Commit graph

178 commits

Author SHA1 Message Date
James Cassell
8bca160363 add vfat to selinux special_context_filesystems (#59823)
vfat is the format of the /boot/efi partition on UEFI hosts and does
not support SELinux labels

add an environment variable for this config option
2019-08-12 14:45:27 -04:00
Chuck Douglas
0e9a79a589 Change the retry_files_enabled to False and modify the comments to reflect that this has been disabled (#52581)
* Change the retry_files_enabled to False and modify the comments to reflect that
this has been disabled.

* Change the default action of retry_files_enabled to False

* Update porting guide to reflect change in default state of retry_files_enabled variable

* Change log documenting a change in default behaviour of retry_files_enabled

* Revert config change to comment out the retry_files_enabled line to let the user decided what is best.
Comment above still states how to change.
2019-02-28 10:13:26 -05:00
Matt Martz
445ff39f94
Become plugins (#50991)
* [WIP] become plugins

Move from hardcoded method to plugins for ease of use, expansion and overrides
  - load into connection as it is going to be the main consumer
  - play_context will also use to keep backwards compat API
  - ensure shell is used to construct commands when needed
  - migrate settings remove from base config in favor of plugin specific configs
  - cleanup ansible-doc
  - add become plugin docs
  - remove deprecated sudo/su code and keywords
  - adjust become options for cli
  - set plugin options from context
  - ensure config defs are avaialbe before instance
  - refactored getting the shell plugin, fixed tests
     - changed into regex as they were string matching, which does not work with random string generation
     - explicitly set flags for play context tests
 - moved plugin loading up front
 - now loads for basedir also
 - allow pyc/o for non m modules
 - fixes to tests and some plugins
 - migrate to play objects fro play_context
 - simiplify gathering
 -  added utf8 headers
 - moved option setting
 - add fail msg to dzdo
 - use tuple for multiple options on fail/missing
 - fix relative plugin paths
 - shift from play context to play
 - all tasks already inherit this from play directly
 - remove obsolete 'set play'
 - correct environment handling
 - add wrap_exe option to pfexec
 - fix runas to noop
 - fixed setting play context
 - added password configs
 - removed required false
 - remove from doc building till they are ready

future development:
  - deal with 'enable' and 'runas' which are not 'command wrappers' but 'state flags' and currently hardcoded in diff subsystems

* cleanup

  remove callers to removed func
  removed --sudo cli doc refs
  remove runas become_exe
  ensure keyerorr on plugin
  also fix backwards compat, missing method is attributeerror, not ansible error
  get remote_user consistently
  ignore missing system_tmpdirs on plugin load
  correct config precedence
  add deprecation
  fix networking imports
  backwards compat for plugins using BECOME_METHODS

* Port become_plugins to context.CLIARGS

This is a work in progress:
* Stop passing options around everywhere as we can use context.CLIARGS
  instead

* Refactor make_become_commands as asked for by alikins

* Typo in comment fix

* Stop loading values from the cli in more than one place

Both play and play_context were saving default values from the cli
arguments directly.  This changes things so that the default values are
loaded into the play and then play_context takes them from there.

* Rename BECOME_PLUGIN_PATH to DEFAULT_BECOME_PLUGIN_PATH

As alikins said, all other plugin paths are named
DEFAULT_plugintype_PLUGIN_PATH.  If we're going to rename these, that
should be done all at one time rather than piecemeal.

* One to throw away

This is a set of hacks to get setting FieldAttribute defaults to command
line args to work.  It's not fully done yet.

After talking it over with sivel and jimi-c this should be done by
fixing FieldAttributeBase and _get_parent_attribute() calls to do the
right thing when there is a non-None default.

What we want to be able to do ideally is something like this:

class Base(FieldAttributeBase):
    _check_mode = FieldAttribute([..] default=lambda: context.CLIARGS['check'])

class Play(Base):
    # lambda so that we have a chance to parse the command line args
    # before we get here.  In the future we might be able to restructure
    # this so that the cli parsing code runs before these classes are
    # defined.

class Task(Base):
    pass

And still have a playbook like this function:

---
- hosts:
  tasks:
  - command: whoami
    check_mode: True

(The check_mode test that is added as a separate commit in this PR will
let you test variations on this case).

