- Add new entry (Ansible module in Python).

content/ansible-python.rst

+Using Ansible as a Python module
+================================
+
+:date: 2015-01-01
+:summary: Using Ansible as a Python module when playbooks are not enough.
+
+At my current employer we have several servers in production with various
+providers, some of them with multiple ip addresses. When configuring the
+firewall to allow traffic from other servers I reached for Ansible. The
+obvious solution was to use a nested loop, something like this: ::
+
+    - name: Allow other servers
+      ufw: rule=allow from_ip={{ item[1] }}
+      with_nested:
+        - all_hosts
+        - {{ item.ansible_all_ipv4_addresses }}
+
+However, this syntax is invalid (and other variations I tried). Using 'include'
+with 'with_items' is deprecated and I didn't manage to get it to work with
+registering variables as well. What I had left was programaticaly generating
+a playbook, but investigating further I found that Ansible can be imported as
+a Python module.
+
+Incorperating Ansible in Python
+-------------------------------
+
+To retrieve all of the ip addresses I'd ran the setup module to gather the
+information ::
+
+    from ansible.runner import Runner
+    struct = Runner (module_name='setup', pattern='all_hosts').run()
+
+Now we have a complex data structure that is the output of Ansible's fact
+gathering module. Running it in the interpeter and examining the structure is
+not hard at all and that is how I managed to write the following code to extract
+a list of all of our server's ip addresses. ::
+
+    ipaddresses = []
+    for host in struct['contacted']:
+        for ip in struct['contacted'][host]['ansible_facts']['ansible_all_ipv4_addresses']:
+            ipaddresses.append (ip)
+
+Putting that information to good use
+------------------------------------
+            
+Now that we have a list of the ip addresses, we can start running Ansible
+commands right from with Python (just like we did) or build a playbook by
+outputing a YAML file. I chose the latter. ::
+
+    from yaml import safe_dump
+    doc = {'all_ipv4': ipaddresses}
+    print (safe_dump (doc), file='vars.yml')
+
+This will create a vars.yml file with the all_ipv4 variable already defined
+there to be imported to any playbook and run. For example: ::
+
+    ---
+    - hosts: all_hosts
+      vars_files:
+        - vars.yml
+      tasks:
+        - name: Allow other servers
+          ufw: rule=allow from_ip={{ item }}
+          with_items: all_ipv4
+
+With this much little code we were able to query all of our hosts, extract the
+needed information and output it back to Ansible for further use. I see this as
+a product of the good decisions the Ansible developers choose early on (YAML,
+Python, SSH). As always, for any feedback you may have, `email me <mailto:
+nimrod@shore.co.il>`_.