First of all, I really appreciate any help you all can offer me! This is my first post here.
We have an ansible role that is executed in an AWX environment. This role authenticates with a secure internal endpoint that returns additional configuration data to be configured on the target hosts in the inventory. This data contains variables that need to be templated with variables in the inventory file. This part is not happening - note the {{ host_seq }} below:
TASK [bmc : Debug profiledata_validated_api_action] ****************************
task path: /tmp/awx_478711_5zqo0k99/requirements_roles/bmc/tasks/main.yaml:150
Thursday 26 September 2024 17:53:13 +0000 (0:00:00.051) 0:00:21.291 ****
ok: [ctv-mobile-strtus-m-91-01.vi.comcast.net] => (item=.links.Systems.href) => {
"msg": "AnsibleUnsafeText"
}
ok: [ctv-mobile-strtus-m-91-01.vi.comcast.net] => (item=.links.Member[] | select(.href | endswith("C{{ host_seq }}N1")) | .href) => {
"msg": "AnsibleUnsafeText"
}
ok: [ctv-mobile-strtus-m-91-01.vi.comcast.net] => (item={ "MACAddress": .HostCorrelation.HostMACAddress[0]}) => {
"msg": "AnsibleUnsafeText"
}
TASK [bmc : Debug profiledata_validated_api_action] ****************************
task path: /tmp/awx_478711_5zqo0k99/requirements_roles/bmc/tasks/main.yaml:155
Thursday 26 September 2024 17:53:13 +0000 (0:00:00.072) 0:00:21.364 ****
ok: [ctv-mobile-strtus-m-91-01.vi.comcast.net] => (item=.links.Systems.href) => {
"ansible_loop_var": "item",
"item": ".links.Systems.href"
}
ok: [ctv-mobile-strtus-m-91-01.vi.comcast.net] => (item=.links.Member[] | select(.href | endswith("C{{ host_seq }}N1")) | .href) => {
"ansible_loop_var": "item",
"item": ".links.Member[] | select(.href | endswith(\"C{{ host_seq }}N1\")) | .href"
}
ok: [ctv-mobile-strtus-m-91-01.vi.comcast.net] => (item={ "MACAddress": .HostCorrelation.HostMACAddress[0]}) => {
"ansible_loop_var": "item",
"item": "{ \"MACAddress\": .HostCorrelation.HostMACAddress[0]}"
}
From my reading this is by design since the data in the variable profiledata_validated_api_action was acquired via the uri module and since that is an external data source, ansible prevents Jinja2 templating by marking the data type as AnsibleUnsafeText.
I have read, among other things:
- AnsibleUnsafeText, use, and linting
- AnsibleUnsafeText as ansible_become_pass variable
- AnsibleUnsafe notes · mitogen-hq/mitogen Wiki · GitHub
- How to check settings
ChatGPT seemed to believe that I could use a | map('template') filter to force Jinja2 templating, but that doesn’t appear to exist in ansible-core 2.16. I cannot find any documentation regarding a template filter. I did find this, but it doesn’t fit my use case: ansible.builtin.template lookup – retrieve contents of file after templating with Jinja2 — Ansible Community Documentation
ChatGPT also believed that if I used | to_json | from_json it would cause the variable to be treated as standard JSON instead of a protected string, but that didn’t work either.