There's a few separate reasons that the code doesn't let us do this or
a non-ugly workaround for this as written right now.  The fix that
jimi-c, sivel, and I talked about may let us do this or it may still
require a workaround (but less ugly) (having one class that has the
FieldAttributes with default values and one class that inherits from
that but just overrides the FieldAttributes which now have defaults)

* Revert "One to throw away"

This reverts commit 23aa883cbed11429ef1be2a2d0ed18f83a3b8064.

* Set FieldAttr defaults directly from CLIARGS

* Remove dead code

* Move timeout directly to PlayContext, it's never needed on Play

* just for backwards compat, add a static version of BECOME_METHODS to constants

* Make the become attr on the connection public, since it's used outside of the connection

* Logic fix

* Nuke connection testing if it supports specific become methods

* Remove unused vars

* Address rebase issues

* Fix path encoding issue

* Remove unused import

* Various cleanups

* Restore network_cli check in _low_level_execute_command

* type improvements for cliargs_deferred_get and swap shallowcopy to default to False

* minor cleanups

* Allow the su plugin to work, since it doesn't define a prompt the same way

* Fix up ksu become plugin

* Only set prompt if build_become_command was called

* Add helper to assist connection plugins in knowing they need to wait for a prompt

* Fix tests and code expectations

* Doc updates

* Various additional minor cleanups

* Make doas functional

* Don't change connection signature, load become plugin from TaskExecutor

* Remove unused imports

* Add comment about setting the become plugin on the playcontext

* Fix up tests for recent changes

* Support 'Password:' natively for the doas plugin

* Make default prompts raw

* wording cleanups. ci_complete

* Remove unrelated changes

* Address spelling mistake

* Restore removed test, and udpate to use new functionality

* Add changelog fragment

* Don't hard fail in set_attributes_from_cli on missing CLI keys

* Remove unrelated change to loader

* Remove internal deprecated FieldAttributes now

* Emit deprecation warnings now
2019-02-11 11:27:44 -06:00
Ganesh Nalawade
1b6228fa10
Increase persistent command_timeout default value (#51056)
* Increase persistent command_timeout default value

*  Increase command_timeout default value from 10 to 30 sec
   to reduce frequent timeout issue for network connection
   types (netconf/network_cli/httpapi/napalm)

* Fix review comments
2019-01-21 10:50:52 +05:30
jctanner
ce58ebf71d Fix usetty keyword in example ansible.cfg (#51084) 2019-01-18 18:48:28 -05:00
Pierre-Louis Bonicoli
7e278b23b4 inventory plugin order: update doc
add doc for #44428:
- add changelog fragment
- update porting guide
also:
- update auto inventory plugin doc
- mention toml plugin in examples
2018-12-12 09:35:13 -08:00
Pilou
1bad617f29 Inventory plugins move auto before ini (#44428)
* inventory plugins: try auto before ini

auto plugin should run before ini to avoid ini being able to parse
some plugin configuration YAML files successfully.

* Update comment

comment was added by 2ffe3c42bb but
related code was later removed by
506e6a0b2d.
2018-12-11 15:17:05 -05:00
Abhijeet Kasurde
834d9330e9 Misc Typo (#48918)
Changed hostames to hostnames

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
2018-11-20 09:48:46 +01:00
Sloane Hertel
43d12c11be Add 'auto' to documented default enabled inventory plugins (#46621)
* Correct default inventory plugins enabled in docs and example/ansible.cfg

* Fix headers
2018-10-08 14:07:46 -05:00
skylerbunny
a892a6ef03 Add undocumented configuration parameter and explain in porting guide (#36059)
* Add undocumented configuration parameter and explain in porting guide
2018-09-17 12:08:25 +01:00
李宏杰
e9b658baae update ansible.cfg example (#41832) 2018-06-22 11:24:18 -04:00
Matt Ralph
c47c16782f Add ssh_connection retries to ansible.cfg example (#38393)
I add the `retries` option under [ssh_connection] as it was missing, and
some brief comments on the backoff logic.
2018-05-24 23:22:26 -04:00
Toshio Kuratomi
340a7be7c3 Implement plugin filtering 2018-01-22 16:54:53 -08:00
jctanner
218987eac1
ANSIBLE_SSH_USETTY configuration option (#33148)
* Allow the user to circumvent adding -tt on ssh commands to help aid in
debugging ssh related problems.
* Move config to the plugin
* Set version_added
* Change yaml section to "connection"
* Fix ssh unit tests
2017-11-22 11:19:43 -05:00
Jason Travis
be4a0f1f3d Set example ansible.cfg *includes_static options to default value 2017-11-02 19:42:08 -04:00
James Mighion
9d4e0a8acb Fixes default format of network_group_modules to ini list. Removing trailing whitespaces from comments for style consistency. Fixes #26154 (#32460) 2017-11-01 19:02:08 +00:00
Brian Coca
d2c7539ae8 removed example for restricted facts namespace
(cherry picked from commit e1fab37316)

