A job template is a definition and set of parameters for running an Ansible job. Job templates are useful to execute the same job many times. Job templates also encourage the reuse of Ansible playbook content and collaboration between teams. While the REST API allows for the execution of jobs directly, Tower requires that you first create a job template.
This menu opens a list of the job templates that are currently available. The job template list may be sorted and searched by Name or Description. The Job Templates tab also enables the user to launch, schedule, modify, and remove a job template.
To create a new job template click the button.
Enter the appropriate details into the following fields:
Name: Required
Description: Enter an arbitrary description as appropriate.
Job Type:
Inventory: Choose the inventory to be used with this job template from the inventories available to the currently logged in Tower user.
Project: Choose the project to be used with this job template from the projects available to the currently logged in Tower user.
Playbook: Choose the playbook to be launched with this job template from the available playbooks. This menu is automatically populated with the names of the playbooks found in the project base path for the selected project. For example, a playbook named “jboss.yml” in the project path appears in the menu as “jboss”.
Credential: Choose the credential to be used with this job template from the credentials available to the currently logged in Tower user.
Cloud Credential: Choose the credential to be used with this job template from the credentials available to the currently logged in Tower user.
Forks: The number of parallel or simultaneous processes to use while executing the playbook. A value of zero uses the Ansible default setting, which is 5 parallel processes unless overridden in /etc/ansible/ansible.cfg
.
Limit:
- A host pattern to further constrain the list of hosts managed or affected by the playbook. Multiple patterns can be separated by colons (”:”). As with core Ansible, “a:b” means “in group a or b”, “a:b:&c” means “in a or b but must be in c”, and “a:!b” means “in a, and definitely not in b”.
- For more information and examples refer to Patterns in the Ansible documentation.
Job Tags:
- A comma-separated list of playbook tags to constrain what parts of the playbooks are executed.
- For more information and examples refer to Tags in the Ansible documentation.
Verbosity: Control the level of output Ansible produces as the playbook executes. Set the verbosity to any of Default, Verbose, or Debug. This only appears in the “details” report view. Verbose logging includes the output of all commands. Debug logging is exceedingly verbose and includes information on SSH operations that can be useful in certain support instances. Most users do not need to see debug mode output.
Extra Variables:
Pass extra command line variables to the playbook. This is the “-e” or “–extra-vars” command line parameter for ansible-playbook that is documented in the Ansible documentation at Passing Variables on the Command Line.
Provide key/value pairs using either YAML or JSON. These variables have a maximum value of precedence and overrides other variables specified elsewhere. An example value might be:
git_branch: production release_version: 1.5
Prompt for Extra Variables: If this is checked, the user is prompted for Extra Variables at job execution. The set of extra variables defaults to any Extra Variables already configured for the job template.
Enable Survey: Survey the user on job launch. Refer to Surveys for additional information.
Create Survey: Creates a survey, if the survey is enabled.
Edit Survey: Edits the existing survey for this job template.
Delete Survey: Deletes the existing survey for this job template.
Allow Callbacks: Enable a host to call back to Tower via the Tower API and invoke the launch of a job from this job template. Refer to Provisioning Callbacks for additional information.
When you have completed configuring the job template, select Save.
When editing an existing job template, by clicking the job template name or the Edit button, the bottom of the screen displays a list of all of the jobs that have been launched from this template. Refer to the section Jobs for more information about this interface.
Cloud Credentials can be used when syncing a respective cloud inventory. Cloud Credentials may also be associated with a Job Template and included in the runtime environment for use by a playbook. The use of Cloud Credentials was introduced in Ansible Tower version 2.4.0.
The sample playbook below invokes the nova_compute
Ansible OpenStack cloud module and requires credentials to do anything meaningful, and specifically requires the following information: auth_url
, username
, password
, and project_name
. These fields are made available to the playbook via the environmental variable OS_CLIENT_CONFIG_FILE
, which points to a YAML file. This sample playbook loads the YAML file into the Ansible variable space.
