【Python】PythonからAnsibleを実行する方法

Copy
|-- app
|   |-- main.py
|   `-- main_readfile.py
|-- docker
|   |-- CTnodeDockerfile
|   |-- TRnodeDockerfile
|   `-- requirements.txt
|-- docker-compose.yml
|-- inventory
|   `-- hosts.yml
`-- project
    `-- playbook.yml

Copy
# pythonイメージを取得
FROM python:3.10.6

# pipのインストールとアップデート
RUN python -m pip install --upgrade pip

# 編集用にvimをインストール
RUN apt-get update
RUN apt-get -y install vim

# sshのポートを20022に変更する
RUN sed -ri 's/^#   Port 22/    Port 20022/' /etc/ssh/ssh_config

# 作業ディレクトリworkspaceへ移動
WORKDIR /workspace

# 作業ディレクトリworkspaceへrequirements.txtをコピー
COPY requirements.txt /workspace/

# ライブラリのインストール
RUN pip install -r requirements.txt

# python実行時、パスワード認証をするため
RUN apt-get install sshpass

# ansible.cfgを作成
RUN mkdir /etc/ansible
RUN touch /etc/ansible/ansible.cfg

# ansible.cfgに追記
# ansible実行時、OpenSSHのチェック機能による警告させないようにする
RUN echo [ssh_connection] >> /etc/ansible/ansible.cfg \
&& echo ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o \
StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null >> /etc/ansible/ansible.cfg

# ホスト名
ENV HOSTNAME controllnode

Copy
ansible
ansible-base

Copy
Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this.  
Please add this host's fingerprint to your known_hosts file to manage this host.",

Copy
FROM rockylinux/rockylinux

# Pythonインストール
RUN dnf install -y python39

# systemctlを使える様にする
RUN dnf -y update \
 && dnf install -y openssh-server \
    openssh-clients \
 && dnf clean all

# パスワードを使用したログインを許可
# ポートを22から20022に変更
# rootのパスワードをpasswordに設定
RUN sed -ri 's/^#PasswordAuthentication yes/PasswordAuthentication yes/' /etc/ssh/sshd_config \
&& sed -ri 's/^#Port 22/Port 20022/' /etc/ssh/sshd_config \
&& echo 'root:password' | chpasswd

EXPOSE 20022

# ホスト名
ENV HOSTNAME targetnode

Copy
version: "3"

# コンテナ
services:
  # 制御ノード
  controllnode:
    container_name: controllnode
    build:
      context: ./docker #Dockerfileへのpath
      dockerfile: CTnodeDockerfile
    tty: true
    volumes:
      - workspace:/workspace
    ports:
      - "1000:8888"
    networks:
      node_network:
        ipv4_address: 172.25.0.2

  # 管理対象ノード
  targetnode:
    container_name: targetnode
    # image: rockylinux/rockylinux
    build:
      context: ./docker #Dockerfileへのpath
      dockerfile: TRnodeDockerfile
    restart: always
    tty: true
    privileged: true
    command: /sbin/init
    ports:
      - 20022:20022
    networks:
      node_network:
        ipv4_address: 172.25.0.3

# ネットワーク
networks:
  node_network:
    ipam:
      driver: default
      config:
        - subnet: 172.25.0.0/24

# ボリューム
volumes:
  workspace:

Copy
---
all:
  hosts:
    target:
      ansible_host: 172.25.0.3
      ansible_user: root
      ansible_password: password

Copy
from __future__ import (absolute_import, division, print_function)
__metaclass__ = type

import json
import shutil

import ansible.constants as C
from ansible.executor.task_queue_manager import TaskQueueManager
from ansible.module_utils.common.collections import ImmutableDict
from ansible.inventory.manager import InventoryManager
from ansible.parsing.dataloader import DataLoader
from ansible.playbook.play import Play
from ansible.plugins.callback import CallbackBase
from ansible.vars.manager import VariableManager
from ansible import context

# Create a callback plugin so we can capture the output
class ResultsCollectorJSONCallback(CallbackBase):
    """A sample callback plugin used for performing an action as results come in.

