Re: [ansible-project] Ansible roles - setup concept

[Rowe, Walter P. (Fed)]

It sounds like you want one NFS role that can do both NFS server and NFS client tasks. Were I designing such a role I think I would use a variable or tag to identify which "persona" you want the role to configure, and use that in the tasks/main.yml to source two different task files. One task file would do the work for an NFS server persona. One task file would do the work for an NFS client persona.

roles/nfs/tasks/main.yml

---

- name: configure nfs server

  include_tasks: nfs_server.yml

  tags: nfs_server

- name: configure nfs client

  include_tasks: nfs_client.yml

  tags: nfs_client

...

roles/nfs/tasks/nfs_server.yml

---

- name: tasks to configure nfs servers

  some_tasks:

...

roles/nfs/tasks/nfs_client.yml

---

- name: tasks to configure nfs clients

  some_tasks:

...

This lets you separate the tasks for server and client persona. Executing the role with tag nfs_server will configure the inventory machines as nfs servers. Executing the role with tag nfs_client will configure the inventory machines as nfs clients. Execute the role two times with different inventories and tags as you showed in your original message.

my_playbook.yml

---

- hosts: cmp
  become: true
  tags: nfs_server

  roles:
    - nfs

- hosts:
    - hardware:!cmp
    - vms
  become: true
  tags: nfs_client
  roles:
    - nfs

I am curious to have others also propose ideas to see how others might address the problem.

Walter
--
Walter Rowe, Division Chief
Infrastructure Services, OISM
Mobile: 202.355.4123

On Nov 23, 2022, at 8:08 AM, Robert Grießner <robert.g...@gmail.com> wrote:

Hi,

i'd like to migrate my playbooks into a ansible role. I started but a basic question raises.

E.g.

I sould like to implement nfs in network of linux machines. on one machine i've to configure the nfs-sharing and on the other machines I've to implemt the link to the nfs-sourcing host.

systemA - configure a share for other hosts

systemB,C,D - use the nfs-sharing from system A

I tried to create a role called nfs where i have to configure a few tasks on systemA and the other tasks on systemB,C,D

I've splitted the tasks into 2 vaious task files one for systemA and one for systemB and both will be imported into main.yml in tasks.

---

# tasks file for installing nfs
- import_tasks: install_cmp.yml
- import_tasks: install_machines.yml

in the run.yml I tried to call the same role twice where I used tags to call the plays for the cmp machine from install_cmp.yml and the tags in install_machines for running the plays for the other machines. however this doesn't work

- hosts: cmp
  become: true
  tags:
    - create_nfs_cmp
    - config_exports_cmp
    - exportfs_cmp
    - symlink_cmp
    - symlink_hostsini_cmp
  roles:
    - nfs

- hosts:
    - hardware:!cmp
    - vms
  become: true
  tags:
    - create_nfs_machines
    - mnt_nfs_machines
  roles:
    - nfs

is my concept wrong, do I have to configure to roles one for setting up nfs on cmp and one for implementing nfs on the machines or is it possible to create just one role for installing nfs on with vaious tasks on various machines?

Thx

--
You received this message because you are subscribed to the Google Groups "Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/a9e1aa6f-f5d8-4256-b735-fc693bb133b4n%40googlegroups.com.

[RG]

hi,

I adapted the configuration to your proposal, however it doesn't work

First all tasks were execetuted on host cmp an then all tasks were again exectuted on the the other machine except cmp.

Regarding to your solution would be necessary to tag both tasks

roles/nfs/tasks/nfs_server.yml

---

- name: tasks to configure nfs servers

  some_tasks:

...

roles/nfs/tasks/nfs_client.yml

---

- name: tasks to configure nfs clients

  some_tasks:

...

maybe as a block, so that there's i reference to those tags in the main.yml.

I don't want to call both roles seperately - I'd like to have a playbook where both tasks setting up the nfs-server and clients are done once automatically.