OS_CLIENT_CONFIG_FILE
example:
clouds:
devstack:
auth:
auth_url: http://devstack.yoursite.com:5000/v2.0/
username: admin
password: your_password_here
project_name: demo
Playbook example:
- hosts: all
gather_facts: false
vars:
config_file: "{{ lookup('env', 'OS_CLIENT_CONFIG_FILE') }}"
nova_tenant_name: demo
nova_image_name: "cirros-0.3.2-x86_64-uec"
nova_instance_name: autobot
nova_instance_state: 'present'
nova_flavor_name: m1.nano
nova_group:
group_name: antarctica
instance_name: deceptacon
instance_count: 3
tasks:
- debug: msg="{{ config_file }}"
- stat: path="{{ config_file }}"
register: st
- include_vars: "{{ config_file }}"
when: st.stat.exists and st.stat.isreg
- name: "Print out clouds variable"
debug: msg="{{ clouds|default('No clouds found') }}"
- name: "Setting nova instance state to: {{ nova_instance_state }}"
local_action:
module: nova_compute
login_username: "{{ clouds.devstack.auth.username }}"
login_password: "{{ clouds.devstack.auth.password }}"
Amazon Web Services cloud credentials are exposed as the following environment variables during playbook execution:
AWS_ACCESS_KEY
AWS_SECRET_KEY
All of the AWS modules will implicitly use these credentials when run via Tower without having to set the aws_access_key
or aws_secret_key
module options.
Rackspace cloud credentials are exposed as the following environment variables during playbook execution:
RAX_USERNAME
RAX_API_KEY
All of the Rackspace modules will implicitly use these credentials when run via Tower without having to set the username
or api_key
module options.
Google cloud credentials are exposed as the following environment variables during playbook execution:
GCE_EMAIL
GCE_PROJECT
GCE_PEM_FILE_PATH
All of the Google modules will implicitly use these credentials when run via Tower without having to set the service_account_email
, project_id
, or pem_file
module options.
Azure cloud credentials are exposed as the following environment variables during playbook execution:
AZURE_SUBSCRIPTION_ID
AZURE_CERT_PATH
All of the Azure modules implicitly use these credentials when run via Tower without having to set the subscription_id
or management_cert_path
module options.
VMware cloud credentials are exposed as the following environment variables during playbook execution:
VMWARE_USER
VMWARE_PASSWORD
VMWARE_HOST
The sample playbook below demonstrates usage of these credentials:
- vsphere_guest:
vcenter_hostname: "{{ lookup('env', 'VMWARE_HOST') }}"
username: "{{ lookup('env', 'VMWARE_USER') }}"
password: "{{ lookup('env', 'VMWARE_PASSWORD') }}"
guest: newvm001
from_template: yes
template_src: centosTemplate
cluster: MainCluster
resource_pool: "/Resources"
vm_extra_config:
folder: MyFolder
Surveys set extra variables for the playbook similar to ‘Prompt for Extra Variables’ does, but in a user-friendly question and answer way. Surveys also allows for validation of user input. If Enable Survey is checked, you can see a button to Create Survey.
Use cases for surveys are numerous. An example might be if operations wanted to give developers a “push to stage” button they could run without advanced Ansible knowledge. When launched, this task could prompt for answers to questions such as, “What tag should we release?”
Many types of questions can be asked, including multiple-choice questions.
Note
Surveys are only available to those with Enterprise-level licenses.
Clicking on Create Survey brings up the Add Survey window.
A survey can consist of any number of questions. For each question, enter the following information:
Once you have entered the question information, click Add Question to add the question.
A stylized version of the survey is presented, along with a New Question button. Click this button to add additional questions.
For any question, you can click on the Edit button to edit the question, the Delete button to delete the question, and click on the Up and Down arrow buttons to rearrange the order of the questions. Click Save to save the survey.
Click Save to save the survey.
The Required setting on a survey question determines whether the answer is optional or not for the user interacting with it.
