Gabriel Radureau
934b62d922
Moves the local ansible runtime from a global `uv tool install ansible-core`
(which required remembering `--with kubernetes --with jmespath --with dnspython`)
to a project-managed venv described by `pyproject.toml` + `uv.lock`. Fixes the
"Failed to import the required Python library (kubernetes)" error on localhost.
The localhost inventory entry now derives `ansible_python_interpreter` from
`{{ ansible_playbook_python }}`, so `uv run ansible-playbook` is enough — no
more hardcoded user-specific paths.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
103 lines
4.0 KiB
Markdown
103 lines
4.0 KiB
Markdown
# Use Ansible
|
|
|
|
## Run locally (uv)
|
|
|
|
A project-local venv is defined in `pyproject.toml` at the repo root (ansible-core + the `kubernetes`, `jmespath`, `dnspython` libraries that `kubernetes.core` and friends need at runtime).
|
|
|
|
```sh
|
|
uv sync # creates .venv/ and installs ansible-core + python deps
|
|
uv run ansible-galaxy collection install -r ansible/requirements.yml
|
|
uv run ansible-playbook -i ansible/arcodange/factory/inventory ansible/arcodange/factory/playbooks/<playbook>.yml
|
|
```
|
|
|
|
The localhost entry in the inventory uses `ansible_python_interpreter: "{{ ansible_playbook_python }}"`, so `uv run` is enough — Ansible picks up the venv's Python automatically without any hardcoded path.
|
|
|
|
## Run with docker ssh agent side proxy
|
|
|
|
### build docker images
|
|
|
|
```sh
|
|
git clone -q --depth 1 --branch master https://github.com/arcodange/ssh-agent.git /tmp/ssh-agent
|
|
(cd /tmp/ssh-agent ; docker build -t docker-ssh-agent:latest -f Dockerfile . ; rm -rf /tmp/ssh-agent)
|
|
(cd ansible; docker build -t arcodange-ansible:0.0.0 .)
|
|
```
|
|
|
|
### run in container
|
|
|
|
```sh
|
|
# git clone -q --depth 1 --branch master https://github.com/arcodange/ssh-agent.git /tmp/ssh-agent
|
|
# (cd /tmp/ssh-agent ; docker build -t docker-ssh-agent:latest -f Dockerfile . ; rm -rf /tmp/ssh-agent)
|
|
# (cd ansible; docker build -t arcodange-ansible:0.0.0 .)
|
|
docker run -d --name=ssh-agent docker-ssh-agent:latest
|
|
docker run --rm --volumes-from=ssh-agent -v ~/.ssh:/.ssh -it docker-ssh-agent:latest ssh-add /root/.ssh/id_rsa
|
|
docker run --rm -u root --name test --volumes-from=ssh-agent -v $PWD:/home/arcodange/code \
|
|
-v "$HOME"/.kube/config:/home/arcodange/.kube/config \
|
|
-e ANSIBLE_VAULT_PASSWORD_FILE=$ANSIBLE_VAULT_PASSWORD_FILE -v $ANSIBLE_VAULT_PASSWORD_FILE:$ANSIBLE_VAULT_PASSWORD_FILE \
|
|
arcodange-ansible:0.0.0 \
|
|
ansible-playbook ansible/arcodange/factory/playbooks/03_cicd.yml -i ansible/arcodange/factory/inventory -vv
|
|
```
|
|
|
|
### use vault with single password
|
|
|
|
> [!IMPORTANT]
|
|
> Required for gitea mailer
|
|
> ```sh
|
|
> kubectl create secret generic arcodange-ansible-vault --from-literal="pass=<ansible_vault_password>" -n kube-system`
|
|
> ```
|
|
> to be set as a file variable for gitea runners
|
|
|
|
```sh
|
|
ANSIBLE_VAULT_PASSWORD_FILE=~/.local/bin/read-vault-key.sh;
|
|
mkdir -p `dirname $ANSIBLE_VAULT_PASSWORD_FILE`; set +o histexpand;
|
|
echo -e "#!/bin/bash\nkubectl get secret -n kube-system arcodange-ansible-vault --template='{{index .data.pass | base64decode}}'" > $ANSIBLE_VAULT_PASSWORD_FILE;
|
|
set -o histexpand; chmod +x $ANSIBLE_VAULT_PASSWORD_FILE; echo "export ANSIBLE_VAULT_PASSWORD_FILE=$ANSIBLE_VAULT_PASSWORD_FILE" >> `find ~ -maxdepth 1 -type f -name '\.*profile' -or -name '\.bashrc' -or -name '\.zshenv' | head -n1`
|
|
export ANSIBLE_VAULT_PASSWORD_FILE
|
|
```
|
|
|
|
### a tool to reuse a ssh agent (not required)
|
|
|
|
```sh
|
|
FIND_SSH_AGENT=$HOME/.local/bin/ssh-find-agent
|
|
curl -s https://raw.githubusercontent.com/wwalker/ssh-find-agent/master/ssh-find-agent.sh > $FIND_SSH_AGENT
|
|
chmod +x $FIND_SSH_AGENT
|
|
echo 'ssh_find_agent "$@"' >> $FIND_SSH_AGENT
|
|
which brew && brew install coreutils # if on macos
|
|
```
|
|
|
|
```sh
|
|
eval "$(ssh-agent -s)"
|
|
ssh-add ~/.ssh/id_rsa
|
|
```
|
|
|
|
## dev
|
|
|
|
### test an expression
|
|
|
|
```sh
|
|
ansible -i ,localhost -c local localhost -m raw -a "echo hello world {{ inventory_hostname }} : {{ hostvars | to_nice_json | regex_replace(\"['\n]\",' ') }}"
|
|
```
|
|
|
|
### local python environment with uv
|
|
|
|
#### Install UV (one-time)
|
|
|
|
```sh
|
|
python3 -m pip install uv
|
|
python3 -m uv python install 3.12
|
|
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshenv
|
|
```
|
|
|
|
#### Bootstrap the project venv
|
|
|
|
```sh
|
|
uv sync # honors .python-version (3.12) and pyproject.toml
|
|
uv run ansible-galaxy collection install -r ansible/requirements.yml
|
|
# `--token <token>` is only needed if you hit galaxy.ansible.com rate limits
|
|
```
|
|
|
|
#### Run
|
|
|
|
```sh
|
|
uv run ansible-galaxy collection install ./ansible/arcodange/factory -f
|
|
uv run ansible-playbook -i ansible/arcodange/factory/inventory ansible/arcodange/factory/playbooks/02_setup.yml
|
|
``` |