Ansible is a radically simple IT automation platform that makes your applications and systems easier to deploy. Avoid writing scripts or custom code to deploy and update your applications — automate in a language that approaches plain English, using SSH, with no agents to install on remote systems. https://docs.ansible.com/ansible/
9c58827410
* Better handling of malformed vault data envelope
If an embedded vaulted variable ('!vault' in yaml)
had an invalid format, it would eventually cause
an error for seemingly unrelated reasons.
"Invalid" meaning not valid hexlify (extra chars,
non-hex chars, etc).
For ex, if a host_vars file had invalid vault format
variables, on py2, it would cause an error like:
'ansible.vars.hostvars.HostVars object' has no
attribute u'broken.example.com'
Depending on where the invalid vault is, it could
also cause "VARIABLE IS NOT DEFINED!". The behavior
can also change if ansible-playbook is py2 or py3.
Root cause is errors from binascii.unhexlify() not
being handled consistently.
Fix is to add a AnsibleVaultFormatError exception and
raise it on any unhexlify() errors and to handle it
properly elsewhere.
Add a _unhexlify() that try/excepts around a binascii.unhexlify()
and raises an AnsibleVaultFormatError on invalid vault data.
This is so the same exception type is always raised for this
case. Previous it was different between py2 and py3.
binascii.unhexlify() raises a binascii.Error if the hexlified
blobs in a vault data blob are invalid.
On py2, binascii.Error is a subclass of Exception.
On py3, binascii.Error is a subclass of TypeError
When decrypting content of vault encrypted variables,
if a binascii.Error is raised it propagates up to
playbook.base.Base.post_validate(). post_validate()
handles exceptions for TypeErrors but not for
base Exception subclasses (like py2 binascii.Error).
* Add a display.warning on vault format errors
* Unit tests for _unhexlify, parse_vaulttext*
* Add intg test cases for invalid vault formats
Fixes #28038
|
||
|---|---|---|
| .github | ||
| bin | ||
| contrib | ||
| docs | ||
| examples | ||
| hacking | ||
| lib/ansible | ||
| licenses | ||
| packaging | ||
| test | ||
| ticket_stubs | ||
| .coveragerc | ||
| .gitattributes | ||
| .gitignore | ||
| .gitmodules | ||
| .mailmap | ||
| .yamllint | ||
| ansible-core-sitemap.xml | ||
| CHANGELOG.md | ||
| CODING_GUIDELINES.md | ||
| CONTRIBUTING.md | ||
| COPYING | ||
| docsite_requirements.txt | ||
| Makefile | ||
| MANIFEST.in | ||
| MODULE_GUIDELINES.md | ||
| README.md | ||
| RELEASES.txt | ||
| requirements.txt | ||
| ROADMAP.rst | ||
| setup.py | ||
| shippable.yml | ||
| tox.ini | ||
| VERSION | ||
Ansible
Ansible is a radically simple IT automation system. It handles configuration-management, application deployment, cloud provisioning, ad-hoc task-execution, and multinode orchestration - including trivializing things like zero downtime rolling updates with load balancers.
Read the documentation and more at https://ansible.com/
You can find installation instructions here for a variety of platforms. Most users should probably install a released version of Ansible from pip, a package manager or our release repository. Officially supported builds of Ansible are also available. Some power users run directly from the development branch - while significant efforts are made to ensure that devel is reasonably stable, you're more likely to encounter breaking changes when running Ansible this way.
Design Principles
- Have a dead simple setup process and a minimal learning curve
- Manage machines very quickly and in parallel
- Avoid custom-agents and additional open ports, be agentless by leveraging the existing SSH daemon
- Describe infrastructure in a language that is both machine and human friendly
- Focus on security and easy auditability/review/rewriting of content
- Manage new remote machines instantly, without bootstrapping any software
- Allow module development in any dynamic language, not just Python
- Be usable as non-root
- Be the easiest IT automation system to use, ever.
Get Involved
- Read Community Information for all kinds of ways to contribute to and interact with the project, including mailing list information and how to submit bug reports and code to Ansible.
- All code submissions are done through pull requests. Take care to make sure no merge commits are in the submission, and use
git rebasevsgit mergefor this reason. If submitting a large code change (other than modules), it's probably a good idea to join ansible-devel and talk about what you would like to do or add first and to avoid duplicate efforts. This not only helps everyone know what's going on, it also helps save time and effort if we decide some changes are needed. - Users list: ansible-project
- Development list: ansible-devel
- Announcement list: ansible-announce - read only
- irc.freenode.net: #ansible
Branch Info
- Releases are named after Led Zeppelin songs. (Releases prior to 2.0 were named after Van Halen songs.)
- The devel branch corresponds to the release actively under development.
- Various release-X.Y branches exist for previous releases.
- We'd love to have your contributions, read Community Information for notes on how to get started.
Authors
Ansible was created by Michael DeHaan (michael.dehaan/gmail/com) and has contributions from over 1000 users (and growing). Thanks everyone!
Ansible is sponsored by Ansible, Inc
License
GNU General Public License v3.0
See COPYING to see the full text.