To get today's date, I'm using this variable in a Jinja template: {{ now() | ansible.builtin.strftime('%d/%m/%Y') }} However, it fails with an error > ansible.errors.AnsibleFilterError: Invalid value for epoch value (%d/%m/%Y) Why is that?

We manage a server farm of RHEL 9 machines via Red Hat Satellite and Ansible Tower (AWX). On some machines the dnf versionlock command outputs packages **"foo"** and **"bar"** as versionlocked. Hovever, our Ansible configuration for these machines (using module community.general.yum_versionlock -- not community.general.dnf_versionlock as we had yum-based old RHEL servers in the past) is set to versionlock the packages **"foo"** and **"quux"**. So, where are all the places where version-locked packages are defined? In particular, is there some setting in Satellite, perhaps related to Repos/Products/Hosts?

On several of my RHEL 9 machines managed by Ansible, the java-1.8.0-openjdk package is versionlocked: - name: java-1.8.0-openjdk-1:1.8.0.402.b06-2.el9 state: present However, Ansible tries to update it anyway, and this causes the Ansible Tower job to fail. Below are the corresponding commands when run via Bash shell. [myhost root ~]# dnf versionlock Updating Subscription Management repositories. rhel9flexnet 105 kB/s | 2.0 kB 00:00 rhel9checkmkagent 113 kB/s | 2.0 kB 00:00 rhel9elk8 97 kB/s | 1.7 kB 00:00 rhel9epel 127 kB/s | 2.3 kB 00:00 java-1.8.0-openjdk-1:1.8.0.402.b06-2.el9.* [myhost root ~]# dnf update Updating Subscription Management repositories. rhel9flexnet 112 kB/s | 2.0 kB 00:00 rhel9checkmkagent 122 kB/s | 2.0 kB 00:00 rhel9elk8 108 kB/s | 1.7 kB 00:00 rhel9epel 133 kB/s | 2.3 kB 00:00 Error: Problem: package java-1.8.0-openjdk-1:1.8.0.402.b06-2.el9.x86_64 from @System requires java-1.8.0-openjdk-headless(x86-64) = 1:1.8.0.402.b06-2.el9, but none of the providers can be installed - cannot install both java-1.8.0-openjdk-headless-1:1.8.0.442.b06-2.el9.x86_64 from rhel-9-for-x86_64-appstream-rpms and java-1.8.0-openjdk-headless-1:1.8.0.402.b06-2.el9.x86_64 from @System - cannot install both java-1.8.0-openjdk-headless-1:1.8.0.442.b06-2.el9.x86_64 from rhel-9-for-x86_64-appstream-rpms and java-1.8.0-openjdk-headless-1:1.8.0.402.b06-2.el9.x86_64 from rhel-9-for-x86_64-appstream-rpms - cannot install the best update candidate for package java-1.8.0-openjdk-headless-1:1.8.0.402.b06-2.el9.x86_64 - cannot install the best update candidate for package java-1.8.0-openjdk-1:1.8.0.402.b06-2.el9.x86_64 (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages) [myhost root ~]# dnf list installed java-1.8.0-* Updating Subscription Management repositories. Installed Packages java-1.8.0-openjdk.x86_64 1:1.8.0.402.b06-2.el9 @rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-headless.x86_64 1:1.8.0.402.b06-2.el9 @rhel-9-for-x86_64-appstream-rpms [myhost root ~]# dnf list available java-1.8.0-* Updating Subscription Management repositories. rhel9flexnet 111 kB/s | 2.0 kB 00:00 rhel9checkmkagent 122 kB/s | 2.0 kB 00:00 rhel9elk8 99 kB/s | 1.7 kB 00:00 rhel9epel 130 kB/s | 2.3 kB 00:00 Available Packages java-1.8.0-openjdk.x86_64 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-demo.x86_64 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-devel.x86_64 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-headless.x86_64 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-javadoc.noarch 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-javadoc-zip.noarch 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-src.x86_64 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms On a shell I would just run dnf update --exclude=java-1.8.0-* to bypass the problem and get a successful update. However, this needs to be done via Ansible playbooks. I am interested to know how would one do that via Ansible (workaround), and especially **why dnf tries to update versionlocked packages** (main issue). ---- EDIT 1 I've modified our update playbook: - name: Update packages yum: name: "{{ packages_name }}" state: latest exclude: "{{ (packages_donotupdate | default([])) | join(',') }}" so to exclude from the update the packages listed in the variable "packages_donotupdate" (if defined), but it does not work -- it does not update any package on the server. (Note: we use the "yum" Ansible module for backward compatibility reasons.)