Is generally the main idea of ansible roles regarding to my problem creating two roles, server and client because of different hosts or is my approach having one role for both server and client the ideal one? 

[Dick Visser]

I do something similar, but then with rsyslog.

I have this set in the role:

defaults/main.yml:

rsyslog_type: client

and then in tasks/main.yml:

- name: Ensure the appropriate tasks file is imported
  include_tasks: "{{ rsyslogd_type }}.yml"

This then includes either tasks/client.yml or tasks/server.yml.

The playbook uses the role like this:

- name: Include rsyslogd role
  include_role:
    name: ansible_role_rsyslogd
  args:
    apply:
      tags: rsyslogd
  tags: always

So by default (i.e. for all hosts in the play) the rsyslog client is configured.

The one or two rsyslog servers have set this host_var:

rsyslog_type: server

It's more or less the same, except that I use a variable to denote the type of deployment, rather than tags, as I find tags more cumbersome to work with.

To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/a550d0ac-50f3-4507-b5ab-a26fe214c7d1n%40googlegroups.com.

[RG]

Hi,

i once again exactly followed your instruction by copying your published config into the files, because your methon seems comprehensive to me.

However the problem is that the tags are not used which means that both tasks are executed completely twice - first for cmp machine and then for the other machines.

Do you've an idea why this happens.

Thx

walte...@nist.gov schrieb am Mittwoch, 23. November 2022 um 14:31:52 UTC+1:

[RG]

Hi,

I don't exactly understand your method although it nearly seems to be similar than the version from Walter. Could you probably post more excerpts from the various scripts. Maybe this could help to better get an idea about the context.

Thanks

[Todd Lewis]

Show us your playbooks, roles, and output, and we can tell you why.
Without any of those, we'd be guessing just like you.

[RG]

Hi,

these are the ansible role config files

 ansible/runsetup.yml

---

- hosts:
    - cmp
  become: true
  tags:
    - nfs_server

  roles:
    - nfs

- hosts:
    - hardware:!cmp
    - vms
  become: true
  tags:

    - nfs_client
  roles:

    - nfs

ansible/nfs/tasks/main.yml

 ---
# tasks file for installing nfs

- name: configure nfs server
  include_tasks: nfs_server.yml
  tags:

    - nfs_server

- name: configure nfs client
  include_tasks: nfs_client.yml
  tags:

    - nfs_client

/ansible/nfs/tasks/ nfs_server.yml

---
- name: Create shared nfs directory

...

- name: Configure /etc/exports

...

- name: set symlink /media/nfs-share -> /Data/nfs-share

...

- name: set symlink to ansible hosts.ini

...

/ansible/nfs/tasks/ nfs_clientym

---

- name: Create sharing nfs directory on hosts/guests

...

- name: Mounting /media/nfs-share

...

This is the ansible console output -

all tasks included in nfs_server.yml and nfs_client.yml are exectuted for cmp (server) and then it starts again with nfs_server.yml for top1...(clients) and stops because set symlink cannot be exectuted on clients, which is ok.

in this case tagging in roles doesn't work.

PLAY [cmp] ***************************************************************************************************************************************************************
TASK [Gathering Facts] ***************************************************************************************************************************************************

ok: [cmp1]

TASK [configure nfs server] **********************************************************************************************************************************************
included: /Data/nfs-share/ansible/nfs/tasks/nfs_server.yml for cmp1
TASK [Create shared nfs directory] ***************************************************************************************************************************************

ok: [cmp1] =>

TASK [nfs : Configure /etc/exports] **************************************************************************************************************************************

ok: [cmp1] =>

TASK [nfs : Commmand exportfs] *******************************************************************************************************************************************

skipping: [cmp1] =>

TASK [set symlink /media/nfs-share -> /Data/nfs-share] *******************************************************************************************************************

ok: [cmp1] =>

TASK [nfs : set symlink to ansible hosts.ini] ****************************************************************************************************************************

changed: [cmp1] =>

TASK [configure nfs client] **********************************************************************************************************************************************

included: /Data/nfs-share/ansible/nfs/tasks/nfs_client.yml for cmp1

TASK [Create sharing nfs directory on hosts/guests] **********************************************************************************************************************

ok: [cmp1] =>

TASK [Mounting /media/nfs-share] *****************************************************************************************************************************************

changed: [cmp1] =>

PLAY [hardware:!cmp,vms] *************************************************************************************************************************************************

TASK [Gathering Facts] ***************************************************************************************************************************************************

ok: [top1]

...

