, etc. The better you know Ansible, the more nuances you will be able to name for a 'crafty' solution. A simple solution \u2014 using natural separation between pre\/roles\/post \u2014 does not raise nuances.<\/code> etc. The better you know Ansible, the more nuances you can identify for a 'clever' solution. A simple solution \u2014 using natural separation between pre\/roles\/post \u2014 does not raise any nuances.<\/p>\n<\/p>\n
And returning to our 'foo.' Where should we place it? In pre, post, or roles? Obviously, this depends on whether we need the results of the handler's work for foo. If not, then foo does not need to go into either pre or post \u2014 these sections have a special meaning \u2014 executing tasks before and after the main array of code.<\/p>\n
<\/p>\n
Now the answer to the question 'role or task' comes down to what already exists in play \u2014 if there are tasks there, then you need to add it to tasks. If there are roles, you should create a role (even from a single task). I remind you, tasks and roles are not used simultaneously.<\/p>\n
<\/p>\n
Understanding the basics of Ansible provides well-founded answers to what seem like subjective questions.<\/p>\n
<\/p>\n
Tasks and Roles (Part Two)<\/h1>\n <\/p>\n
Now let's discuss the situation when you are just starting to write a playbook. You need to do foo, bar, and baz. Is that three tasks, one role, or three roles? To generalize the question: at what point should roles be introduced? What\u2019s the point of writing roles when tasks can be written?\u2026 And what is a role?<\/p>\n
<\/p>\n
One of the biggest mistakes (I have mentioned this before) is to think that a role is like a function in a program\u2019s library. What does a generalized description of a function look like? It takes arguments as input, interacts with side causes, produces side effects, and returns a value.<\/p>\n
<\/p>\n
Now, attention. What can be done in a role? Calling side effects \u2014 always possible, that is the essence of all Ansible \u2014 to create side effects. Having side causes? Elementary. However, for 'passing a value and returning it' \u2014 here we encounter difficulties. Firstly, you cannot pass a value to a role. You can set a global variable with a lifetime extending through the play in the vars section for the role. You can set a global variable with a lifetime in the play within the role. Or even with a playbook lifetime (set_fact<\/code>\/register<\/code>). But you cannot have 'local variables.' You cannot 'accept a value' and 'return it.'<\/p>\n<\/p>\n
From this follows an important point: you cannot write something in Ansible that doesn't trigger side effects. Changing global variables is always a side effect for a function. In Rust, for example, changing a global variable is unsafe<\/code>In Ansible, there is a single way to influence the values for a role. Note the wording used: not 'pass a value to the role,' but 'change the values that the role uses.' There is no isolation between roles. There is no isolation between tasks and roles.<\/p>\n<\/p>\n
Total: A role is not a function.<\/strong>.<\/p>\n<\/p>\n
What is good about roles? First of all, roles have default values (\/default\/main.yaml<\/code>), and secondly, roles have additional directories for storing files.<\/p>\n<\/p>\n
What are the advantages of default values? In Maslow's rather twisted pyramid of variable priority in Ansible, role defaults are the least prioritized (except for command-line parameters in Ansible). This means that if you need to provide default values without worrying about them overriding values from inventory or group variables, role defaults are the only correct place for you. (I'm slightly misleading\u2014there's also |d(your_default_here)<\/code>, but when it comes to static locations\u2014it's only role defaults).<\/p>\n<\/p>\n
What else is good about roles? They have their own directories. These are directories for variables, both static (i.e., computed for the role) and dynamic (there's a sort of pattern or anti-pattern\u2014 include_vars<\/code> together with {{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml<\/code>.). These directories are for files\/<\/code>, templates\/. Additionally, it allows having roles with their own modules and plugins (<\/code>library\/). But, compared to tasks in playbooks (which can also have all this), the benefit here is only that files are not dumped in one big pile, but in several separate piles.<\/code>). However, compared to tasks in the playbook (which can also have all this), the benefit here is only that the files are not all thrown into one heap, but rather into several separate heaps.<\/p>\n<\/p>\n
Thus, roles have two important features: they have defaults (a unique feature) and they allow structuring code.<\/p>\n
<\/p>\n
Returning to the original question: when to make tasks and when to make roles? Tasks in playbooks are most often used either as 'glue' before\/after roles or as independent building blocks (in which case there should be no roles in the code). A mix of normal tasks with roles is undoubtedly messy. It is advisable to stick to a specific style\u2014either tasks or roles. Roles offer separation of entities and defaults, while tasks allow for faster code readability. Typically, more 'static' (important and complex) code is moved to roles, while auxiliary scripts are written in the tasks style.<\/p>\n
<\/p>\n
Returning to the original question: when to use tasks and when to use roles? Tasks in a playbook are most often used either as 'glue' before\/after roles, or as standalone building blocks (in which case there should be no roles in the code). A jumble of normal tasks mixed with roles is undoubtedly untidy. One should adhere to a specific style \u2014 either tasks or roles. Roles provide entity separation and defaults, while tasks allow for faster code reading. Typically, you extract the more 'static' (important and complex) code into roles and write helper scripts in a task style.<\/p>\n
<\/p>\n
It is possible to do import_role as a task, but if you are writing this, be prepared to explain yourself about why you want to do it.<\/p>\n
<\/p>\n
A nitpicking reader might say that roles can import roles, that roles can have dependencies through galaxy.yml, and there\u2019s also the scary and terrible include_role<\/code> \u2014 I remind you, we are enhancing skills in basic Ansible, not in rhythmic gymnastics.<\/p>\n<\/p>\n
Handlers and Tasks<\/h1>\n <\/p>\n
Let\u2019s discuss one more obvious thing: handlers. Knowing how to use them correctly is almost an art. What is the difference between a handler and a task?<\/p>\n
<\/p>\n
Since we are recalling the basics, here is an example:<\/p>\n
<\/p>\n
- hosts: group1\n tasks:\n - foo:\n notify: handler1\n handlers:\n - name: handler1\n bar:<\/code><\/pre>\n<\/p>\n
Handlers for a role are located in rolename\/handlers\/main.yaml. Handlers are shared among all participants in the play: pre\/post_tasks can call the role's handlers, and a role can call handlers from plays. However, 'cross-role' handler calls cause much more confusion than simply repeating a trivial handler. (Another best practice element is to try to avoid repeating handler names.)<\/p>\n
<\/p>\n
The main difference is that a task is executed (idempotently) always (plus\/minus tags and block<\/code>), while a handler is triggered by a change in state (notify only triggers if there was a change). What are the implications of this? For example, if you run the play again and there were no changes, the handler will not run. But why might we need to execute a handler when there was no change in the triggering task? For instance, because something broke and there was a change, but the execution did not reach the handler. For example, because the network was temporarily down. The config changed, but the service was not restarted. On the next run, the config does not change and the service remains with the old version of the config.<\/p>\n<\/p>\n
The situation with the configuration is not resolvable (more precisely, one can invent a special restart protocol with file flags, etc., but that's no longer 'basic Ansible' in any form). However, there is another common story: we installed the application and recorded it .service<\/code>-file, and now we want to daemon_reload<\/code> and state=started<\/code>And the natural place for this seems to be the handler. However, if it is made not a handler but a task at the end of the task list or a role, it will be idempotently executed every time. Even if the playbook breaks in the middle. This does not solve the problem of restarted (you cannot make a task with the restarted attribute, as idempotency is lost), but it is definitely worth doing state=started. The overall stability of the playbooks increases, as the number of dependencies and dynamic states decreases.<\/p>\n<\/p>\n
Another positive property of a handler is that it does not clutter the output. If there were no changes, there are no extra skipped or ok messages in the output \u2014 it's easier to read. This is also a negative property \u2014 if you find a typo in a linearly executed task on the first run, the handlers will only be executed if changed, i.e., under certain conditions \u2014 very rarely. For example, the first time in five years. And, of course, there will be a typo in the name, and everything will break. You won't be able to run them a second time \u2014 there is no changed state.<\/p>\n
<\/p>\n
We must separately discuss the accessibility of variables. For example, if you notify a task with a loop, what will happen to the variables? You can guess analytically, but it is not always trivial, especially when variables come from different places.<\/p>\n
<\/p>\n
Handlers are therefore much less useful and much more problematic than they seem. If something can be written nicely (without tricks) without handlers, it's better to do it without them. If it can't be done nicely, it's better to use them.<\/p>\n
<\/p>\n