I tried many ways to fix the below problem, but I was not lucky enough. I have the below inventories; #cat inventory/common/group_vars/all/inventory_pwd.yml remote1_user: "devops" #cat inventory/nonprod/fdc/group_vars/all/inventory.txt [remote] x.x.x.x ansible_ssh_user="{{ remote1_user }}" ansible_port=22 ansible_password="test@12" And I am running this below playbook to copy files from control machine to a remote machine; pb.yml

---
- name: "Copy test"
  hosts: remote
  become: true
  tasks:

    - name: Copying content to the remote vm
      synchronize:
        src: /ansible/playbooks/Hello
        dest: /home/devops/
      delegate_to: localhost

In the controller machine I logged as root user, and the user to connect with remote server is devops. But, after executing the playbook I am getting the below error; ansible-playbook -vvv -i inventory/common -i inventory/nonprod/fdc/group_vars/all/inventory.txt pb.yml

TASK [Copying content to the remote vm] *********************************************************************************************task path: /ansible/playbooks/pb.yml:9
fatal: [x.x.x.x -> localhost]: FAILED! => {
    "changed": false,
    "cmd": "sshpass -d3 /usr/bin/rsync --delay-updates -F --compress --archive --rsh=/usr/bin/ssh -S none -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null --rsync-path=sudo rsync --out-format=>%i %n%L /ansible/playbooks/Hello {{remote1_user}}@x.x.x.x:/home/devops/",
    "invocation": {
        "module_args": {
            "_local_rsync_password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "_local_rsync_path": "rsync",
            "_substitute_controller": false,
            "archive": true,
            "checksum": false,
            "compress": true,
            "copy_links": false,
            "delete": false,
            "dest": "{{remote1_user}}@x.x.x.x:/home/devops/",
            "dest_port": null,
            "dirs": false,
            "existing_only": false,
            "group": null,
            "link_dest": null,
            "links": null,
            "mode": "push",
            "owner": null,
            "partial": false,
            "perms": null,
            "private_key": null,
            "recursive": null,
            "rsync_opts": [],
            "rsync_path": "sudo rsync",
            "rsync_timeout": 0,
            "set_remote_user": true,
            "src": "/ansible/playbooks/Hello",
            "ssh_args": null,
            "times": null,
            "verify_host": false
        }
    },
    "msg": "remote username contains invalid characters\r\nrsync: connection unexpectedly closed (0 bytes received so far) [sender]\nrsync error: unexplained error (code 255) at io.c(235) [sender=3.1.3]\n",
    "rc": 255
}

Here the '"dest": "{{ remote1_user }}@x.x.x.x:/home/devops/"' should be like 'devops@x.x.x.x:/home/devops/'. However, it is not replacing 'remote1_user' with 'devops'. Can anyone please help me on this?

I have made a playbook which does something like this: shell: source ~/.bashrc && some_command |awk something more become: yes become user: a_user become_method: sudo My Ansible_user that connects to the target host should not be able to sudo -i on target host, nor should it have 'Ansible_user (ALL)=ALL NOPASSWD: ALL' entry in the /etc/sudoers. I want it to be able to execute some commands as a_user (including bash builtins like source). I found in the documentation that Ansible will try to execute something like this: 1. log on as Ansible_user 2. Execute $Ansible_user sudo -u commands_from_playbook Yet, when I try to run the playbook all I get is: module_stderr: Shared connection to host_ip_here closed msg: MODULE FAILURE See stderr for the exact error No stderr is presented despite the job running as 'verbosity 3' When user is granted sudo -i and/or ALL in sudoers, the script runs as expected... What should be the /etc/sudoers entry? Probably I should use something like Ansible_user ALL = (a_user) NOPASSWD: and_something_here (/bin/bash for builtins?) Any hints?

I'm getting a strange message with Ansible. On a RHEL 9 server, I can join our domain via the shell command line realm join example.xyz --user=svc-ansible --computer-ou="OU=Linux Servers, OU=Servers, OU=ACME, OU=Units, DC=example, DC=xyz" Once done that I can successfully change user via su - johndoe@example.xyz, where "johndoe" is an user defined in the AD and belonging to an AD group defined in simple_allow_groups in the file /etc/sssd/sssd.conf. So the config seems to be working. After that, I run an realm leave example.xyz --remove -U 'svc-ansible' and realm list beforehand to check that the server is not in the domain anymore. However, when I run via AWX an Ansible playbook defined as this (...) - name: Set staging_ou ansible.builtin.set_fact: staging_ou: "OU=Linux Servers, OU=Servers, OU=ACME, OU=Units, DC=example, DC=xyz" - name: Realm join into domain ansible.builtin.expect: command: /bin/bash -c 'realm join {{ domain }} --user={{ ad_join_user }} --computer-ou="{{ staging_ou }}"' responses: Password.*: "{{ ad_join_password }}" timeout: 120 (...) I get the following error: > TASK [playbook_ad_join : Realm join into domain] ********************************** fatal: [myrhel9server]: FAILED! => {"changed": true, "cmd": "/bin/bash -c 'realm join example.xyz --user=svc-ansible --computer-ou=\"OU=Linux Servers, OU=Servers, OU=ACME, OU=Units, DC=example, DC=xyz\"'", "delta": "0:00:00.152467", "end": "2024-11-13 11:45:09.577079", "msg": "non-zero return code", "rc": 1, "start": "2024-11-13 11:45:09.424612", "stdout": "realm: Already joined to this domain\r\nPlease check\r\n https://red.ht/support_rhel_ad \r\nto get help for common issues.", "stdout_lines": ["realm: Already joined to this domain", "Please check", " https://red.ht/support_rhel_ad ", "to get help for common issues."]} A realm list confirms that the server is indeed in the example.xyz domain and returns the same output as when I ran the realm join ... command via shell. However, I cannot su to AD users anymore: trying to do so returns an error > su: user johndoe@example.xyz does not exist or the user entry does not contain all the required fields The link cited in the error message doesn't help. What could be wrong? --- EDIT 1: Running via shell the same command run via ansible, i.e. /bin/bash -c 'realm join example.xyz (...) ' doesn't change anything with respect to running realm join example.xyz (...) (see top of post). The other tasks in the playbook only modify a few config files: /etc/krb5.conf /etc/sssd/sssd.conf /usr/local/bin/sss_ssh_authorizedkeys_ad /etc/ssh/sshd_config and install some packages. These do not matter as the configuration already converged. I have removed a line which restarted the realmd daemon, since it could be the one causing the issue, but nothing changed.

I'm looking at deploying Ansible Tower on OpenShift but don't want to deal with deploying my own Postgresql instance if I don't have to (not that it's a big deal). If I deploy [Ansible Tower](https://docs.ansible.com/ansible-tower/latest/html/administration/openshift_configuration.html#ag-openshift-configuration) on OpenShift, the diagram makes it look like I have to deploy my own instance of Postgresql instead of it using its normal embedded instance. Is that accurate or will it spin up its own Postgresql pod?

I am trying to run a simple Ansible playbook against an EC2 instance using AWX. My Ansible AWX is version 17.0.1 (running in Docker, not the Kubernetes version). I ran a 'pip3 list | grep six' and it shows it is installed as v1.16.0 (latest).

---
- name: Ping all hosts
  hosts: all
  tasks:
    - name: Ping
      ping:

I can run the command fine via the "ansible-playbook -i /etc/ansible/hosts ping-servers.yml", but when I try to use it in AWX with the proper pem for the EC2 instances, I keep getting the error as seen below.