Behind the scenes, optional survey variables can be passed to the playbook in extra_vars
, even when they aren’t filled in.
extra_var
is passed to the playbook.length > 0
, no survey extra_var
is passed to the playbook.length === 0
, that survey extra_var
is passed to the playbook, with the value set to an empty string ( “” ).When you pass survey variables, they are passed as extra variables (extra_vars
) within Tower. This can be tricky, as passing extra variables to a job template (as you would do with a survey) can override other variables being passed from the inventory and project.
For example, say that you have a defined variable for an inventory for debug = true
. It is entirely possible that this variable, debug = true
, can be overridden in a job template survey.
To ensure that the variables you need to pass are not overridden, ensure they are included by redefining them in the survey. Keep in mind that extra variables can be defined at the inventory, group, and host levels.
Note
Beginning with Ansible Tower version 2.4, the behavior for Job Template extra variables and Survey variables has changed. Previously, variables set using a Survey overrode any extra variables specified in the Job Template. In 2.4 and later, the Job Template extra variables dictionary is merged with the Survey variables. This may result in a change of behavior upon upgrading to 2.4.
The following table notes the behavior (hierarchy) of variable precedence in Ansible Tower as it compares to variable precedence in Ansible.
Ansible Tower Variable Precedence Hierarchy (last listed wins)
Another change for Ansible Tower version 2.4 introduced a launch_type
setting for your jobs. Instead of manually relaunching a job, a relaunch is denoted by setting launch_type
to relaunch
. The relaunch behavior deviates from the launch behavior in that it does not inherit extra_vars
.
Job relaunching does not go through the inherit logic. It uses the same extra_vars
that were calculated for the job that is being relaunched.
For example, say that you launched a Job Template with no extra_vars
which resulted in the creation of j1. Next, say that you changed the Job Template and all the extra_vars
“{ “hello”: “world” }”. Relaunching j1 results in the creation of j2, but j2 will not have any extra_vars
.
To continue upon this example, if you were to then launch the Job Template (with the extra_vars
you added after the creation of j1), the relaunced job (j3) will include the extra_vars
“{ “hello”: “world” }”. Relaunching j3, resulting in the creation of j4, would also include extra_vars
“{ “hello”: “world” }”.
Provisioning callbacks are a feature of Tower that allow a host to initiate a playbook run against itself, rather than waiting for a user to launch a job to manage the host from the tower console. Please note that provisioning callbacks are only used to run playbooks on the calling host. Provisioning callbacks are meant for cloud bursting, ie: new instances that phone home to be configured, not to run a job against another host. This provides for automatically configuring a system after it has been provisioned by another system (such as AWS auto-scaling, or a OS provisioning system like kickstart or preseed) or for launching a job programmatically without invoking the Tower API directly. The Job Template launched only runs against the host requesting the provisioning.
Frequently this would be accessed via a firstboot type script, or from cron.
To enable callbacks, check the Allow Callbacks checkbox. This displays the Provisioning Callback URL for this job template.
Note
If you intend to use Tower’s provisioning callback feature with a dynamic inventory, Update on Launch should be set for the inventory group used in the Job Template.
Callbacks also require a Host Config Key, to ensure that foreign hosts with the URL cannot request configuration. Click the button to create a unique host key for this callback, or enter your own key. The host key may be reused across multiple hosts to apply this job template against multiple hosts. Should you wish to control what hosts are able to request configuration, the key may be changed at any time.
To callback manually via REST, look at the callback URL in the UI, which is of the form:
http://<Tower server name>/api/v1/job_templates/1/callback/
The ‘1’ in this sample URL is the job template ID in Tower.
The request from the host must be a POST. Here is an example using curl (all on a single line):
root@localhost:~$ curl --data "host_config_key=5a8ec154832b780b9bdef1061764ae5a" \
http://api/v1/job_templates/1/callback/
The requesting host must be defined in your inventory for the callback to succeed. If Tower fails to locate the host either by name or IP address in one of your defined inventories, the request is denied. When running a Job Template in this way, the host initiating the playbook run against itself must be in the inventory. If the host is missing from the inventory, the Job Template will fail with a “No Hosts Matched” type error message.
