Jan 01, 2015

Using Ansible as a Python module

At my current employer we have several servers in production with various providers, some of them with multiple IP addresses. When configuring the firewall to allow traffic from other servers I reached for Ansible. The obvious solution was to use a nested loop, something like this:

- name: Allow other servers
  ufw:
    rule: allow
    from_ip: '{{ item[1] }}'
  with_nested:
    - all_hosts
    - '{{ item.ansible_all_ipv4_addresses }}'

However, this syntax is invalid (and other variations I tried). Using include with with_items is deprecated and I didn't manage to get it to work with registering variables as well. What I had left was programmatically generating a playbook, but investigating further I found that Ansible can be imported as a Python module.

Incorporating Ansible in Python

To retrieve all of the ip addresses I'd ran the setup module to gather the information

from ansible.runner import Runner
struct = Runner (module_name='setup', pattern='all_hosts').run()

Now we have a complex data structure that is the output of Ansible's fact gathering module. Running it in the interpreter and examining the structure is not hard at all and that is how I managed to write the following code to extract a list of all of our server's ip addresses.

ipaddresses = []
for host in struct['contacted']:
    for ip in struct['contacted'][host]['ansible_facts']['ansible_all_ipv4_addresses']:
        ipaddresses.append (ip)

Putting that information to good use

Now that we have a list of the ip addresses, we can start running Ansible commands right from with Python (just like we did) or build a playbook by outputting a YAML file. I chose the latter.

from yaml import safe_dump
doc = {'all_ipv4': ipaddresses}
print (safe_dump (doc), file='vars.yml')

This will create a vars.yml file with the all_ipv4 variable already defined there to be imported to any playbook and run. For example:

---
- hosts: all_hosts
  vars_files:
    - vars.yml
  tasks:
    - name: Allow other servers
      with_items: all_ipv4
      ufw:
        rule: allow
        from_ip: '{{ item }}'

With this much little code we were able to query all of our hosts, extract the needed information and output it back to Ansible for further use. I see this as a product of the good decisions the Ansible developers choose early on (YAML, Python, SSH). As always, for any feedback you may have, email me.