TASK [configure nfs server] **********************************************************************************************************************************************

included: /Data/nfs-share/ansible/nfs/tasks/nfs_server.yml for top1, top2,...

TASK [Create shared nfs directory] ***************************************************************************************************************************************

changed: [top1]

...

TASK [nfs : Configure /etc/exports] **************************************************************************************************************************************

hanged: [top1] =>

...

TASK [nfs : Commmand exportfs] *******************************************************************************************************************************************

skipping: [top1]

...

TASK [set symlink /media/nfs-share -> /Data/nfs-share] *******************************************************************************************************************

fatal: [top1]:

....

PLAY RECAP ***************************************************************************************************************************************************************

Thx,

Robert

[Rowe, Walter P. (Fed)]

How do you execute runsetup.yml ? You need to provide the appropriate tag on the command line to tell it which persona to assume.

$ ansible-playbook runsetup.yml -i inventory -t nfs_server

$ ansible-playbook runsetup.yml -i inventory -t nfs_client

Walter
--
Walter Rowe, Division Chief
Infrastructure Services, OISM
Mobile: 202.355.4123

-- 
You received this message because you are subscribed to the Google Groups "Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/3b50c342-d700-43aa-aabc-b30e073160abn%40googlegroups.com.

[Todd Lewis]

Te be honest, I've never seen the tags keyword applied to at the play level, although https://docs.ansible.com/ansible/latest/reference_appendices/playbooks_keywords.html clearly says it can be. I suspect the functionality it provides is not what you're after though, as you seem to be using it in a way that would normally be done with the tags command line parameter. The above mentioned docs says this about tags on a play:

Tags applied to the task or included tasks, this allows selecting subsets of tasks from the command line.

The way I read that is, it's as if you had put these tags on each task, or had used include_tasks with apply tags [...]. You still have to use the command line tags parameter to do any task selection based on tags.

[Rowe, Walter P. (Fed)]

I ran a simple test on tagging plays and it does seem to work as one might assume. I have two simple plays. Each prints a debug message stating what play they are executing. When no tags both plays execute. With a tag only the tagged play executes.

foo.yml

---
- name: play 1 tagged play1
  hosts: localhost
  become: false
  gather_facts: false
  tags: play1
  tasks:
    - name: debug in play 1
      debug: msg="debug in play 1"

- name: play 2 tagged play2
  hosts: localhost
  become: false
  gather_facts: false
  tags: play2
  tasks:
    - name: debug in play 2
      debug: msg="debug in play 2"

% ansible-playbook -i localhost, foo.yml 

PLAY [play 1 tagged play1] *********************************************************************************************

TASK [debug in play 1] *************************************************************************************************
ok: [localhost] => {
    "msg": "debug in play 1"
}

PLAY [play 2 tagged play2] *********************************************************************************************

TASK [debug in play 2] *************************************************************************************************
ok: [localhost] => {
    "msg": "debug in play 2"
}

PLAY RECAP *************************************************************************************************************
localhost                  : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

% ansible-playbook -i localhost, foo.yml -t play1

PLAY [play 1 tagged play1] *********************************************************************************************

TASK [debug in play 1] *************************************************************************************************
ok: [localhost] => {
    "msg": "debug in play 1"
}

PLAY [play 2 tagged play2] *********************************************************************************************

PLAY RECAP *************************************************************************************************************
localhost                  : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