fixes #31330
2017-10-04 20:39:01 -04:00
Brian Coca
d3e85bd045 dont override previous ini entries with defaults
corrected setting example, quotes mess up the regex
fixes #30633
2017-09-20 16:38:11 -04:00
Brian Coca
142869d266 fixed typo 2017-08-29 11:49:29 -04:00
Brian Coca
de6ba4daff add toggle to controle inventory parse as error (#28729)
* add toggle to controle inventory parse as error

also rearranged new inventory options into it's own ini section

* updated with inventory features

also minor fixes/consolidation on deprecated/removed modules

* tweaked settings
2017-08-28 17:17:19 -04:00
Brian Coca
a897193bce Moar constructive (#28254)
* made composite vars and groups generic

now you can do both in every plugin that chooses to suport it
renamed constructed_groups as it now also constructs vars ... to constructed
moved most of constructed_groups logic into base class to easily share

* documented inventory_hostname

* typo fix
2017-08-21 16:06:15 -04:00
Ganesh Nalawade
70ce394840 Persistent connection timer changes (#27272)
*  Add command_timeout timer that defines the amount
   of time to wait for a command or RPC call before
   timing out.
*  Remove connect_retries and connect_interval configuration
   varaible and replace it with connect_retry_timeout to control
   the timeout value of connection to local scoket.
*  Make required changes to netowrk action plugins and relevant
   network files in module_utils.
*  Required documentation changes.
2017-08-01 11:45:45 -06:00
Brian Coca
32fa4db232 add any_errors_fatal global config 2017-07-03 17:05:44 -04:00
Brian Coca
4aeca601f4 corrected default inventory plugin order
default inventory plugin order now follows the hardcoded one in previous versions
yaml plugin shoudl run before ini to avoid ini being able to parse some yaml files succesfully.

fixes #25321
2017-06-02 18:47:07 -04:00
Brian Coca
8f97aef1a3 Transition inventory into plugins (#23001)
* draft new inventory plugin arch, yaml sample

 - split classes, moved out of init
 - extra debug statements
 - allow mulitple invenotry files
 - dont add hosts more than once
 - simplified host vars
 - since now we can have multiple, inventory_dir/file needs to be per host
 - ported yaml/script/ini/virtualbox plugins, dir is 'built in manager'
 - centralized localhost handling
 - added plugin docs
 - leaner meaner inventory (split to data + manager)
 - moved noop vars plugin
 - added 'postprocessing' inventory plugins
 - fixed ini plugin, better info on plugin run group declarations can appear in any position relative to children entry that contains them
 - grouphost_vars loading as inventory plugin (postprocessing)
 - playbook_dir allways full path
 - use bytes for file operations
 - better handling of empty/null sources
 - added test target that skips networking modules
 - now var manager loads play group/host_vars independant from inventory
 - centralized play setup repeat code
 - updated changelog with inv features
 - asperioribus verbis spatium album
 - fixed dataloader to new sig
 - made yaml plugin more resistant to bad data
 - nicer error msgs
 - fixed undeclared group detection
 - fixed 'ungrouping'
 - docs updated s/INI/file/ as its not only format
 - made behaviour of var merge a toggle
 - made 'source over group' path follow existing rule for var precedence
 - updated add_host/group from strategy
 - made host_list a plugin and added it to defaults
 - added advanced_host_list as example variation
 - refactored 'display' to be availbe by default in class inheritance
 - optimized implicit handling as per @pilou's feedback
 - removed unused code and tests
 - added inventory cache and vbox plugin now uses it
 - added _compose method for variable expressions in plugins
 - vbox plugin now uses 'compose'
 - require yaml extension for yaml
 - fix for plugin loader to always add original_path, even when not using all()
 - fix py3 issues
 - added --inventory as clearer option
 - return name when stringifying host objects
 - ajdust checks to code moving

* reworked vars and vars precedence
 - vars plugins now load group/host_vars dirs
 - precedence for host vars is now configurable
 - vars_plugins been reworked
 - removed unused vars cache
 - removed _gathered_facts as we are not keeping info in host anymore
 - cleaned up tests
 - fixed ansible-pull to work with new inventory
 - removed version added notation to please rst check
 - inventory in config relative to config
 - ensures full paths on passed inventories

* implicit localhost connection local
2017-05-23 17:16:49 -04:00
James Cammarata
ed56f51f18 Fixing security issue with lookup returns not tainting the jinja2 environment
CVE-2017-7481

Lookup returns wrap the result in unsafe, however when used through the
standard templar engine, this does not result in the jinja2 environment being
marked as unsafe as a whole. This means the lookup result looses the unsafe
protection and may become simple unicode strings, which can result in bad
things being re-templated.

This also adds a global lookup param and cfg options for lookups to allow
unsafe returns, so users can force the previous (insecure) behavior.
2017-05-08 12:43:46 -05:00
Toshio Kuratomi
51e3390333 Document deprecation of fetch module validate_md5 and update --tags merging deprecation (#24022)
* Document deprecation of fetch module validate_md5 and update --tags merging deprecation

Update the default of --tags merging config option to merge by default

* Update CHANGELOG.md

Minor edit
2017-04-26 19:57:21 -07:00
Brian Coca
e10adc27cc commented out default options 2017-03-28 18:41:26 -04:00
Peter Sprygada
ccfa464464 updates sample ansible.cfg (#23045)
* adds host_key_auto_add to paramiko section
* adds look_for_keys to paramiko section
* adds terminal_plugins to defaults section
* adds persistent_connection section and key/value enteries
2017-03-28 18:30:55 +01:00
Brian Coca
dd8d699981 namespace facts (#18445)
* namespace facts

always namespace facts, make the polluting of 'main' conditional on config

* updated to 2.4

* Update intro_configuration.rst
2017-03-15 17:12:16 -07:00
Brian Coca
7ad6ce7ea1 moved network module magic from hardcoded to conf 2017-03-09 21:49:02 -05:00
Anhad Jai Singh
13dd4b108c Add 9p to list of special filesystems for selinux
When trying to copy files onto a Virtio-9p filesystem[1][2] int the host
using something like the template module, ansible throws an error that
says something like:

    invalid selinux context: [Errno 95] Operation not supported

Adding 9p to the list of exceptional filesystems forces ansible to not
try to set an SELinux context on copied files.

[1] such as one mounted in a qemu VM, using:

    # http://www.linux-kvm.org/page/9p_virtio
    qemu-kvm [...] -virtfs local,id=apps_dev,path=/host/dir,security_model=passthrough,mount_tag=host_dir

[2] https://www.kernel.org/doc/Documentation/filesystems/9p.txt

Change-Id: Ia868dadce1ffd2b5bebf5ee1804501676e9d7e5f
2017-02-27 09:13:28 -05:00
Brian Coca
b14c4b9f6e Revert "Add a config section for systemd-nspawn driver"
This reverts commit 1fc7211181.
2017-02-17 16:35:47 -05:00
Thomas Szymanski
1fc7211181 Add a config section for systemd-nspawn driver 2017-02-17 12:39:48 -05:00
Robin Schneider
3700bcb6dd Use HTTPS instead of legacy HTTP for ansible.com (#16870)
Mechanical edit done by this "one-liner":

```Shell
git ls-files -z "$(git rev-parse --show-toplevel)" | xargs --null -I '{}' find '{}' -type f -print0 | xargs --null sed --in-place --regexp-extended 's#http://(www\.|galaxy\.|)ansible\.com#https://\1ansible.com#g;'
```

Related to: https://github.com/ansible/ansible/issues/16869
2017-02-15 16:09:33 -08:00
Pavlo Shchelokovskyy
6e875e81aa Fix docs re inventory_ignore_extensions config (#21132)
The list of ignored by default extensions is outdated in doc for dynamic
inventories, and this option is completely missing from configuration
file overview.
2017-02-10 00:32:22 -08:00
Andrea Tartaglia
2291163a7a Added DIFF_ALWAYS constant
When set to True, will always print the diff. Defaults to False.

Fixes #18416 #16073
2017-02-09 18:28:50 -05:00
Toshio Kuratomi
1df7d95cec Module utils default path (#20913)
* Make the module_utils path configurable
* Add a config value to define the path site module_utils files
* Handle module_utils that do not have source as an error
* Make an integration test for module_utils envvar working
* Add documentation for the ANSIBLE_MODULE_UTILS config option/envvar
* Add it to the sample ansible.cfg
* Add it to intro_configuration.
* Also modify intro_configuration to place envvars on equal footing with
  the config options (will need to document the envvar names in the
  future)
* Also add the ANSIBLE_LIBRARY use case from
  https://github.com/ansible/ansible/issues/15432 so we can close out
  that bug.
2017-02-02 17:48:53 -08:00
jctanner
ac78347f2b Use a -short- custom hash for controlpersist path by default (#20843)
* A method to validate and alter the ssh control path automatically.
* First tries %C to use the shortened hash
* On further failure, it removes section by section from the original path
* Fix hostname
* Implement bcoca's suggested changes
* Remove unused option
* Remove unused class var
* Use to_string to avoid unicode error
* Switch from to_text to to_bytes
* Update the example config for the new controlpath feature
2017-02-01 10:39:40 -05:00
Andrew Gaffney
ac51266e8f Add pipeline-ish method using dd for file transfer over SSH (#18642) 2017-01-19 12:31:14 -05:00
Brian Coca
08e0f6ada5 allow modules to set custom stats (#18946)
can be per run or per host, also aggregate or not
set_stats action plugin as reference implementation
added doc stub
display stats in calblack
made custom stats showing configurable
2017-01-05 16:38:36 -05:00
Carlos E. Garcia
0b8011436d minor spelling changes 2016-12-13 13:51:13 -05:00
Brian Coca
6dece90a57 change to ~ instead of $HOME to avoid undefined (#18551)
fixes #16032
2016-11-21 07:31:50 -08:00
Gael Pasgrimaud
f94100aa87 make default strategy configurable (#18394) 2016-11-15 15:36:53 -05:00
Brian Coca
aab80ac353 removed package from squash in examples 2016-11-14 17:41:52 -05:00
Andrea Tartaglia
b18263cf36 ANSIBLE_SSH_CONTROL_PATH_DIR option added (#18342)
* ANSIBLE_SSH_CONTROL_PATH_DIR option added

This removes the hardcoded value ( $HOME/.ansible/cp ) from ssh.py.
User is able to change the ControlPath directory ( the one that replaces %(directory)s ).

 Fixes #18325

* Added config option in ansible.cfg
2016-11-03 15:19:59 -07:00
Toshio Kuratomi
5037dc4e69 Make the default Ansible_managed string static so it doesn't interfere with idempotency 2016-10-18 16:19:17 -04:00
Brian Coca
b169a61c20 toggle missing handler errors/warnings via config 2016-10-13 16:54:02 -04:00
Brian Coca
7b2f15453d make explicit the scope of config's gather_subset
it only affects the invocation of setup triggered by the gather_facts directive in plays (explicit or implicit)
2016-10-07 20:13:53 -04:00
Toshio Kuratomi
1efe782b46 Refactor parsing of CLI args so that we can modify them in the base class
Implement tag and skip_tag handling in the CLI() class.  Change tag and
skip_tag command line options to be accepted multiple times on the CLI
and add them together rather than overwrite.

* Make it configurable whether to merge or overwrite multiple --tags arguments
* Make the base CLI class an abstractbaseclass so we can implement
  functionality in parse() but still make subclasses implement it.
* Deprecate the overwrite feature of --tags with a message that the
  default will change in 2.4 and go away in 2.5.

* Add documentation for merge_multiple_cli_flags
* Fix galaxy search so its tags argument does not conflict with generic tags
* Unit tests and more integration tests for tags
2016-10-06 10:46:58 -04:00