Managing Enterprise Automation with Red Hat Ansible Automation Platform
Create and manage a job template that specifies a project and playbook, an execution environment from a private automation hub, an inventory, and credentials that you can use to launch Red Hat Ansible Automation Platform jobs on managed hosts.
In automation controller, a job template is a predefined collection of settings that you can use to launch jobs that run playbooks. Running a playbook from the command line requires a playbook, inventory, and authentication. Similarly, a job template associates a playbook from a project with an inventory of hosts, credentials for authentication, an automation execution environment, and other parameters used when you launch an Ansible job to run that playbook.
Whether a user can launch jobs or create job templates with particular projects and inventories depends on the roles that you have assigned them. When granted the Use role, users can use a job template to associate projects with inventories.
A job template defines the parameters for the execution of an Ansible job. An Ansible job executes a playbook against a set of managed hosts. Therefore, a job template must define which project provides the playbook and which inventory contains the list of managed hosts.
The job template can also specify an automation execution environment to use when running the playbook. For example, if you are using a playbook that worked with Ansible 2.9, you can specify a compatible automation execution environment to run the playbook.
Additionally, the job template must also define the machine credential to use to authenticate to the managed hosts. Like projects and inventories, users must have the Use role assigned to a machine credential before they can associate it with a job template.
After it has been defined, a job template allows for the repeated execution of a job and is therefore ideal for routine execution of tasks. Because the project, inventory, automation execution environment, and machine credential parameters are part of the job template definition, the job runs the same way each time.
Unlike other automation controller resources, job templates do not directly belong to an organization. Instead, they are used by a project that belongs to an organization. The relationship of a job template to an organization is determined by the project that it uses. Therefore, you do not need the Admin role in an organization to create a job template. Instead, you only need the Use role for the project that you assign to the job template.
Because a job template has to be defined with an inventory, project, automation execution environment, and machine credential, a user can only create a job template if they have Use roles assigned to one or more of each of these three automation controller resources.
The following procedure to create a job template focuses on mandatory parameters; optional parameters are discussed later:
Log in to the automation controller web UI as a user who has been assigned the
Userole for the inventory, project, and machine credential resources for the project that you are creating.Navigate to → and then click → to open the page.
Enter a name for the job template in the field.
In the list, choose .
Click the search icon for the field, select the required inventory, and then click .
Click the search icon for the field, select the desired project, and then click .
Click the drop-down menu for the field and select the desired playbook.
Click the search icon for the field, select the desired credential, and then click .
Scroll to the bottom of the page and click .
A job template has other settings you can use to adjust how automation controller runs the playbook when you launch the template:
Use this field to specify an optional description of the job template.
Use this field to specify an automation execution environment for the job template. Click the search icon and select the automation execution environment from the list. This field is available after you have selected a project for the job template. When you specify an automation execution environment, it overrides the one that is used when launching the job template. You can verify the automation execution environment used by the job template in its details page.
Labels are names that you can attach to job templates to help you group or filter job templates.
You can use this field to pass extra command-line variables to the playbook executed by a job. You define these extra variables as key-value pairs using either YAML or JSON.
Use this field to specify the
forkssetting that controls the number of parallel processes to allow during playbook execution. Set this to0to use the default setting from the Ansible configuration file.Use this field to restrict the list of managed hosts provided by the inventory that you defined for the job template.
This determines the level of detail generated in the output of the job run.
Use this field to specify the number of slices into which you want to divide the work done by this job template.
Use this field to specify the time in seconds to run the job before it is canceled. A value of
0causes no job timeout.Enable this option to show the changes made by Ansible tasks.
Use this field to specify the instance groups on which you want to run the job template.
This field accepts a comma-separated list of tags that exist in a playbook. Use tags to identify distinct portions of a playbook. By specifying a list of tags in this field, you can selectively execute only certain portions of a playbook.
This field accepts a comma-separated list of tags that exist in a playbook. By specifying a list of tags in this field, you can selectively skip certain portions of a playbook during its execution.
Select this option to run the playbook with escalated privileges.
Select this option to create a provisioning callback URL on automation controller, which hosts can use to request a configuration update using the job template.
Select this option to enable the ability to interact with GitHub or GitLab.
Select this option to allow for multiple, simultaneous executions of this job template.
Select this option to save the gathered facts to be viewed at the host level.
When executing playbooks from the command line, administrators can modify playbook execution with command-line options. Automation controller provides some of this flexibility by allowing certain parameters in job templates to prompt for user input at the time of job execution. The Prompt on launch option is available for the following parameters:
Job TypeInventoryCredentialsVariablesLimitVerbosityShow ChangesJob TagsSkip Tags
The flexibility to change job parameters at the time of job execution encourages playbook reuse. For example, rather than creating multiple job templates to run the same playbook on different sets of managed hosts, a single job template that has the Prompt on launch option enabled for the inventory field is sufficient. When the job is launched, the user executing the job is given the option to specify an inventory to execute the playbook on. When prompted, users can only select from inventories that they have been assigned the Use role on.
Three roles are available to control user access to job templates.
| Role | Description |
|---|---|
Admin
| Users with the Admin role can delete a job template or edit its properties, including its associated permissions. This role also grants permissions associated with the job template Execute and Read roles. |
Execute
| Users with the Execute role can execute a job using the job template. The users can also schedule a job using the job template. This role also grants permissions associated with the job template Read role. |
Read
| Users with the Read role have read-only access to the properties of a job template. They can also view other information related to the job template, such as the list of jobs executed using the job template, as well as its associated permissions and notifications. |
Important
A job template makes use of other automation controller resources such as projects, inventories, and credentials. For a user to execute a job using a job template, they only need the Execute role on the job template; they do not need the Use roles on any of these associated automation controller resources.
When you create a job template, it is only accessible to you or users with either an Admin or Auditor role in the organization where the project was created. Additional access must be specifically configured if desired.
The assignment of the previously discussed job template roles to users or teams dictates who has permissions to a job template.
You cannot assign these permissions when you create the job template; create the job template first and then assign any required permissions.
You can assign roles through the section of the job template page. Use the following procedure to grant permissions to a job template:
Log in as a user with the
Adminrole in the organization that the job template is associated with or as the user who created the job template.Navigate to → and click the name of the job template.
On the page, click to start adding permissions.
Click either or and then click .
Select the users or teams to be granted permissions, and then click to display the list of job template roles and their definitions.
Select the desired job template role for the user or team and then click to finalize the changes to permissions.
Use the following procedure to launch a job after you have created a job template:
Log in as a user with the
Executerole on the desired job template.Navigate to → to display the list of templates.
Click the Launch Template icon under the column of the desired job template to launch the job.
If any of the job template parameters have the
Prompt on launchoption enabled, then you are prompted for input prior to job execution. Enter the desired input for each parameter and then click .
After you have launched a job from a job template in the automation controller web UI, you are automatically redirected to the job page. Alternatively, navigate to → to see the list of executed jobs and click the link for the job of interest.
The job page has two tabs. The tab displays the details of the job parameters. The tab displays the output of the playbook executed by the job.
The job output tab displays information similar to that seen when you run the playbook from the command line, but includes additional information as well. This page includes the number of plays and tasks that were executed, the number of hosts that the job was executed against, and the time it took for the job to execute. It also includes three icons: to launch the job, to download the output, and to delete the job.
References