{
  "ansible_facts": {},
  "msg": "The following modules failed to execute: setup\n",
  "failed_modules": {
    "setup": {
      "failed": true,
      "module_stdout": "Traceback (most recent call last):\r\n  File \"/home/ubuntu/.ansible/tmp/ansible-tmp-1718848180.6915529-730-156986994201226/AnsiballZ_setup.py\", line 102, in \r\n    _ansiballz_main()\r\n  File \"/home/ubuntu/.ansible/tmp/ansible-tmp-1718848180.6915529-730-156986994201226/AnsiballZ_setup.py\", line 94, in _ansiballz_main\r\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\r\n  File \"/home/ubuntu/.ansible/tmp/ansible-tmp-1718848180.6915529-730-156986994201226/AnsiballZ_setup.py\", line 37, in invoke_module\r\n    from ansible.module_utils import basic\r\n  File \"/tmp/ansible_setup_payload_ye2vc_d8/ansible_setup_payload.zip/ansible/module_utils/basic.py\", line 173, in \r\nModuleNotFoundError: No module named 'ansible.module_utils.six.moves'\r\n",
      "module_stderr": "Shared connection to 10.81.10.153 closed.\r\n",
      "exception": "Traceback (most recent call last):\r\n  File \"/home/ubuntu/.ansible/tmp/ansible-tmp-1718848180.6915529-730-156986994201226/AnsiballZ_setup.py\", line 102, in \r\n    _ansiballz_main()\r\n  File \"/home/ubuntu/.ansible/tmp/ansible-tmp-1718848180.6915529-730-156986994201226/AnsiballZ_setup.py\", line 94, in _ansiballz_main\r\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\r\n  File \"/home/ubuntu/.ansible/tmp/ansible-tmp-1718848180.6915529-730-156986994201226/AnsiballZ_setup.py\", line 37, in invoke_module\r\n    from ansible.module_utils import basic\r\n  File \"/tmp/ansible_setup_payload_ye2vc_d8/ansible_setup_payload.zip/ansible/module_utils/basic.py\", line 173, in \r\nModuleNotFoundError: No module named 'ansible.module_utils.six.moves'\r\n",
      "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
      "rc": 1,
      "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
      }
    }
  },
  "_ansible_verbose_override": true,
  "_ansible_no_log": false,
  "changed": false
}

I tried to install ansible tower on a VM, obtaining the setup from the official RH repo: https://releases.ansible.com/ansible-tower/setup/ansible-tower-setup-latest.tar.gz Everything is from the official RH Repos. I extracted the contents, and setup the inventory with the passwords, and then run sudo ./setup.sh and got the following error (despite the fact that the installer is supposed to install the ansible package):

[ansible@tower ansible-tower-setup-3.8.6-2]$ sudo ./setup.sh
Updating Subscription Management repositories.
Error: Unknown repo: 'ansible-tower-dependencies-temp'
[error] Unable to install ansible.
[error] Ansible is not installed on this machine.
You must install Ansible before you can install Tower.

For guidance on installing Ansible, consult
http://docs.ansible.com/intro_installation.html .

Turns out RedHat changed the package availability, and I had to install ansible-core. However, now on running the setup, I get the error ERROR! couldn't resolve module/action 'ini_file'. This often indicates a misspelling, missing collection, or incorrect module path.. I even tried changing the module name to contain the FQCN commnity.general.ini_file, but no luck! Unfortunately, I'm new to Ansible, and not sure how to proceed further, to install Ansible Tower. Here are the complete error logs (and platform details):

Installed:
  ansible-core-2.14.2-4.el9.x86_64                    git-core-2.39.1-1.el9.x86_64            libnsl2-2.0.0-1.el9.x86_64                      mpdecimal-2.5.1-3.el9.x86_64           
  python3.11-3.11.2-2.el9.x86_64                      python3.11-cffi-1.15.1-1.el9.x86_64     python3.11-cryptography-37.0.2-5.el9.x86_64     python3.11-libs-3.11.2-2.el9.x86_64    
  python3.11-pip-wheel-22.3.1-2.el9.noarch            python3.11-ply-3.11-1.el9.noarch        python3.11-pycparser-2.20-1.el9.noarch          python3.11-pyyaml-6.0-1.el9.x86_64     
  python3.11-setuptools-wheel-65.5.1-2.el9.noarch     python3.11-six-1.16.0-1.el9.noarch      sshpass-1.09-4.el9.x86_64                      

Complete!

[ansible@tower ansible-tower-setup-3.8.6-2]$ ansible --version
ansible [core 2.14.2]
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/ansible/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.11/site-packages/ansible
  ansible collection location = /home/ansible/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.11.2 (main, Feb 16 2023, 00:00:00) [GCC 11.3.1 20221121 (Red Hat 11.3.1-4)] (/usr/bin/python3.11)
  jinja version = 3.1.2
  libyaml = True

[ansible@tower ansible-tower-setup-3.8.6-2]$ sudo ./setup.sh 
Traceback (most recent call last):
  File "", line 1, in 
  File "/usr/lib64/python3.9/distutils/version.py", line 64, in __gt__
    c = self._cmp(other)
  File "/usr/lib64/python3.9/distutils/version.py", line 341, in _cmp
    if self.version < other.version:
TypeError: '<' not supported between instances of 'str' and 'int'
Updating Subscription Management repositories.
Error: Unknown repo: 'ansible-tower-dependencies-temp'
Using /etc/ansible/ansible.cfg as config file

instead. See https://docs.ansible.com/ansible- 
core/2.14/user_guide/playbooks_reuse_includes.html for details. This feature 
will be removed in version 2.16. Deprecation warnings can be disabled by 
setting deprecation_warnings=False in ansible.cfg.
ERROR! couldn't resolve module/action 'community.general.ini_file'. This often indicates a misspelling, missing collection, or incorrect module path.

The error appears to be in '/home/ansible/ansible-tower-setup-3.8.6-2/roles/repos_el/tasks/main.yml': line 67, column 7, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:


    - name: Enable AWS rhui repositories
      ^ here
[error] Oops!  An error occurred while running setup.
[warn] /var/log/tower does not exist. Setup log saved to setup.log.

[ansible@tower ansible-tower-setup-3.8.6-2]$ cat /etc/os-rel*
NAME="Red Hat Enterprise Linux"
VERSION="9.1 (Plow)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="9.1"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Red Hat Enterprise Linux 9.1 (Plow)"
ANSI_COLOR="0;31"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:redhat:enterprise_linux:9::baseos"
HOME_URL="https://www.redhat.com/ "
DOCUMENTATION_URL="https://access.redhat.com/documentation/red_hat_enterprise_linux/9/ "
BUG_REPORT_URL="https://bugzilla.redhat.com/ "

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 9"
REDHAT_BUGZILLA_PRODUCT_VERSION=9.1
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.1"
[ansible@tower ansible-tower-setup-3.8.6-2]$

I'd like to use Ansible to upload files from local workstations to a NAS server. Both are managed via Ansible. The only way I've gotten this to work so far is by mounting the NAS file share as a local directory via NFS, and delegating the copy tasks to the Ansible controller:

- name: Fetch files to NAS
    fetch:
      src: "{{ item.path }}"
      dest: "/NAS/Share/{{inventory_hostname}}/" #

However, this solution is slow and error prone. In addition, I would like to start using Ansible tower, with which I don't think this solution will work at all. Is this a feasible task to automate via Ansible? The only solution I can think of is mounting the NAS to the workstations and copying it locally - something I'd prefer to avoid. Any pointers would be greatly appreciated. Thanks! EDIT: Thanks to the great commenters below! I managed to use the synchronize module from Linux workstations as suggested. Unfortunately, some of the workstations run Windows, where the module isn't available. The only currently working solution I could muster is using pscp, which I prefer to avoid to keep things Ansible-only. Is there another method I can use to fetch files from Windows workstations to the NAS? Thanks!