Awx: support galaxy role fetch authentication

[FloThinksPi]

ISSUE TYPE

• Feature Idea

COMPONENT NAME

• UI
• API

SUMMARY

This is half Feature Idea, half Bug because this makes ansible galaxy bearly useable in AWX/Tower.

As described in http://docs.ansible.com/ansible-tower/3.2.1/html/userguide/projects.html#ansible-galaxy-support , AWX is capable of running ansible-galaxy to load dependencys like Roles over a Ansible mechanism. Unfortunaly AWX/Tower seem to fail providing authentication credentials to galaxy. Thus it is not possible to safely clone from git repositoriy or provide any requirements where authentication is required.

ENVIRONMENT

• AWX version: 1.0.1.32
• AWX install method: docker install via local build
• Ansible version: 2.4.0.0
• Host System: RHEL 7.4
• Web Browser: Chrome

STEPS TO REPRODUCE

The project must include a roles/requirements.yml file with git requirements which require authentication for cloning.

My requirements contain following.

# Install a role from a specific git branch
- name: myrole
  src: ansible-awx@mydomain:8081/2911-ansible/roles/myrole.git
  scm: git
  version: master

EXPECTED RESULTS

The clone of roles defined in requirements.yml should work.
At least the credentials for the project should be used for cloning from the same git server via ansible galaxy.
In the best case, the requirements.yml get detected and parsed after the clone of the project and AWX could somehow implement a method to even supply different credentials to different entrys in the requirements.yml

ACTUAL RESULTS

The Cloning of a whole project with a requirements.yml is sucessfull however when running a template , ansiblegalaxy gets executed (which was skipped when cloning a whole project) and is cloning the roles without password or empty Passwort possibly because none where provided in the URI

TASK [fetch galaxy roles from requirements.yml] ********************************
The authenticity of host 'mydomain (10.xx.xx.xx)' can't be established.
ECDSA key fingerprint is SHA256:blabla
ECDSA key fingerprint is MD5:blabla
Are you sure you want to continue connecting (yes/no)? 
ansible-awx@mydomain's password: 
ansible-awx@mydomain's password: 
ansible-awx@mydomain's password: 
fatal: [localhost]: FAILED! => {"changed": true, "cmd": ["ansible-galaxy", "install", "-r", "requirements.yml", "-p", 
[.....]

So as workaround one would have to add the credentials to the git SCM what nobody should ever do.

ADDITIONAL INFORMATION

Could be combined with #106

[wenottingham]

The way ansible-galaxy works to checkout requirements is that it formulates a git command from the src line and executes the git commandline.

To do what's asked here relies on git prompting the user, and for that prompting to be passed through ansible-galaxy in a way that pexpect() could possibly supply the password... and even so would only work if there's a single password required for all roles that might be checked out.

[FloThinksPi]

Hm is there any possibility to load Roles from third party git Repositorys ? because the same issue applies to git submodules. When cloning a Project, the submodules get cloned without authentication.

[wenottingham]

?

The example you posted is effectively a third-party git repository - it would attempt to be cloned regardless of where the original project is located.

[FloThinksPi]

@wenottingham thats correct, but how can i supply credentals from AWX to clone submodules. When cloning a project with submodules, the credentials get used for the actuall git repo(project). however when AWX clones the git submodules of that project, it does not provide the (same)credentials thus the clone of the project fails because it cant clone the git submodules.

Effectively there is no way i see to keep parts of a playbook, like roles in a seperate git repository which needs authentication because neither git submodules can be cloned nor can Galaxy clone additional requirements via a git repo which needs authentication.

[wenottingham]

That will hit the exact same issue - if you have multiple submodules with different username/password, you can't reliably prompt for that; you'd need to encode the auth in the URL.

[FloThinksPi]

Got it working by choosing the same communication method for the repo and submodules. When the repo used https to clone and the submudules where ssh, AWX somehow didnt provide the credentials to the submodules. I switched the submodules to https and voila, AWX uses the credentials of the main repo for the submodules ;)

[srinivasakp]

folks.. I think there is a bug in it.

i have fixed in project_update.yml file modified it
default stats command mentioned in the file doesn't work
Also, scm_full_checkout value doesn't exists and hence fails to execute the roles

1

- name: detect requirements.yml
  stat:
    path: "{{project_path|quote}}/roles/requirements.yml"
  register: doesRequirementsExist

2

- name: fetch galaxy roles from requirements.yml
  command: ansible-galaxy install -r requirements.yml -p {{project_path|quote}}/roles/ --force
  args:
    chdir: "{{project_path|quote}}/roles"
  when: doesRequirementsExist.stat.exists

[cstuart1]

@srinivasakp
Thanks for posting a resolution, this resolved my issue with galaxy roles as well.

[cavamagie]

@srinivasakp thanks!!!
but for me is necessary to add for example an option
acceptkey: yes

[MathiasDidier]

Got it working by choosing the same communication method for the repo and submodules. When the repo used https to clone and the submudules where ssh, AWX somehow didnt provide the credentials to the submodules. I switched the submodules to https and voila, AWX uses the credentials of the main repo for the submodules ;)

I am struggling with something similar. I want to have one repo with the playbooks and one with vars. How can I use a awx-job (playbook repo) and use vars from the vars repo? Both repos are on a on premise gitlab server and awx should use the same credentials over https.