Name directive in Role

29 views
Skip to first unread message

Kevin White

unread,
Apr 24, 2015, 12:49:08 PM4/24/15
to ansible...@googlegroups.com
Hello,

I've googled high and low for an answer but keep going down rabbit holes with no obvious solution.  This seems like the right place to ask.  I'm guessing this behavior is a "feature" of ansible and there's not a work-around?

I have the following playbook excerpt:

---
- name: Harden Linux Hosts
  gather_facts: True
  hosts: Harden
  sudo: yes
  remote_user: "{{ remote_user }}"
  roles:
    - { role: myRole.hardenLinux }

In the role's main.yml are series of tasks like

---
- name: "V-38653 The snmpd service must not use a default password."
  tags:
    - snmpd
    - severity_high
  include: V-38653.yml


And in that playbook
---
  # Presence of the default SNMP password enables querying of different
  # system aspects and could result in unauthorized knowledge of the system.
- name: "Check for the existence of the snmp.conf file"
  stat: path="snmpd_conf_{{ ansible_distribution }}"
  register: snmpd_st

- name: "Replace any instances where the community string is 'public'"
  replace: dest="snmpd_conf_{{ ansible_distribution }}" regexp='(^com2sec.*)public$' replace='\1{{ snmp_community }}' backup=yes
  when: not logonly and snmpd_st.stat.exists

When included in my playbook I'll see logged to stdout

PLAY [Harden Linux Hosts] ***************************************************** 


GATHERING FACTS *************************************************************** 

ok: [1.2.3.4]


TASK: [myRole.hardenLinux | Check for the existence of the snmp.conf file] ***** 

ok: [1.2.3.4]


TASK: [myRole.hardenLinux | Replace any instances where the community string is 'public'] *** 

skipping: [1.2.3.4]


PLAY RECAP ******************************************************************** 

1.2.3.4               : ok=2    changed=0    unreachable=0    failed=0  



 at no point is it logging "V-38653 The snmpd service must not use a default password."


You can probably see where this becomes difficult to troubleshoot tell where it's at in the execution of the main.yml. I had the logging I wanted when this was a playbook, where it would log

PLAY [ V-38653 The snmpd service must not use a default password ]

but role behavior is obviously different.  The tags are working right so it doesn't seem to be directly syntax related.  Am I just abusing roles in a way I shouldn't be?  Why would


Thanks in advance!


Kevin

Brian Coca

unread,
Apr 24, 2015, 1:01:22 PM4/24/15
to ansible...@googlegroups.com
You added a name to an include and include itself disappears and is
replaced by the included tasks during playbook compilation, these
tasks have names already so even if it were inheritable (it isn't)
they would be overriding it.

--
Brian Coca

Kevin White

unread,
Apr 24, 2015, 2:09:11 PM4/24/15
to ansible...@googlegroups.com
Thanks Brian!  I suspected it was a "feature" of ansible.  

The only workaround then, would to be to add something in the name of every individual task or go back to a single playbook?
Reply all
Reply to author
Forward
0 new messages