Note
If your host is not in inventory and Update on Launch
is set for the inventory group, Tower attempts to update cloud based inventory source before running the callback.
Successful requests result in an entry on the Jobs tab, where the results and history can be viewed.
While the callback can be accessed via REST, the suggested method of using the callback is to use one of the example scripts that ships with Tower - /usr/share/awx/request_tower_configuration.sh
(Linux/Unix) or /usr/share/awx/request_tower_configuration.ps1
(Windows). Usage is described in the source code of the file. This script is intelligent in that it knows how to retry commands and is therefore a more robust way to use callbacks than a simple curl request. As written, the script retries once per minute for up to ten minutes, which is amply conservative.
Most likely you will use callbacks with dynamic inventory in Tower, such as pulling cloud inventory from one of the supported cloud providers. In these cases, along with setting Update On Launch, be sure to configure an inventory cache timeout for the inventory source, to avoid abusive hammering of your Cloud’s API endpoints. Since the request_tower_configuration.sh
script polls once per minute for up to ten minutes, a suggested cache invalidation time for inventory (configured on the inventory source itself) would be one or two minutes.
While we recommend against running the request_tower_configuration.sh
script from a cron job, a suggested cron interval would be perhaps every 30 minutes. Repeated configuration can be easily handled by scheduling in Tower, so the primary use of callbacks by most users is to enable a base image that is bootstrapped into the latest configuration upon coming online. To do so, running at first boot is a better practice. First boot scripts are just simple init scripts that typically self-delete, so you would set up an init script that called a copy of the request\_tower\_configuration
script and make that into an autoscaling image.
Just as you can pass extra_vars
in a regular Job Template, you can also pass them to provisioning callbacks. To pass extra_vars
, the data sent must be part of the body of the POST request as application/json (as the content type). Use the following JSON format as an example when adding your own extra_vars
to be passed:
'{"extra_vars": {"variable1":"value1","variable2":"value2",...}}'
(Added in Ansible Tower version 2.2.0.)
A major benefit of Ansible Tower is the push-button deployment of Ansible playbooks. You can easily configure a template within Tower to store all parameters you would normally pass to the ansible-playbook on the command line–not just the playbooks, but the inventory, credentials, extra variables, and all options and settings you can specify on the command line.
Easier deployments drive consistency, by running your playbooks the same way each time, and allow you to delegate responsibilities–even users who aren’t Ansible experts can run Tower playbooks written by others.
To launch a job template, click the button.
A job may require additional information to run. The following data may be requested at launch:
Here is an example job launch that prompts for a password, and runs the example survey created in Surveys.
Along with any extra variables set in the job template and survey, Tower automatically adds the following variables to the job environment:
tower_job_id
: The Job ID for this job runtower_job_launch_type
: One of manual, callback, or scheduled to indicate how the job was startedtower_job_template_id
: The Job Template ID that this job run usestower_job_template_name
: The Job Template name that this job usestower_user_id
: The user ID of the Tower user that started this job. This is not available for callback or scheduled jobs.tower_user_name
: The user name of the Tower user that started this job. This is not available for callback or scheduled jobs.Upon launch, Tower automatically redirects the web browser to the Job Status page for this job under the Jobs tab.
Launching job templates may also be scheduled via the button. Clicking this button opens the Schedules page.
This page displays a list of the schedules that are currently available for the selected Job Template. The schedule list may be sorted and searched by Name.
The list of schedules includes: - Name: Clicking the schedule name opens the Edit Schedule dialog - First Run: The first scheduled run of this task - Next Run: The next scheduled run of this task - Final Run: If the task has an end date, this is the last run of the task
Buttons located in the upper right corner of the Schedules screen provide the following actions:
To create a new schedule click the button.
Enter the appropriate details into the following fields and select Save:
The Details tab displays a description of the schedule and a list of the scheduled occurrences in the selected Local Time Zone.
Note
Jobs are scheduled in UTC. Repeating jobs that runs at a specific time of day may move relative to a local timezone when Daylight Saving Time shifts occur.
There are several actions available for schedules, under the Actions column: