplis

 - nom_FS: /apps/oracle/logs
 nom_LV: lvlogs
 size_FS: 5
 owner_FS: oracle
 group_FS: dba
 vg_name: vglogs

The ansible tasks

tasks:
 - name: Calculate with selectattr, map and sum
 debug:
 msg: "{{ FS | selectattr('vg_name', 'equalto', 'vgapplis') | map(attribute='size_FS') | list | sum }}"

 - name: Calculate with json_query
 vars:
 sum_query: "[?vg_name=='vgapplis'].size_FS | sum(@)"
 debug:
 msg: "{{ FS | json_query(sum_query) }}"

References:

¹ Use select and map with Ansible

https://serverfault.com/questions/972403/use-select-and-map-with-ansible ↩︎

Ansible Environment variables

Thu, 19 Aug 2021 00:00:00 +0000

- hosts: localhost
 vars:
 kubeconfig_path: "{{ lookup('env','KUBECONFIG') }}"
 cloudflare_email: "{{ lookup('env','CF_EMAIL') }}"

export CF_EMAIL=<your_cloudflare_email>
export KUBECONFIG=~/.kube/config
ansible-playbook playbook.yml

References:

¹How to Inject Environment Variables into Ansible Playbooks

https://graspingtech.com/ansible-environment-variables/ ↩︎

ansible-docs

Tue, 10 Aug 2021 00:00:00 +0000

ansible-doc -t <plugin type> -l
ansible-doc inventory -l
ansible-doc -t inventory host_list

ansible-inventories

Tue, 10 Aug 2021 00:00:00 +0000

ansible-inventory -i <inventory file> --host_list
ansible-inventory --yaml -i <inventory file> --list --output inventory.yaml

Print variable results

Tue, 10 Aug 2021 00:00:00 +0000

- name: Print output from a variable results using jinja
 debug:
 msg: "{% for result in ocp_etcd_cert_file.results %}
 {{ result.stdout }}
 {% endfor %}"

- name: Another way to print a variable results
 debug:
 msg: "{{ ocp_etcd_cert_file.results | map(attribute='stdout') | list }}"

Using the Ansible Stat Module on a Loop

Sun, 12 Apr 2020 00:00:00 +0000

Table of Contents

Using the Ansible stat module on a loop

Hi again, it’s been a while since I wrote something on this blog. This time I was working on a Ansible playbook and I get this:

Problem

I want to verify if a file exists. Depending on the registered output I want to perform some other actions. On my specific use case, I want to use in in conjunct with the file module to define the state on my next task.

graph TD; A(Stat over file) --> B{Does the file exists?}; B -->|Yes| C[state: file]; B -->|No| D[state: touch];

Solution

Here is the solution that worked for me, using loops, loop_control,and jinja2 filters.

- name: Stat over the files
 stat:
 path: "{{ my_loop }}"
 loop:
 - /etc/cron.allow
 - /etc/at.allow
 loop_control:
 loop_var: my_loop
 register: my_stat_var

- name: Create a file if not exists
 file:
 path: "{{ item.my_loop }}"
 owner: root
 group: root
 mode: og-rwx
 state: "{{ 'file' if item.stat.exists else 'touch' }}"
 loop: "{{ my_stat_var.results }}"

Basically, I’m using the new loop syntax to iterate over all the files that I want to check.

In order to avoid some warnings about the loop using item I implement the loop_control and loop_var syntax to control the loop behavior and on this specific case, instead of using the word item I will substitute it with the one that I define as my loop_var in this case is called my_loop (Remember this, I will use it on the next task).

I’m registering the result of the stat task on a variable, for this case is my_stat_var

Here is an example of the output, when the 2 files do not exists:

ok: [instance-amazon2] => {
 "my_loop": {
 "changed": false,
 "msg": "All items completed",
 "results": [
 {
 "ansible_loop_var": "my_loop",
 "at_cron_restricted_touch": "/etc/cron.allow",
 "changed": false,
 "failed": false,
 "invocation": {
 "module_args": {
 "checksum_algorithm": "sha1",
 "follow": false,
 "get_attributes": true,
 "get_checksum": true,
 "get_md5": false,
 "get_mime": true,
 "path": "/etc/cron.allow"
 }
 },
 "stat": {
 "exists": false
 }
 },
 {
 "ansible_loop_var": "my_loop",
 "at_cron_restricted_touch": "/etc/at.allow",
 "changed": false,
 "failed": false,
 "invocation": {
 "module_args": {
 "checksum_algorithm": "sha1",
 "follow": false,
 "get_attributes": true,
 "get_checksum": true,
 "get_md5": false,
 "get_mime": true,
 "path": "/etc/at.allow"
 }
 },
 "stat": {
 "exists": false
 }
 }
 ]
 }
}

On the next task I access the results of the registered variable my_stat_var using, according to the previous output, I need to use the results variable to access it and gives me 2 arrays (each one for each file)

Also, I extract the path from the same variable my_stat_var.results but as it is part of a loop, I will access it using item.my_loop as on the the second task loop I’m not using a loop_control, also I can access it using item.item but I prefer the first syntax. In case you implement a loop_control on you can access it as my_second_loop.my_loop

Also, I extract if the file exists with the variable item.stat.exists but I’m putting that on a jinja2 filter, that way it will evaluate and set the correct option on the state

# When the file exists
state: file
# When the file does not exists
state: touch

This behavior also brings idempotency to your task, because:

If the files does not exists on the first iteration it will be created and,
The next time you run the tasks as the files already exists it will works as a stat and will return the current state of path.

That is all for now. See you soon!

Ansible Galaxy Roles

Fri, 25 Oct 2019 00:00:00 +0000

CircleCI Role: Ansible role that installs CircleCI CLI on your server/workstation.
Sonobuoy Role: Ansible role that installs sonobuoy on your server/workstation.

Molecule Cookiecutter

Thu, 24 Oct 2019 00:00:00 +0000

A Cookiecutter template for your new Molecule project.

Improve Ansible Roles with Molecule

Thu, 07 Mar 2019 16:00:00 +0000

Click on the Slides button above to view the built-in slides feature.

On this talk I share some best practices to perform test driven on your Ansible Roles.

I explain how workflow with molecule will help you to improve the development speed for your Ansible Roles.

I show an example of how to integrate molecule on an Ansible Role that does not have it.

Improve Ansible Roles with Molecule

Thu, 07 Mar 2019 00:00:00 +0000

Improve Ansible Roles with Molecule

Luis Cacho

Security Systems Administrator

@Rackspace

luiscachog.io | @luiscachog | github.com/luiscachog

Agenda

Ansible Review
- YAML Review
Test Automation
- Testing options for Ansible
Molecule
Demo!!

Ansible (1/4)

Use Cases	Attributes
Configuration Management	Simple
Software Provisioning	Powerful
Security and Compliance	Agentless
Application Deployment	Cross Platform
Orchestration	Over 450 Modules
Continuous Delivery	Big Community

Ansible (2/4)

Ansible (3/4)

Ansible (4/4)

Playbooks contain/connect roles
Roles contain plays
Plays contain tasks
Tasks execute a module
Tasks run sequencially
Handlers are triggered by tasks, runs once at the end of the play

Test Automation (1/2)

Reliable Code
Quality (Fast feedback)
Time and cost saving
Faster Development Cycle (CI/CD)
Repeatability (Test same change accross multiple environments (OS, Providers); multiple data sets)

Test Automation (2/2)

Testing options for Ansible

Ansible tasks - Test Ansible w/ Ansible

Test Kitchen - Test Ansible w/ Ruby

ansible-test - Test Ansible w/ Unmaintained Python

Molecule - Test Ansible w/ Python

Press S key to view - Algunas herramientas que revise, despues de ver la conferencia de Elana Hashman en en Ansible Fest 2017 son:

Testing Ansible with Ansible Tasks -> Test ansible with Ansible tasks Benefits:

As flexible and powerful as you need it Issues:
High development cost
Ansible can’t detect ansible bugs
Need to write your own provisioner

Testing Ansible with ansible-test -> Benefits:

Written in Python
Solves the provisioning problem in “Test ansible with Ansible”
Simple tool with small codebase Issues:
Onlys support docker provisioner on debian-based images
Does not apear to be actively maintained

Testing Ansible with Test Kitchen -> Benefits:

Large community
Supports Ansible
Supportw windows testing for Ansible Issues:
Written in Ruby
Verifiers are Ruby or bash based
Installs Ansible on the target host and runs it locally

Molecule (1/5)

Testing Ansible with Molecule

Tool designed to aid in the development and testing of Ansible roles.
Provides support for testing with multiple instances, operating systems, providers, test frameworks and testing scenarios.
Encourages an approach that results in consistently developed roles that are well-written, easily understood and maintained.

github.com/ansible/molecule | molecule.readthedocs.io

Molecule (2/5)

Testing Ansible with Molecule

Pros	Cons
- Written in Python	- No Windows support
- Ansible-Native	- No Dinamyc Inventory support
- Established community
- Open-Source

Molecule (3/5)

Testing Ansible with Molecule

Creates nodes for testing
Run the playbook on the nodes
Run the playbook again to test idempotence
Lints the Ansible code with ansible-lint
Lint the Python code with flake8
Runs the verifier tests on the nodes to ensure the desired state

Molecule (4/5)

Testing Ansible with Molecule

Molecule (5/5)

Testing Ansible with Molecule

What can I test?
- Files exists and permissions
- Service are running
- User exists and is member of the correct groups
- Package installed
- Basic Software interaction (Test web server basic authentication)

Molecule Demo (1/3)

Let’s try it!!
- Creates 2 nodes
- Converge both nodes
- Check for idempotence
- Lint the Ansible and Python code
- Verify the role against some tests
Github Repo: github.com/luiscachog/elastic_stack (Thanks to GaRaGeD for provide a playbook to test)

Molecule Demo (2/3)

Terminal time!!

Molecule Demo (3/3)

TO-DO

Ansible-Vault implementation
Integrating Molecule into Travis CI, Circle CI, Jenkins, etc

Conclusion

There are different testing solutions for Ansible, but Molecule is an Ansible-native and the robust option.
Molecule allows you to create, converge, check idempotence, lint and verify your Ansible code.
Molecule help you to create the best playbooks possible.

Questions?

Talk links, references and resources can be found at: luiscachog.io/talk/improve-ansible-roles-with-molecule

Thank you

You can find me on:

luiscachog [at] gmail.com | luiscachog.io | github.com/luiscachog | @luiscachog

My First Contribution to OpenStack project

Thu, 15 Mar 2018 00:00:00 +0000

I been working since last year using Ansible for fun and to trying to get prepared to become a DevOps, so I found an excelent OpenStack project called ARA Records Ansible.

Ansible Logo

ARA Logo

Basically it is a project from the OpenStack community that makes it easier to understand and troubleshoot your Ansible roles and playbooks. If you want more information, please refer to the Documentation Page.

Anyhow, I just found a little bug on the Ansible Role to install ARA ansible-role-ara on Debian based distros and just send the patch to fix it.

Here is the link to my contribution.

And, as I am proud of my first commit on a big project here is the screenshot too:

My First OpenStack Contribution

I feel happy and motivated to still learn about this Open-Source project and a lot more.

😄