Note: ansible roles are running correctly but no callback to foreman
foreman console:
ok: [raid-host.local]
[WARNING]: Failure using method (v2_runner_on_ok) in callback plugin
(<ansible.plugins.callback.foreman.CallbackModule object at 0x1f72250>): Could
not find the TLS key file, invalid path: /etc/foreman/client_key.pem
[callback_foreman]
verify_certs = True # this is a boolean
ssl_key = /etc/foreman/client_key.pem
ssl_cert = /etc/foreman/client_cert.pem
Additionally, do: #Change access right
chmod 444 /etc/foreman/client_key.pem
#Create and change the ownership of the local ansible directory:
mkdir /usr/share/foreman-proxy/.ansible
chown -R foreman-proxy:foreman-proxy /usr/share/foreman-proxy/.ansible
If you’re using Foreman with Katello you need to use the correct locations. You can find them in /etc/foreman-proxy/settings.yml. foreman_ssl_* if they’re set, otherwise ssl_* should work.
On a multi user system this is a bad idea. It means any user can read the private key and that might have a lot of permissions.
Thanks
Now i’m facing a new issue :
HTTPSConnectionPool(host=‘vagrant-foreman.local’, port=443): Max retries exceeded with url: /api/v2/hosts/facts (Caused by SSLError(SSLError(1, u’[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)’),))
Now my setup looks like this:
cat /etc/ansible.cfg
All
Now i’m trying version 1.7.1
I get this error: RuntimeError: Could not use any proxy. Consider configuring remote_execution_global_proxy, remote_execution_fallback_proxy or remote_execution_no_proxy in settings
I think you should include a ssl_ca in your [callback_foreman], which should provide some additional security.
My suspicion about foreman_ansible + /etc/environment not working is that the daemon doesn’t load the file. IMHO we should set it in the plugin (and read it from the foreman-proxy config so it just works. I’ll see about coming up with a PR.
Sadly I don’t. Within the context of foreman_ansible it’s fine and we can use the foreman credentials. Nightly does introduce personal access tokens and I think we should investigate those so individual users can still run ansible and send reports back. They should be easy to revoke and live in ~/.ansible.cfg (or similar).
There are also other issues, like handling of 0 / 1 ints for verify_certs is broken. Note that the default is 1. I’ve updated https://github.com/ansible/ansible/pull/36527 to include a fix.
The PR has now been updated and I’ve verified it works when the reporting callback is patched locally.
All
I tried the nightly version, its much better.
Question, is there a way to pass ansible “tags” to job template.
I use the job templates as playbooks.
example:
- hosts: all
gather_facts: true
roles:
- {role: elasticsearch, tags: elasticsearch }
I wan’t to call the “elasticsearch” tag
or a “tag” inside the role
Thanks again
