# Updating roles on project update/install **URL:** \ **Category:** AWX Project\ **Tags:** awx, galaxy-ng\ **Created:** [September 19, 2017, 9:01pm UTC](https://forum.ansible.com/t/updating-roles-on-project-update-install/25533 "2017-09-19T21:01:47Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Mike\_Biancaniello](https://avatars.discourse-cdn.com/v4/letter/m/dec6dc/32.png) [@Mike\_Biancaniello](https://forum.ansible.com/u/Mike_Biancaniello)\ **Post date:** [September 19, 2017, 9:01pm UTC](https://forum.ansible.com/t/updating-roles-on-project-update-install/25533/1 "2017-09-19T21:01:47Z")
I am running AWX inside of some docker containers and can’t get the project\_update job to install roles from my requirements.yml file. It successfully finds the file, but, for some reason, scm\_full\_checkout is always set to false. I modified /usr/lib/python2.7/site-packages/awx/playbooks/project\_update.yml to add this: > - name: detect requirements.yml > stat: path={{project\_path|quote}}/roles/requirements.yml > register: doesRequirementsExist > > **+ - name: show me stat** > **+ debug:** > **+ msg: “{{ doesRequirementsExist }}”** > **+** > **+ - name: show me scm\_full\_checkout** > **+ debug:** > **+ msg: “{{ scm\_full\_checkout }}”** > > - name: fetch galaxy roles from requirements.yml > command: ansible-galaxy install -r requirements.yml -p {{project\_path|quote}}/roles/ --force > args: > chdir: “{{project\_path|quote}}/roles” > when: doesRequirementsExist.stat.exists and scm\_full\_checkout|bool Which results in the following displayed in the job output (I removed most of the file stats for brevity): > TASK [detect requirements.yml] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > > ok: [localhost] > > TASK [show me stat] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > > ok: [localhost] =\> { > > “msg”: { > > “changed”: false, > > “failed”: false, > > “stat”: { > > “executable”: false, > > **“exists”: true,** > > “mode”: “0644”, > > “readable”: true, > > “uid”: 0, > > “writeable”: true, > > } > > } > > } > > TASK [show me **scm\_full\_checkout**] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > > ok: [localhost] =\> { > > “msg”: **false** > > } > > TASK [fetch galaxy roles from requirements.yml] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > > **skipping: [localhost]** I’ve tried every option I can find for defining the project and in every case, scm\_full\_checkout is _always_ false! Any ideas how I can get this to work? thanks, -MikeB ---
**Author:** ![matburt](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matburt/32/3612_2.png) [@matburt](https://forum.ansible.com/u/matburt)\ **Post date:** [September 20, 2017, 12:52am UTC](https://forum.ansible.com/t/updating-roles-on-project-update-install/25533/2 "2017-09-20T00:52:02Z")
It’ll only sync the roles when a job is run using that project, until then it won’t sync the roles from the requirements file. ---
**Author:** ![Mike\_Biancaniello](https://avatars.discourse-cdn.com/v4/letter/m/dec6dc/32.png) [@Mike\_Biancaniello](https://forum.ansible.com/u/Mike_Biancaniello)\ **Post date:** [September 20, 2017, 2:05pm UTC](https://forum.ansible.com/t/updating-roles-on-project-update-install/25533/3 "2017-09-20T14:05:52Z")
I’m getting closer! So I was able to get this to at least try to install the roles when I run the job. However I am running into a few issues: 1. The roles aren’t installing with error: “SCM Update failed with ID 37”. I assume this is because the roles require creds. Unfortunately, the job template doesn’t allow for adding “Source Control” creds. I tried setting the “machine” creds to use my key, but that failed with “ID 39” (I didn’t actually expect this to work). 2. The output display is empty (even at highest verbosity). I assume this is because the output display is only going to show the output from the playbook that I specified for the job. ---
**Author:** ![Mike\_Biancaniello](https://avatars.discourse-cdn.com/v4/letter/m/dec6dc/32.png) [@Mike\_Biancaniello](https://forum.ansible.com/u/Mike_Biancaniello)\ **Post date:** [September 21, 2017, 7:07pm UTC](https://forum.ansible.com/t/updating-roles-on-project-update-install/25533/4 "2017-09-21T19:07:27Z")
Is there a way to assign creds to the job template to use when grabbing new roles from a requirements.yml? In this case, it can use the same creds that it used to get the project (same git repo). ---
