Red Hat Enterprise Linux Automation with Ansible

As an example, the recommended time synchronization service for Red Hat Enterprise Linux 7 is the chronyd service. In Red Hat Enterprise Linux 6 however, the recommended service is the ntpd service. In an environment with a mixture of Red Hat Enterprise Linux 6 and 7 hosts, an administrator must manage the configuration files for both services.

With RHEL System Roles, administrators no longer need to maintain configuration files for both services. Administrators can use rhel-system-roles.timesync role to configure time synchronization for both Red Hat Enterprise Linux 6 and 7 hosts. A simplified YAML file containing role variables defines the configuration of time synchronization for both types of hosts.

RHEL System Roles are derived from the open source Linux System Roles project, found on Ansible Galaxy. Unlike Linux System Roles, RHEL System Roles are supported by Red Hat as part of a standard Red Hat Enterprise Linux subscription. RHEL System Roles have the same life cycle support benefits that come with a Red Hat Enterprise Linux subscription.

Every system role is tested and stable. The Fully Supported system roles also have stable interfaces. For any Fully Supported system role, Red Hat will endeavour to ensure that role variables are unchanged in future versions. Playbook refactoring due to system role changes should be minimal.

The Technology Preview system roles may utilize different role variables in future versions. Integration testing is recommended for playbooks that incorporate any Technology Preview role. Playbooks may require refactoring if role variables change in a future version of the role.

Other roles are in development in the upstream Linux System Roles project, but are not yet available through a RHEL subscription. These roles are available through Ansible Galaxy.

After installation, documentation for the RHEL System Roles is found in the /usr/share/doc/rhel-system-roles-<version>/ directory. Documentation is organized into subdirectories by subsystem:

[root@host ~]# ls -l /usr/share/doc/rhel-system-roles/
total 4
drwxr-xr-x. ...output omitted... kdump
drwxr-xr-x. ...output omitted... network
drwxr-xr-x. ...output omitted... postfix
drwxr-xr-x. ...output omitted... selinux
drwxr-xr-x. ...output omitted... timesync

Each role's documentation directory contains a README.md file. The README.md file contains a description of the role, along with role usage information.

The README.md file also describes role variables that affect the behavior of the role. Often the README.md file contains a playbook snippet that demonstrates variable settings for a common configuration scenario.

Some role documentation directories contain example playbooks. When using a role for the first time, review any additional example playbooks in the documentation directory.

Role documentation for RHEL System Roles matches the documentation for Linux System Roles. Use a web browser to access role documentation for the upstream roles at the Ansible Galaxy site, https://galaxy.ansible.com.

Sometimes, the SELinux role must ensure the managed hosts are rebooted in order to completely apply its changes. However, it does not ever reboot hosts itself. This is so that you can control how the reboot is handled. But it means that it is a little more complicated than usual to properly use this role in a play.

The way this works is that the role will set a Boolean variable, selinux_reboot_required, to true and fail if a reboot is needed. You can use a block/rescue structure to recover from the failure, by failing the play if that variable is not set to true or rebooting the managed host and rerunning the role if it is true. The block in your play should look something like this:

    - name: Apply SELinux role
      block:
        - include_role:
            name: rhel-system-roles.selinux
      rescue:
        - name: Check for failure for other reasons than required reboot
          fail:
          when: not selinux_reboot_required

        - name: Restart managed host
          reboot:

        - name: Reapply SELinux role to complete changes
          include_role:
            name: rhel-system-roles.selinux

The variables used to configure the rhel-system-roles.selinux role are documented in its README.md file. The following examples show some ways to use this role.

The selinux_state variable sets the mode SELinux runs in. It can be set to enforcing, permissive, or disabled. If it is not set, the mode is not changed.

selinux_state: enforcing

The selinux_booleans variable takes a list of SELinux Boolean values to adjust. Each item in the list is a hash/dictionary of variables: the name of the Boolean, the state (whether it should be on or off), and whether the setting should be persistent across reboots.

This example sets httpd_enable_homedirs to on persistently:

selinux_booleans:
  - name: 'httpd_enable_homedirs'
    state: 'on'
    persistent: 'yes'

The selinux_fcontext variable takes a list of file contexts to persistently set (or remove). It works much like the selinux fcontext command.

The following example ensures the policy has a rule to set the default SELinux type for all files under /srv/www to httpd_sys_content_t.

selinux_fcontexts:
  - target: '/srv/www(/.*)?'
    setype: 'httpd_sys_content_t'
    state: 'present'

The selinux_restore_dirs variable specifies a list of directories on which to run restorecon:

selinux_restore_dirs:
  - /srv/www

The selinux_ports variable takes a list of ports that should have a specific SELinux type.

selinux_ports:
  - ports: '82'
    setype: 'http_port_t'
    proto: 'tcp'
    state: 'present'

There are other variables and options for this role. See its README.md file for more information.