This bug has been migrated to another issue tracking site. It has been closed here and may no longer be being monitored.

If you would like to get updates for this issue, or to participate in it, you may do so at Red Hat Issue Tracker .
Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2282275 - Running Ansible Remote Execution Jobs Against Multiple Hosts, the Host Parameter from First Host is Being Used to Render Job Template For All Hosts
Summary: Running Ansible Remote Execution Jobs Against Multiple Hosts, the Host Parame...
Keywords:
Status: CLOSED MIGRATED
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Ansible - Remote Execution
Version: 6.15.0
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: Unspecified
Assignee: Zuzana Lena Ansorgova
QA Contact: Satellite QE Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-05-22 00:16 UTC by myoder
Modified: 2024-06-06 17:40 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2024-06-06 17:40:00 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker   SAT-25285 0 None Migrated None 2024-06-06 17:39:58 UTC

Description myoder 2024-05-22 00:16:31 UTC
Description of problem:

When running Ansible Remote Execution Tasks against multiple hosts, the host parameter from the first host of the batch of hosts is being used to render the job template for all hosts.  The Job Task output shows the correct host parameter for all hosts, however, the job template renders based on the first host, which can cause issues for other hosts that have a different host parameter.

In the job template, there is erb logic to include an Ansible task to reboot hosts based on a host parameter "patching_reboot".  When this value is set to 'y' the job template should render an additional task to reboot the server.  When this value is set to 'n', the job template should not render the additional task.

Further, when previewing the job template for specific hosts, it renders correctly for every host.  It is only when jobs are scheduled for a batch of hosts does the template render incorrectly.

A very simple job template can be used to demonstrate (this is just runs the echo command for demo purposes):

~~~
<%
patching_reboot = host_param('patching_reboot')
-%>
---
- name: A playbook to test host parameter
  hosts: all
  gather_facts: true
  tasks:
<% if patching_reboot == "y" -%>
    - name: My Script
      ansible.builtin.script:
        cmd: /usr/bin/echo "rebooting"
<% end -%>
~~~

If the "patching_reboot" host parameter is 'n', the task "My Script" should not get rendered in the playbook to be executed.  If the host parameter is 'y' the task 'My Script' should get rendered in the playbook to be executed.

In the following example when the first host parameter is 'y', all the other hosts get this task executed, even when the parameter is 'n':

~~~
 host-1: patching_reboot='y'
 host-2: patching_reboot='n'
 host-3: patching_reboot='n'
~~~

In the converse situation, when the first host is 'n', all the other hosts won't get this task executed, even when they are set to 'y':

~~~
 host-1: patching_reboot='n'
 host-2: patching_reboot='y'
 host-3: patching_reboot='y'
~~~

Version-Release number of selected component (if applicable):
Red Hat Satellite 6.15

How reproducible:
always

Steps to Reproduce:
1. create a job template to add an Ansible Task if a host parameter equals a certain value
2. set the host parameter to different values for multiple hosts
3. execute the custom job template on multiple hosts (with different values for the host_parameter)

Actual results:
The job template will render according to the very first host's host parameter

Expected results:
The job template should render for each host according to their host parameter.

Additional info:
Executing the custom job template on individual hosts renders correctly.  Also, the preview for each host in the job template page renders correctly.  It is only when executing the tasks in batch does the rendering differ (if a host parameter is different from the first host's host parameter in the batch of hosts)

Comment 2 Adam Ruzicka 2024-05-23 15:34:59 UTC
Host parameters are available as variables when the playbook runs so instead of rendering the template differently for different hosts, it is preferred to have the template render to the same playbook for all hosts and let ansible do different things with it.

---
- name: A playbook to test host parameter
  hosts: all
  gather_facts: true
  tasks:
    - name: My Script
      ansible.builtin.script:
        cmd: /usr/bin/echo "rebooting"
      when: patching_reboot

This issue exists and is known. It is an outcome of trying to fit a 1:n tool (ansible) to an already existing 1:1 model (non-ansible remote execution). There used to be a time where we spawned a separate ansible-playbook instance for every single host in the job and switching to running a single ansible-playbook instance per batch introduce this issue, but the original way didn't scale. I know this is unfortunate if you're used to using non-ansible based remote execution in Satellite, but thinking about ansible from satellite as "just ansible" rather than something else helps a bit.

> The job template will render according to the very first host's host parameter

Under the hood the job template gets rendered separately for each host, but then all the rendered variants are ignored except for the first one. As far as I know Ansible itself does not allow running multiple playbooks against multiple hosts with a single ansible-playbook invocation so there's that.

We could try comparing the rendered playbooks, grouping them and then spawning a separate instance of ansible for each distinct playbook, instead of spawning a single one for the entire batch, but so far we didn't have the need for it and this particular BZ doesn't sound like anything that would change our stance towards that. I'd suggest embracing ansible and leaning into ansible-native ways of doing conditionals, which will always behave better. Once we find a use case which cannot be expressed natively in ansible then we may revisit this, but until that happens I don't really see us investing time into this.

However, the issue is there, there's no denying that, but we could at least document the recommended way of doing things to prevent people from running into this, especially if we consider the ansible-native way to be superior in probably all regards.

Comment 4 Zuzana Lena Ansorgova 2024-06-05 15:56:12 UTC
https://github.com/theforeman/foreman-documentation/pull/3065

Comment 5 Eric Helms 2024-06-06 17:40:00 UTC
This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there.

Due to differences in account names between systems, some fields were not replicated.  Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information.

To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "SAT-" followed by an integer.  You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like:

"Bugzilla Bug" = 1234567

In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information.


Note You need to log in before you can comment on or make changes to this bug.