**Author:** ![matburt](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matburt/32/3612_2.png) [@matburt](https://forum.ansible.com/u/matburt)\ **Post date:** [September 21, 2017, 8:31pm UTC](https://forum.ansible.com/t/updating-roles-on-project-update-install/25533/5 "2017-09-21T20:31:51Z")
We have thought about having JTs generated from projects but not currently. ---
**Author:** ![Chris\_Church](https://avatars.discourse-cdn.com/v4/letter/c/f475e1/32.png) [@Chris\_Church](https://forum.ansible.com/u/Chris_Church)\ **Post date:** [September 22, 2017, 1:54am UTC](https://forum.ansible.com/t/updating-roles-on-project-update-install/25533/6 "2017-09-22T01:54:09Z")
Note that there are two different modes for running project updates (job\_type == “check” vs. job\_type == “run”, which also show up as launch\_type == “dependency” vs. launch\_type == “sync”). The check/dependency job runs project\_update.yml in check mode and sets scm\_full\_checkout = false, whereas the run/sync mode sets scm\_full\_checkout = true. The default jobs list hides the sync updates: /#/jobs?job\_search=page\_size:20;order\_by:-finished;not\_\_launch\_type:sync If you modify that default filter in the URL, you should see both SCM updates that ran before your playbook run: /#/jobs?job\_search=page\_size:20;order\_by:-finished What Matt meant by “It’ll only sync the roles when a job is run using that project” is that the the requirements.yml will only be pulled down by the second run/sync SCM update prior to running your job template. The SCM credentials specified for your project (if SSH keys) should be available for use by galaxy when checking out roles, but if you’re using username/password instead, we won’t be able to inject that into the SCM URLs as we do for normal SCM updates ([https://github.com/ansible/awx/blob/devel/awx/main/tasks.py#L1346](https://github.com/ansible/awx/blob/devel/awx/main/tasks.py#L1346)). ---
**Author:** ![Mike\_Biancaniello](https://avatars.discourse-cdn.com/v4/letter/m/dec6dc/32.png) [@Mike\_Biancaniello](https://forum.ansible.com/u/Mike_Biancaniello)\ **Post date:** [September 22, 2017, 2:38am UTC](https://forum.ansible.com/t/updating-roles-on-project-update-install/25533/7 "2017-09-22T02:38:20Z")
Thanks for the tip about the filter! That helped me find the “SCM Update” task that had the actual error in it. Turns out, the urls in the requirements file were ssh host aliases and (obviously) those aliases aren’t configured in the container. I’ll give it another shot tomorrow. ---
**Author:** ![Mike\_Biancaniello](https://avatars.discourse-cdn.com/v4/letter/m/dec6dc/32.png) [@Mike\_Biancaniello](https://forum.ansible.com/u/Mike_Biancaniello)\ **Post date:** [September 22, 2017, 3:55am UTC](https://forum.ansible.com/t/updating-roles-on-project-update-install/25533/8 "2017-09-22T03:55:10Z")
Ok, so my issue turned out to be the username. - I am using SSH-key creds with git scm. - I also have to send a username (because awx in the container runs as root and user:root isn’t a valid git user). - I specify this username (no password, just the key) in the project definition. - Task: “update project using git and accept hostkey” works fine (meaning it sends ssh://username@git.url), presumably because it builds the URL. - Task: “fetch galaxy roles from requirements.yml” just runs galaxy as `-r requirements`, so uses the URL from the file, which doesn’t contain a username. hence, failure. I don’t see a good AWX or galaxy way around this, though. And, if I put the username in the URL in the requirements file, then nobody else can use that file to install the requirements on their own machine (for dev/testing/etc) without modifying the file to either remove the username or use their own. I also tested this when in check mode and it also tried (and failed) to install the requirements. (fwiw, updating the requirements when in check mode is good. Otherwise, every playbook in the project that “requires” a role in the “requirements” file would fail) anyway, I got everything installed, but then the playbooks can’t find the roles! My tree: [root@awx projects]# tree -L 4 . └── \_6\_\_my\_projectmikeb\_test ├── ansible.cfg ├── inventory\_scripts │ └── cmdb\_inventory.py ├── playbooks │ └── test │ ├── helloworld.yml │ └── network\_config.yml ├── requirements.txt └── roles ├── my.libs ├── my.tasks └── requirements.yml So … I had to modify my project’s ansible.cfg to set roles\_path=roles/ (relative path). Which leaves me with 2 modifications to my project’s repo to work within AWX, but not anywhere else. I may just stick with mounting a volume into awx\_task:/etc/ansible/roles/ and installing the roles on the host. I’ll have to sleep on it.