    If you want to collect all results into a single object for processing at
    the end of the execution, look into utilizing the ``json`` callback plugin
    or writing your own custom callback plugin.
    """

    def __init__(self, *args, **kwargs):
        super(ResultsCollectorJSONCallback, self).__init__(*args, **kwargs)
        self.host_ok = {}
        self.host_unreachable = {}
        self.host_failed = {}

    def v2_runner_on_unreachable(self, result):
        host = result._host
        self.host_unreachable[host.get_name()] = result

    def v2_runner_on_ok(self, result, *args, **kwargs):
        """Print a json representation of the result.

        Also, store the result in an instance attribute for retrieval later
        """
        # host = result._host
        # self.host_ok[host.get_name()] = result
        # print(json.dumps({host.name: result._result}, indent=4))
        host = result._host
        self.host_ok[host.get_name()] = result

    def v2_runner_on_failed(self, result, *args, **kwargs):
        host = result._host
        self.host_failed[host.get_name()] = result
def main():
    # host_list = ['root@172.25.0.2']
    host_list = ['./inventory/hosts.yml']
    # since the API is constructed for CLI it expects certain options to always be set in the context object
    context.CLIARGS = ImmutableDict(connection='smart', module_path=['/to/mymodules', '/usr/share/ansible'], forks=10, become=None,
                                    become_method=None, become_user=None, check=False, diff=False, verbosity=0)
    # required for
    # https://github.com/ansible/ansible/blob/devel/lib/ansible/inventory/manager.py#L204
    sources = ','.join(host_list)
    # if len(host_list) == 1:
    #     sources += ','

    # initialize needed objects
    loader = DataLoader()  # Takes care of finding and reading yaml, json and ini files
    passwords = dict(vault_pass='password')

    # Instantiate our ResultsCollectorJSONCallback for handling results as they come in. Ansible expects this to be one of its main display outlets
    results_callback = ResultsCollectorJSONCallback()

    # create inventory, use path to host config file as source or hosts in a comma separated string
    inventory = InventoryManager(loader=loader, sources=sources)

    # variable manager takes care of merging all the different sources to give you a unified view of variables available in each context
    variable_manager = VariableManager(loader=loader, inventory=inventory)

    # instantiate task queue manager, which takes care of forking and setting up all objects to iterate over host list and tasks
    # IMPORTANT: This also adds library dirs paths to the module loader
    # IMPORTANT: and so it must be initialized before calling `Play.load()`.
    tqm = TaskQueueManager(
        inventory=inventory,
        variable_manager=variable_manager,
        loader=loader,
        passwords=passwords,
        stdout_callback=results_callback,  # Use our custom callback instead of the ``default`` callback plugin, which prints to stdout
    )

    # create data structure that represents our play, including tasks, this is basically what our YAML loader does internally.
    play_source = dict(
        name="Ansible Play",
        # hosts=host_list,
        hosts=['target'],
        # gather_facts='yes',
        tasks=[
            # dict(action=dict(module='shell', args='ls -l /'), register='shell_out')
            dict(action=dict(module='file', args=dict(path='/tmp/hoge', state='touch')))
            # dict(action=dict(module='shell', args='ls'), register='shell_out'),
            # dict(action=dict(module='debug', args=dict(msg='{{shell_out.stdout}}'))),
            # dict(action=dict(module='command', args=dict(cmd='/usr/bin/uptime'))),
        ]
    )

    # Create play object, playbook objects use .load instead of init or new methods,
    # this will also automatically create the task objects from the info provided in play_source
    play = Play().load(play_source, variable_manager=variable_manager, loader=loader)

    # Actually run it
    try:
        result = tqm.run(play)  # most interesting data for a play is actually sent to the callback's methods
    finally:
        # we always need to cleanup child procs and the structures we use to communicate with them
        tqm.cleanup()
        if loader:
            loader.cleanup_all_tmp_files()

    # Remove ansible tmpdir
    shutil.rmtree(C.DEFAULT_LOCAL_TMP, True)

    print("UP ***********")
    for host, result in results_callback.host_ok.items():
        # print('{0} >>> {1}'.format(host, result._result['stdout']))
        print(host)
        print(json.dumps(result._result, indent=4))

    print("FAILED *******")
    for host, result in results_callback.host_failed.items():
        print('{0} >>> {1}'.format(host, result._result['msg']))

    print("DOWN *********")
    for host, result in results_callback.host_unreachable.items():
        print('{0} >>> {1}'.format(host, result._result['msg']))

if __name__ == '__main__':
    main()

Copy
play_source = dict(
        name="Ansible Play",
        # hosts=host_list,
        hosts=['target'],
        gather_facts='yes',
        tasks=[
            # dict(action=dict(module='shell', args='ls -l /'), register='shell_out')
            dict(action=dict(module='file', args=dict(path='/tmp/hoge', state='touch')))
            # dict(action=dict(module='shell', args='ls'), register='shell_out'),
            # dict(action=dict(module='debug', args=dict(msg='{{shell_out.stdout}}'))),
            # dict(action=dict(module='command', args=dict(cmd='/usr/bin/uptime'))),
        ]
    )

Copy
$ docker ps
CONTAINER ID   IMAGE                            COMMAND                   CREATED             STATUS             PORTS                      NAMES
53c1c32650b0   ansible_pythonapi-targetnode     "/sbin/init"              About an hour ago   Up About an hour   0.0.0.0:20022->20022/tcp   targetnode
aa8d69cc13d0   ansible_pythonapi-controllnode   "/bin/sh -c 'echo Co…"   About an hour ago   Up About an hour   0.0.0.0:1000->8888/tcp     controllnode

Copy
$ docker exec -it targetnode bash
[root@53c1c32650b0 /]#
[root@53c1c32650b0 /]# cd /tmp
[root@53c1c32650b0 tmp]# ls
ks-script-7srd58lj  ks-script-lcrwq6wj
[root@53c1c32650b0 tmp]#

Copy
root@aa8d69cc13d0:/workspaces/ansible_pythonAPI# ssh root@172.25.0.3
The authenticity of host '[172.25.0.3]:20022 ([172.25.0.3]:20022)' can't be established.
ECDSA key fingerprint is SHA256:GWHoVbMXTeE3hDPJFCc9mPnNAXNDAreqGq41Cak8n+k.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[172.25.0.3]:20022' (ECDSA) to the list of known hosts.
root@172.25.0.3's password: 
Last login: Wed Aug 30 18:37:48 2023 from 172.25.0.2
[root@53c1c32650b0 ~]#

Copy
[root@53c1c32650b0 ~]# cd /tmp/hoge
-bash: cd: /tmp/hoge: No such file or directory
[root@53c1c32650b0 ~]#

Copy
root@aa8d69cc13d0:/workspaces/ansible_pythonAPI# /usr/local/bin/python /workspaces/ansible_pythonAPI/app/main.py
UP ***********
target
{
    "dest": "/tmp/hoge",
    "changed": true,
    "diff": {
        "before": {
            "path": "/tmp/hoge",
            "state": "absent",
            "mtime": 1693422597.9600735,
            "atime": 1693422597.9600735
        },
        "after": {
            "path": "/tmp/hoge",
            "state": "touch",
            "mtime": 1693422597.9705737,
            "atime": 1693422597.9705737
        }
    },
    "uid": 0,
    "gid": 0,
    "owner": "root",
    "group": "root",
    "mode": "0644",
    "state": "file",
    "size": 0,
    "invocation": {
        "module_args": {
            "path": "/tmp/hoge",
            "state": "touch",
            "recurse": false,
            "force": false,
            "follow": true,
            "modification_time_format": "%Y%m%d%H%M.%S",
            "access_time_format": "%Y%m%d%H%M.%S",
            "unsafe_writes": false,
            "_original_basename": null,
            "_diff_peek": null,
            "src": null,
            "modification_time": null,
            "access_time": null,
            "mode": null,
            "owner": null,
            "group": null,
            "seuser": null,
            "serole": null,
            "selevel": null,
            "setype": null,
            "attributes": null
        }
    },
    "_ansible_no_log": false
}

Copy
$ docker exec -it targetnode bash
[root@53c1c32650b0 /]# cd /tmp
[root@53c1c32650b0 tmp]# ls
hoge  ks-script-7srd58lj  ks-script-lcrwq6wj

Copy
---
- hosts: all
  gather_facts: no
  tasks:
  - name: test
    yum: name=httpd state=latest

Copy
import os
import sys
from collections import namedtuple
import json

from ansible.parsing.dataloader import DataLoader
from ansible.vars.manager import VariableManager
from ansible.inventory.manager import InventoryManager
from ansible.executor.playbook_executor import PlaybookExecutor
from ansible.module_utils.common.collections import ImmutableDict
from ansible import context
from ansible.plugins.callback import CallbackBase

class ResultCallback(CallbackBase):

    def __init__(self, *args, **kwargs):
        super(ResultCallback, self).__init__(*args, **kwargs)
        self.host_ok = {}
        self.host_unreachable = {}
        self.host_failed = {}

    def v2_runner_on_unreachable(self, result):
        super(ResultCallback, self).v2_runner_on_unreachable(result)
        print(json.dumps({result._host.name: result._result}, indent=4))

    def v2_runner_on_ok(self, result, **kwargs):
        super(ResultCallback, self).v2_runner_on_ok(result)
        print(json.dumps({result._host.name: result._result}, indent=4))

    def v2_runner_on_failed(self, result, *args, **kwargs):
        super(ResultCallback, self).v2_runner_on_failed(result)
        print(json.dumps({result._host.name: result._result}, indent=4))

def main():
    loader = DataLoader()
    inventory = InventoryManager(loader=loader, sources='./inventory/hosts.yml')
    variable_manager = VariableManager(loader=loader, inventory=inventory)
    playbook_path = './project/playbook.yml'

    if not os.path.exists(playbook_path):
        print('[INFO] The playbook does not exist')
        sys.exit()

    passwords = {}

    context.CLIARGS = ImmutableDict(connection='smart', module_path=['/to/mymodules', '/usr/share/ansible'], forks=10, become=None,
                                    become_method=None, become_user=None, check=False, diff=False, verbosity=0,syntax=False,
                                    start_at_task=None)

    executor = PlaybookExecutor(
        playbooks=[playbook_path],
        inventory=inventory,
        variable_manager=variable_manager,
        loader=loader,
        # options=options,
        passwords=passwords
    )
    results_callback = ResultCallback()
    executor._tqm._stdout_callback = results_callback
    results = executor.run()

if __name__ == '__main__':
    main()

Copy
$ docker exec -it targetnode bash
[root@368db8ee502a /]# systemctl status httpd
Unit httpd.service could not be found.
[root@368db8ee502a /]#

Copy
root@baadc5f2b5b6:/workspaces/ansible_pythonAPI# /usr/local/bin/python /workspaces/ansible_pythonAPI/app/main_readfile.py
{
    "target": {
        "ansible_facts": {
            "discovered_interpreter_python": "/usr/libexec/platform-python"
        },
        "msg": "",
        "changed": true,
        "results": [
            "Installed: apr-util-1.6.1-6.el8_8.1.x86_64",
            "Installed: mailcap-2.1.48-3.el8.noarch",
            "Installed: apr-util-bdb-1.6.1-6.el8_8.1.x86_64",
            "Installed: brotli-1.0.6-3.el8.x86_64",
            "Installed: apr-util-openssl-1.6.1-6.el8_8.1.x86_64",
            "Installed: httpd-2.4.37-56.module+el8.8.0+1284+07ef499e.6.x86_64",
            "Installed: mod_http2-1.15.7-8.module+el8.8.0+1284+07ef499e.3.x86_64",
            "Installed: httpd-filesystem-2.4.37-56.module+el8.8.0+1284+07ef499e.6.noarch",
            "Installed: httpd-tools-2.4.37-56.module+el8.8.0+1284+07ef499e.6.x86_64",
            "Installed: rocky-logos-httpd-86.3-1.el8.noarch",
            "Installed: apr-1.6.3-12.el8.x86_64"
        ],
        "rc": 0,
        "invocation": {
            "module_args": {
                "name": [
                    "httpd"
                ],
                "state": "latest",
                "allow_downgrade": false,
                "autoremove": false,
                "bugfix": false,
                "disable_gpg_check": false,
                "disable_plugin": [],
                "disablerepo": [],
                "download_only": false,
                "enable_plugin": [],
                "enablerepo": [],
                "exclude": [],
                "installroot": "/",
                "install_repoquery": true,
                "install_weak_deps": true,
                "security": false,
                "skip_broken": false,
                "update_cache": false,
                "update_only": false,
                "validate_certs": true,
                "lock_timeout": 30,
                "allowerasing": false,
                "conf_file": null,
                "disable_excludes": null,
                "download_dir": null,
                "list": null,
                "releasever": null
            }
        },
        "_ansible_no_log": false
    }
}

Copy
$ docker exec -it targetnode bash
[root@368db8ee502a /]# systemctl status httpd
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled)
   Active: inactive (dead)
     Docs: man:httpd.service(8)