% ansible-playbook -i localhost, foo.yml -t play2  

PLAY [play 1 tagged play1] *********************************************************************************************

PLAY [play 2 tagged play2] *********************************************************************************************

TASK [debug in play 2] *************************************************************************************************
ok: [localhost] => {
    "msg": "debug in play 2"
}

PLAY RECAP *************************************************************************************************************
localhost                  : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

Walter
--
Walter Rowe, Division Chief
Infrastructure Services, OISM
Mobile: 202.355.4123

-- 
You received this message because you are subscribed to the Google Groups "Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/56bd92d3-e3df-2eaf-383a-fc9a6a6ca02a%40gmail.com.

[Rowe, Walter P. (Fed)]

As one more sanity check I ran the sample playbook with a tag not used in the playbook and none of the plays executed. Note the empty Play Recap output

% ansible-playbook -i localhost, foo.yml -t play3

PLAY [play 1 tagged play1] *********************************************************************************************

PLAY [play 2 tagged play2] *********************************************************************************************

PLAY RECAP *************************************************************************************************************

Walter
--
Walter Rowe, Division Chief
Infrastructure Services, OISM
Mobile: 202.355.4123

To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/5EE865C6-8EE5-4E0E-ADF9-46224D525982%40nist.gov.

[Robert Grießner]

hi, my intention is to migrate various playbooks to absible roles, setting up a system consisting of various machines. i would like to start the new ansible role playbook once doing the whole stuff. one item will be configuring nfs on server and clients. is it a good idea to use one role for this nfs-task and how could i realize it? until now i don't or whether it works with tags or any other solution or is it in general usual and easier in this case to build two roles one for server and one for client?

You received this message because you are subscribed to a topic in the Google Groups "Ansible Project" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/ansible-project/f1liGR-TVCs/unsubscribe.
To unsubscribe from this group and all its topics, send an email to ansible-proje...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/AA831EF0-F19F-4812-8C4B-7FB67CF18346%40nist.gov.

[Rowe, Walter P. (Fed)]

It works with roles. I will provide a following message where there is behavior one might NOT expect.

---

- name: play 1 tagged play1

  hosts: localhost

  become: false

  gather_facts: false

  tags: play1

  roles:

    - my_role

  tasks:

    - name: debug in play 1

      debug: msg="debug in play 1"

- name: play 2 tagged play2

  hosts: localhost

  become: false

  gather_facts: false

  tags: play2

  roles:

    - my_role

  tasks:

    - name: debug in play 2

      debug: msg="debug in play 2"

% ansible-playbook -i localhost, foo.yml

PLAY [play 1 tagged play1] *********************************************************************************************

TASK [my_role : my_role] ***********************************************************************************************

ok: [localhost] => {

    "msg": "debug message inside my_role"

}

TASK [debug in play 1] *************************************************************************************************

ok: [localhost] => {

    "msg": "debug in play 1"

}

PLAY [play 2 tagged play2] *********************************************************************************************

TASK [my_role : my_role] ***********************************************************************************************

ok: [localhost] => {

    "msg": "debug message inside my_role"

}

TASK [debug in play 2] *************************************************************************************************

ok: [localhost] => {

    "msg": "debug in play 2"

}

PLAY RECAP *************************************************************************************************************

localhost                  : ok=4    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

% ansible-playbook -i localhost, foo.yml -t play1

PLAY [play 1 tagged play1] *********************************************************************************************

TASK [my_role : my_role] ***********************************************************************************************

ok: [localhost] => {

    "msg": "debug message inside my_role"

}

TASK [debug in play 1] *************************************************************************************************

ok: [localhost] => {

    "msg": "debug in play 1"

}

PLAY [play 2 tagged play2] *********************************************************************************************

PLAY RECAP *************************************************************************************************************

localhost                  : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

% ansible-playbook -i localhost, foo.yml -t play2

PLAY [play 1 tagged play1] *********************************************************************************************

PLAY [play 2 tagged play2] *********************************************************************************************

TASK [my_role : my_role] ***********************************************************************************************

ok: [localhost] => {

    "msg": "debug message inside my_role"

}

TASK [debug in play 2] *************************************************************************************************

ok: [localhost] => {

    "msg": "debug in play 2"

}

PLAY RECAP *************************************************************************************************************

localhost                  : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

% ansible-playbook -i localhost, foo.yml -t play3

PLAY [play 1 tagged play1] *********************************************************************************************

PLAY [play 2 tagged play2] *********************************************************************************************

PLAY RECAP *************************************************************************************************************

Walter
--
Walter Rowe, Division Chief
Infrastructure Services, OISM
Mobile: 202.355.4123

To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/CA%2BSddAy0wEBNkbuPCwB4t421ChHFivjVr8%2BTHLLd6uOjhr2-%3DA%40mail.gmail.com.

[Rowe, Walter P. (Fed)]

There is a unique behavior with plays and roles and tags to be aware of. If you tag a play that calls a role, all tasks in that role are executed if that tag is provided even if there are tasks inside that role that have an alternate tag.

AFTER running the tests below, I edited my sample role to include two debug statements. Each had play1 or play2 as the tag. When I executed the foo.yml playbook with -t play1 then both debug messages are display in play1, but only the play1 debug message is display for play2. It seems to parse the role for play2 to determine if any tasks have the play1 tag (including the roles) and will run them if they exist. It is easier to show than to describe.

I don't know if this is the expected behavior with ansible. I was surprised by this. I expected the entire play to be skipped if the tag for that play was not specified.

% cat roles/my_role/tasks/main.yml

---

# tasks file for my_role

- name: my_role play1 tag

  debug: msg="debug message for tag play1 inside my_role"

  tags: play1

- name: my_role play2 tag

  debug: msg="debug message for tag play2 inside my_role"

  tags: play2

% ansible-playbook -i localhost, foo.yml -t play1

PLAY [play 1 tagged play1] *********************************************************************************************

TASK [my_role : my_role play1 tag] *************************************************************************************

ok: [localhost] => {

    "msg": "debug message for tag play1 inside my_role"

}

TASK [my_role : my_role play2 tag] *************************************************************************************

ok: [localhost] => {

    "msg": "debug message for tag play2 inside my_role"

}

TASK [debug in play 1] *************************************************************************************************

ok: [localhost] => {

    "msg": "debug in play 1"

}

PLAY [play 2 tagged play2] *********************************************************************************************

TASK [my_role : my_role play1 tag] *************************************************************************************

ok: [localhost] => {

    "msg": "debug message for tag play1 inside my_role"

}

PLAY RECAP *************************************************************************************************************

localhost                  : ok=4    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

% ansible-playbook -i localhost, foo.yml -t play2

PLAY [play 1 tagged play1] *********************************************************************************************

TASK [my_role : my_role play2 tag] *************************************************************************************

ok: [localhost] => {

    "msg": "debug message for tag play2 inside my_role"

}

PLAY [play 2 tagged play2] *********************************************************************************************

TASK [my_role : my_role play1 tag] *************************************************************************************

ok: [localhost] => {

    "msg": "debug message for tag play1 inside my_role"

}

TASK [my_role : my_role play2 tag] *************************************************************************************

ok: [localhost] => {

    "msg": "debug message for tag play2 inside my_role"

}

TASK [debug in play 2] *************************************************************************************************

ok: [localhost] => {

    "msg": "debug in play 2"

}

PLAY RECAP *************************************************************************************************************

localhost                  : ok=4    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

% ansible-playbook -i localhost, foo.yml -t play3

PLAY [play 1 tagged play1] *********************************************************************************************

PLAY [play 2 tagged play2] *********************************************************************************************

PLAY RECAP *************************************************************************************************************

Walter
--
Walter Rowe, Division Chief
Infrastructure Services, OISM
Mobile: 202.355.4123

On Nov 25, 2022, at 10:38 AM, Robert Grießner <robert.g...@sbg.at> wrote:

To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/CA%2BSddAy0wEBNkbuPCwB4t421ChHFivjVr8%2BTHLLd6uOjhr2-%3DA%40mail.gmail.com.

[Rowe, Walter P. (Fed)]

AFTER running the tests IN THE PRIOR MESSAGE, I edited my sample role to include two debug statements. Each had play1 or play2 as the tag. When I executed the foo.yml playbook with -t play1 then both debug messages are display in play1, but only the play1 debug message is display for play2. It seems to parse the role for play2 to determine if any tasks have the play1 tag (including the roles) and will run them if they exist. It is easier to show than to describe.

[Robert Grießner]

hi,

and where/how does your solution differ to mine? why did you place the tasks in the playbook and not in the role-tasks? how does your my_role task look like?

To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/B1FFCECF-AAAF-48AB-9B55-673C8CA80874%40nist.gov.

[Rowe, Walter P. (Fed)]

I was using your original playbook as my starting point. It had tags in the plays. If you remove the tags in the plays and leave the tags in the role tasks it behaves as expected. Each play runs the role, and only the tasks with the named tag execute.

Walter
--
Walter Rowe, Division Chief
Infrastructure Services, OISM
Mobile: 202.355.4123

To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/CA%2BSddAwqwQedViE7XPoVR11MToxEwCLi53rWp62h7MPAQKesWA%40mail.gmail.com.

[RG]

hi, 

would it be possible to post the relevant content of all these necessary files (excerpt in one of my previous posts) for installing nfs on server and client using one ansible role.  That allows me to understand and reproduce it.

Thx a lot

- ansible/runsetup.yml

- ansible/nfs/tasks/main.yml

- ansible/nfs/tasks/ nfs_server.yml

- ansible/nfs/tasks/ nfs_clientym

- command to run the ansible role playbook

[Todd Lewis]

I think it makes sense to put both the client and server tasks in the same role, especially if you have some hosts which are both nfs clients and nfs servers.

However, I would recommend that you not use the tags keyword at the play level. It's a short cut way to add a tag or tags to every task involved in the play. While there must be some problem for which that is a solution, you don't have such a problem, at least not in my opinion.

A more straightforward approach would be to use host groups. Let's say you have host groups rg_nfs_clients and rg_nfs_servers. Then in your nfs/tasks/main.yml you have something like

---
# ansible/nfs/tasks/main.yml

- name: Configure NFS Servers
  ansible.builtin.include_tasks: nfs_server.yml
  when: inventory_hostname in groups['rg_nfs_servers']
  tags:
    - always

- name: Configure NFS Clients
  ansible.builtin.include_tasks: nfs_client.yml
  when: inventory_hostname in groups['rg_nfs_clients']
  tags:
    - always

Then your playbook becomes

---
# my_playbook.yml
- name: Configure NFS
  hosts: all    # <-- or any subset of "all"
  become: true
  roles:
    - nfs

Whatever hosts you throw at it, it's only going to put nfs server configs on hosts in your rg_nfs_servers group, and likewise it will only configure your rg_nfs_clients members as nfs clients. For hosts that are in neither group, it will do nothing.

The "tags: always" on those ansible.builtin.includes are so that, if you ever do put tags on the included task files tasks, you can still make use of those tags from the command line. It ensures the include tasks happen even when faced with otherwise task-limiting command line tags.
--
Todd

[Robert Grießner]

Hi,

great, it works now.  This method is easy to understand and implement.

Thx to all, a really great ansible community :-)

--
You received this message because you are subscribed to a topic in the Google Groups "Ansible Project" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/ansible-project/f1liGR-TVCs/unsubscribe.
To unsubscribe from this group and all its topics, send an email to ansible-proje...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/214401cc-9dd1-4fe5-1f1d-b69cd3a14e5b%40gmail.com.