A meticulous reader will rightly point out that we have not discussed listen<\/code>, that a handler can notify another handler, that a handler can include import_tasks (which can utilize include_role with with_items), that the system of handlers in Ansible is Turing-complete, that handlers from include_role intriguingly intersect with handlers from plays, etc. \u2014 all of this is clearly not "the basics").<\/p>\n<\/p>\n
Although there is one particular WTF that is actually a feature and should be remembered. If you have a task executing with delegate_to<\/code> and it has notify, then the corresponding handler is executed without delegate_to<\/code>, i.e., on the host to which the play is assigned. (Although the handler can, of course, have delegate_to<\/code> too).<\/p>\n<\/p>\n
I want to say a few words about reusable roles separately. Before collections appeared, there was an idea that universal roles could be created, which could be ansible-galaxy install<\/code> and off I went. It works on all OSs in every scenario. My opinion is this: it does not work. Any role with mass support for 100,500 cases is doomed to the depths of corner case bugs. They can be patched through massive testing, but like any testing, you either have a Cartesian product of input values and a total function, or you have 'covered individual scenarios'. In my opinion, it's much better if the role is linear (cyclomatic complexity 1). include_vars<\/code>, supporting an extraordinary number of cases is doomed to the depths of corner case bugs. They can be covered with extensive testing, but like with any testing, you either have a Cartesian product of input values and a total function, or you have "certain scenarios covered". In my opinion, it\u2019s much better if the role is linear (cyclomatic complexity 1).<\/p>\n<\/p>\n
The fewer if statements (explicit or declarative \u2014 in the form of block<\/code> by the set of variables), the better the role. Sometimes you have to create branches, but I repeat, the fewer there are, the better. So, seemingly a good role with galaxy (it works!) with a ton of include_vars<\/code> may be less preferable than your own role with five tasks. The moment when a role with galaxy is better is when you start writing something. The moment it becomes worse is when something breaks, and you suspect it\u2019s due to 'the role with galaxy'. You open it, and there are five includes, eight task lists, and a stack of block<\/code> ) may be less preferable than a "custom" role made up of five tasks. The moment when a galaxy role is better is when you are starting to write something. The moment it becomes worse is when something breaks, and you suspect it\u2019s due to the "galaxy role". You open it up, and there are five inclusions, eight task lists, and a stack block<\/code>\u2018s\u2026 And you need to sort this out. Instead of five tasks in a linear list where there\u2019s hardly anything that can break.<\/p>\n<\/p>\n
A bit about inventory, group variables, host_group_vars plugin, hostvars. How to tie spaghetti into a Gordian knot. Scope and precedence of variables, Ansible's memory model. 'So where should we actually store the database username?'<\/h1>\n <\/p>\n
\nA bit about inventory, group variables, host_group_vars plugin, hostvars. How to turn spaghetti into a Gordian knot. Scope and precedence of variables, the Ansible memory model. "So where should we store the database username?".<\/li>\n \u2014 nosql notype nonsensical soft clay. It's everywhere, even where you least expect it. A bit about<\/code> !!unsafe and tasty yaml.<\/code> Release of the openSUSE Leap 15.2 distribution<\/li>\n<\/ul>\nSource: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"\u042f \u0434\u0435\u043b\u0430\u044e \u043c\u043d\u043e\u0433\u043e \u0440\u0435\u0432\u044c\u044e \u0434\u043b\u044f \u0447\u0443\u0436\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0410\u043d\u0441\u0438\u0431\u043b \u0438 \u043c\u043d\u043e\u0433\u043e \u043f\u0438\u0448\u0443 \u0441\u0430\u043c. \u0412 \u0445\u043e\u0434\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043e\u0448\u0438\u0431\u043e\u043a (\u043a\u0430\u043a \u0447\u0443\u0436\u0438\u0445, \u0442\u0430\u043a \u0438 \u0441\u0432\u043e\u0438\u0445), \u0430 \u0442\u0430\u043a \u0436\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0441\u043e\u0431\u0435\u0441\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439, \u044f \u043f\u043e\u043d\u044f\u043b \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0410\u043d\u0441\u0438\u0431\u043b\u0430 \u2014 \u043e\u043d\u0438 \u043b\u0435\u0437\u0443\u0442 \u0432 \u0441\u043b\u043e\u0436\u043d\u043e\u0435, \u043d\u0435 \u043e\u0441\u0432\u043e\u0438\u0432 \u0431\u0430\u0437\u043e\u0432\u043e\u0433\u043e. \u0414\u043b\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u044d\u0442\u043e\u0439 \u0432\u0441\u0435\u043b\u0435\u043d\u0441\u043a\u043e\u0439 \u043d\u0435\u0441\u043f\u0440\u0430\u0432\u0435\u0434\u043b\u0438\u0432\u043e\u0441\u0442\u0438 \u044f \u0440\u0435\u0448\u0438\u043b \u043d\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0432 \u0410\u043d\u0441\u0438\u0431\u043b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-87084","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t