So I tried adding allow_jinja_in_extra_vars = always as ChatGPT seems to think this should be supported in ansible-core release 2.14+, but it doesn’t seem to be effective. Also it doesn’t seem to be a related configuration option based on the limited documentation I could find on the setting:
[root@CHQS-EniCEJ55G6 ansible]# export ANSIBLE_CONFIG=/root/ansible/ansible.cfg
[root@CHQS-EniCEJ55G6 ansible]# cat /root/ansible/ansible.cfg
[defaults]
allow_jinja_in_extra_vars = always
ALLOW_JINJA_IN_EXTRA_VARS = always
[root@CHQS-EniCEJ55G6 ansible]#
[root@CHQS-EniCEJ55G6 ansible]# ansible-config dump -t all --only-changed
ERROR: Error reading config file (/root/ansible/ansible.cfg): While reading from '<string>' [line 3]: option 'allow_jinja_in_extra_vars' in section 'defaults' already exists
[root@CHQS-EniCEJ55G6 ansible]# cat >ansible.cfg<<EOF
[defaults]
allow_jinja_in_extra_vars = always
EOF
[root@CHQS-EniCEJ55G6 ansible]# ansible-config dump -t all --only-changed
CONFIG_FILE() = /root/ansible/ansible.cfg
[root@CHQS-EniCEJ55G6 ansible]# ansible-config dump -t all | grep -i allow_jinja_in_extra_vars
[root@CHQS-EniCEJ55G6 ansible]#
I setup an example playbook (below) to demo the AnsibleUnsafeText problem with my attempt at using | to_json | from_json to trigger templating:
ansible-playbook -i localhost, -c local /dev/stdin <<EOF
---
- name: variable within variable expansion
hosts: all
become: false
gather_facts: false
vars:
host_seq: 1
jq_filters:
- ".links.Systems.href"
- !unsafe .links.Member[] | select(.href | endswith("C{{ host_seq }}N1")) | .href
- '{ "MACAddress": .HostCorrelation.HostMACAddress[0]}'
tasks:
- debug:
var: jq_filters
- debug:
msg: "{{ item | string | type_debug }}"
loop: "{{ jq_filters }}"
- set_fact:
jq_filters_new: "{{ jq_filters_new | default( [], true ) + [ item | to_json | from_json ] }}"
loop: "{{ jq_filters }}"
- name: debug jq_filters_new
debug:
var: jq_filters_new
- name: each item in jq_filters_new
debug:
msg: "{{ item | type_debug }}"
loop: "{{ jq_filters_new }}"
EOF
Details about my AWX worker node / ansible version:
bash-4.4# ansible-playbook --version
ansible-playbook [core 2.13.11]
config file = /etc/ansible/ansible.cfg
configured module search path = ['/etc/ansible/library']
ansible python module location = /usr/local/lib/python3.10/site-packages/ansible
ansible collection location = /usr/local/lib/python3.10/site-packages/ansible_collections
executable location = /usr/local/bin/ansible-playbook
python version = 3.10.12 (main, Jul 24 2023, 21:10:19) [GCC 8.5.0 20210514 (Red Hat 8.5.0-20)]
jinja version = 3.1.2
libyaml = True
bash-4.4# cat /etc/redhat-release
CentOS Stream release 8
bash-4.4# uname -r
4.18.0-513.18.1.el8_9.x86_64
bash-4.4# cat /etc/os-release
NAME="CentOS Stream"
VERSION="8"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="8"
PLATFORM_ID="platform:el8"
PRETTY_NAME="CentOS Stream 8"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:8"
HOME_URL="https://centos.org/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux 8"
REDHAT_SUPPORT_PRODUCT_VERSION="CentOS Stream"
bash-4.4#
Details about my test machine (WSL2 instance of Rocky 8.10):
[root@CHQS-EniCEJ55G6 ansible]# ansible-playbook --version
ansible-playbook [core 2.16.3]
config file = /root/ansible/ansible.cfg
configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python3.12/site-packages/ansible
ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
executable location = /usr/bin/ansible-playbook
python version = 3.12.3 (main, Jul 2 2024, 20:57:30) [GCC 8.5.0 20210514 (Red Hat 8.5.0-22)] (/usr/bin/python3.12)
jinja version = 3.1.2
libyaml = True
[root@CHQS-EniCEJ55G6 ansible]# cat /etc/redhat-release
Rocky Linux release 8.10 (Green Obsidian)
[root@CHQS-EniCEJ55G6 ansible]# uname -r
5.15.146.1-microsoft-standard-WSL2
[root@CHQS-EniCEJ55G6 ansible]# cat /etc/os-release
NAME="Rocky Linux"
VERSION="8.10 (Green Obsidian)"
ID="rocky"
ID_LIKE="rhel centos fedora"
VERSION_ID="8.10"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Rocky Linux 8.10 (Green Obsidian)"
ANSI_COLOR="0;32"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:rocky:rocky:8:GA"
HOME_URL="https://rockylinux.org/"
BUG_REPORT_URL="https://bugs.rockylinux.org/"
SUPPORT_END="2029-05-31"
ROCKY_SUPPORT_PRODUCT="Rocky-Linux-8"
ROCKY_SUPPORT_PRODUCT_VERSION="8.10"
REDHAT_SUPPORT_PRODUCT="Rocky Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="8.10"
[root@CHQS-EniCEJ55G6 ansible]#