Template paths

Archives Ansible Project
1

I tried asking the IRC channel but I didn’t get any responses so I figure that the mailing list might be better suited to this question. I’m trying to build an extensible iptables template. All of my hosts will need some amount of custom rules to be added so I feel that extending a template would be a great way to achieve this. My base template looks like this:

#roles/common/templates/iptables.j2

{% block nat %}
{% endblock nat %}
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT

SSH

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
{% block role_rules %}
{% endblock role_rules %}

Drop All

-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

So then I created a template for another host to add it’s role specific information in. This template looks like this:

{% extends “roles/common/templates/iptables.j2” %}
{% block role_rules %}
-A INPUT -m state --state NEW -m tcp -p tcp --dport 9000 -j ACCEPT
{% endblock role_rules %}

This was working until I moved my playbooks into a folder to organize them. Now I can’t seem to fix the path to make the template extends tag work. I even tried an absolute path.
Here’s my directory structure:

ansible/
ansible.cfg
hosts/
dev
qa
groupvars/
dev
qa
playbooks/
roles/
common.yml
roleA.yml
roleB.yml
roles/
common/
templates/
iptables.j2

tasks/
main.yml

roleA/
templates/
iptables.j2
tasks/
main.yml

I keep getting this error when I get to the play that templates the iptables file:
{‘msg’: ‘AnsibleError: file: /path/to/ansible/roles/vickyvale/templates/iptables.j2, error: Cannot find/not allowed to load (include) template /path/to/ansible/roles/common/templates/iptables.j2’, ‘failed’: True}

2

permissions issue?

3

For starters, what ansible version are you using?

4

I originally though it might be permissions, but both templates are 0664 with my account being owner.

I’m using ansible version 1.7.2

5

Is there somewhere that documents what paths are searched when inside a template or in include calls from within a template? I can’t find much information about this at all.

6

It looks for the file in the “base” directory or in the templates/ subdirectory. The “base” directory is the directory of the current play or role.

7

So is there no way to include from a folder other than the current role’s folder? Is there no way to share/extend templates between roles?

8

So is there no way of including or extending templates from other roles? It would seem that this is a really powerful feature of the templating language that would make many configurations more versatile and powerful. Is what I’m trying to do not possible with Ansible?

9

assuming all roles are in the same directory, you could do relative paths to other roles’ template directory.

10

I’ve tried that but I can’t seem to get it to work. Here are the paths I’ve tried so far:
common/templates/iptables.j2
…/common/templates/iptables.j2
…/…/common/templates/iptables.j2
…/…/…/common/templates/iptables.j2
/absolute/path/to/common/templates/iptables.j2

I get the same error message for all of them.

11

hmm, I’ve only tested this by invoking the templates through the modules (in that case …/…/common/templates/iptables.j2 should work).

I need to check env when calling template to see the base path (probably playbook relative) for doing the includes from inside the template engine.

12

After some more playing, I found that if I move my roles/ directory into the folder with the playbooks, things work like they used to work. However, if I move to roles/ directory anywhere higher in the hierarchy than the playbook, it seems that the path can not be resolved inside the template.

I have decided to again reorganize my code/configs so that I can put the roles/ directory parallel to all the playbooks. It’s slightly less ideal as the number of playbooks grow, but it maintains all needed functionality. If there’s a better suggestion, I would be all for it.

13

I’ve had the same problem. There is an issue for it:

https://github.com/ansible/ansible/issues/7106

and I have created a patch that will also use the roles directory as a base for the lookups:

https://github.com/ansible/ansible/pull/9933

However, there are 300+ pull requests sitting out there, I’m a bit bummed that it may not get any attention.

14

Everything is going to get attention, the question is simply what gets attention next :slight_smile:

It might help if people quit telling others how good Ansible is, and such.

Ultimately we do admit we are concentrating on things that affect the most folks first.

15

Michael,

I understand, success always brings with it a requirement to priorities.

My pull request is only five lines and I believe pretty benign. Anything I can do to make it more likely to get merged in?

*Randy Syring*
Chief Executive Developer
Direct: 502.276.0459
Office: 812.285.8766
Level 12 Technologies <https://www.level12.io/&gt;

(attachments)

email-sigs.png

16

This is in template.py which is going to be superceeded by the v2 tree, unfortunately.

We are unlikely to release this file again in it’s current state.

(attachments)

email-sigs.png

17

Can you point me to the comparable file in the v2 tree? If you think you would approve a similar logic change, I'll work on making it. Or, maybe this issue is already addressed in v2?

*Randy Syring*
Chief Executive Developer
Direct: 502.276.0459
Office: 812.285.8766
Level 12 Technologies <https://www.level12.io/&gt;

(attachments)

email-sigs.png

18

I’m very glad that someone else has run into the same issue. That makes me feel that my use isn’t totally off the wall.

This file looks to be the one you’ll need but it’s pretty empty at the moment. I don’t think that v2 is mature enough at the moment to accept any changes because most of it isn’t functional yet from the looks of the code.
https://github.com/ansible/ansible/blob/devel/v2/ansible/executor/template_engine.py

I would think that it would actually do a lot of good merging this change into the current tree whether or not it gets released. It can always be run from a git checkout if the feature is critical. When the template engine gets reworked for v2, these changes or considerations would be more visible to whoever makes the code change. Just my 2 cents, but I hope it helps.

19

v2 is not open for submissions just yet, plugins are in progress – we anticipate this should be ready in about a month or so for helping testing and development. There will be an analogous file in the action_plugins tree, called template.py, and be pretty similar, just a bit nicer.

The main parts are cleaning up the other pieces of code that it uses and touches it.