Search code examples
ansiblegitlab-ci-runner

gitlab-runner: "local" ansible role not found


The ansible docu says

If Ansible were to load ansible.cfg from a world-writable current working directory, it would create a serious security risk.

That makes sense but causes a problem in my ci-pipeline fir my project:

.
├── group_vars
├── host_vars
├── playbooks
├── resources
├── roles
|   ├── bootstrap
|   └── networking
├── ansible.cfg
├── inventory.yml
├── requirements.yml
├── site.yml
└── vault.yml

I have two "local" roles which are checked in under source control of the ansible project under ./roles, but the roles are not found when i run ansible-playbook --syntax-check site.yml

$ ansible-playbook --syntax-check site.yml
 [WARNING] Ansible is being run in a world writable directory (/builds/papanito/infrastructure), ignoring it as an ansible.cfg source. For more information see https://docs.ansible.com/ansible/devel/reference_appendices/config.html#cfg-in-world-writable-dir
 [WARNING]: provided hosts list is empty, only localhost is available. Note
that the implicit localhost does not match 'all'
ERROR! the role 'networking' was not found in /builds/papanito/infrastructure/playbooks/roles:/root/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:/builds/papanito/infrastructure/playbooks
The error appears to have been in '/builds/papanito/infrastructure/playbooks/networking.yml': line 14, column 7, but may
be elsewhere in the file depending on the exact syntax problem.
The offending line appears to be:
  roles:
    - { role: networking, become: true }
      ^ here
ERROR: Job failed: exit code 1
--------------------------------------------------------

Obviously cause roles are searched

A roles/ directory, relative to the playbook file.

Thus my ansible.cfg defined to look in ./roles

# additional paths to search for roles in, colon separated
roles_path    = ./roles

So based on the ansible docu I can use the environment variable ANSIBLE_CONFIG as I do as follows in the gitlab-ci.yml

variables:
  SITE: "site.yml"
  PLAYBOOKS: "playbooks/**/*.yml"
  ANSIBLE_CONIG: "./ansible.cfg"

stages:
  - verify

before_script:
   .....

ansible-verify:
  stage: verify
  script:
    - ansible-lint -v $SITE
    - ansible-lint -v $PLAYBOOKS
    - ansible-playbook --syntax-check $SITE
    - ansible-playbook --syntax-check $PLAYBOOKS

But I still get the error above. What do I miss?

site.yml

- import_playbook: playbooks/networking.yml
- import_playbook: playbooks/monitoring.yml

playbooks/networking.yml

- name: Setup default networking
  hosts: all

  roles:
    - { role: networking, become: true }
    - { role: oefenweb.fail2ban, become: true }

Solution

  • I know the topic is old, but you have a typo in your config file. You are missing an F in ANSIBLE_CONFIG, so write this instead

    variables:
      SITE: "site.yml"
      PLAYBOOKS: "playbooks/**/*.yml"
      ANSIBLE_CONFIG: "./ansible.cfg"
    

    BTW, it helped to solve my problem