Ansible module architecture

Python

New-style Python modules use the Ansiballz framework framework for constructing modules. These modules use imports from ansible.module_utils to pull in boilerplate module code, such as argument parsing, formatting of return values as JSON, and various file operations.

PowerShell

New-style PowerShell modules use the Module Replacer framework framework for constructing modules. These modules get a library of PowerShell code embedded in them before being sent to the managed node.

Module Replacer framework

The Module Replacer framework is the original framework implementing new-style modules, and is still used for PowerShell modules. It is essentially a preprocessor (like the C Preprocessor for those familiar with that programming language). It does straight substitutions of specific substring patterns in the module file. There are two types of substitutions:

• Replacements that only happen in the module file. These are public replacement strings that modules can utilize to get helpful boilerplate or access to arguments.

  • from ansible.module_utils.MOD_LIB_NAME import * is replaced with the contents of the ansible/module_utils/MOD_LIB_NAME.py These should only be used with new-style Python modules.

  • #<<INCLUDE_ANSIBLE_MODULE_COMMON>> is equivalent to from ansible.module_utils.basic import * and should also only apply to new-style Python modules.

  • # POWERSHELL_COMMON substitutes the contents of ansible/module_utils/powershell.ps1. It should only be used with new-style Powershell modules.

• Replacements that are used by ansible.module_utils code. These are internal replacement patterns. They may be used internally, in the above public replacements, but shouldn’t be used directly by modules.

  • "<<ANSIBLE_VERSION>>" is substituted with the Ansible version. In new-style Python modules under the Ansiballz framework framework the proper way is to instead instantiate an AnsibleModule and then access the version from :attr:AnsibleModule.ansible_version.

  • "<<INCLUDE_ANSIBLE_MODULE_COMPLEX_ARGS>>" is substituted with a string which is the Python repr of the JSON encoded module parameters. Using repr on the JSON string makes it safe to embed in a Python file. In new-style Python modules under the Ansiballz framework this is better accessed by instantiating an AnsibleModule and then using AnsibleModule.params.

  • <<SELINUX_SPECIAL_FILESYSTEMS>> substitutes a string which is a comma-separated list of file systems which have a file system dependent security context in SELinux. In new-style Python modules, if you really need this you should instantiate an AnsibleModule and then use AnsibleModule._selinux_special_fs. The variable has also changed from a comma-separated string of file system names to an actual python list of file system names.

  • <<INCLUDE_ANSIBLE_MODULE_JSON_ARGS>> substitutes the module parameters as a JSON string. Care must be taken to properly quote the string as JSON data may contain quotes. This pattern is not substituted in new-style Python modules as they can get the module parameters another way.

  • The string syslog.LOG_USER is replaced wherever it occurs with the syslog_facility which was named in ansible.cfg or any ansible_syslog_facility inventory variable that applies to this host. In new-style Python modules this has changed slightly. If you really need to access it, you should instantiate an AnsibleModule and then use AnsibleModule._syslog_facility to access it. It is no longer the actual syslog facility and is now the name of the syslog facility. See the documentation on internal arguments for details.

Ansiballz framework

The Ansiballz framework was adopted in Ansible 2.1 and is used for all new-style Python modules. Unlike the Module Replacer, Ansiballz uses real Python imports of things in ansible/module_utils instead of merely preprocessing the module. It does this by constructing a zipfile – which includes the module file, files in ansible/module_utils that are imported by the module, and some boilerplate to pass in the module’s parameters. The zipfile is then Base64 encoded and wrapped in a small Python script which decodes the Base64 encoding and places the zipfile into a temp directory on the managed node. It then extracts just the Ansible module script from the zip file and places that in the temporary directory as well. Then it sets the PYTHONPATH to find Python modules inside of the zip file and imports the Ansible module as the special name, __main__. Importing it as __main__ causes Python to think that it is executing a script rather than simply importing a module. This lets Ansible run both the wrapper script and the module code in a single copy of Python on the remote machine.

In Ansiballz, any imports of Python modules from the ansible.module_utils package trigger inclusion of that Python file into the zipfile. Instances of #<<INCLUDE_ANSIBLE_MODULE_COMMON>> in the module are turned into from ansible.module_utils.basic import * and ansible/module-utils/basic.py is then included in the zipfile. Files that are included from module_utils are themselves scanned for imports of other Python modules from module_utils to be included in the zipfile as well.

_ansible_no_log

Type: bool

Set to True whenever an argument in a task or play specifies no_log. Any module that calls the AnsibleModule.log() function handles this action automatically. If you have a module that implements its own logging then you need to check the value of _ansible_no_log. To access _ansible_no_log in a module, instantiate the AnsibleModule utility and then check the value of AnsibleModule.no_log.

_ansible_debug

Type: bool

Operates verbose logging and logging of external commands that a module executes. If the module uses the AnsibleModule.debug() function rather than the AnsibleModule.log() function then the messages are only logged if you set the _ansible_debug argument to True. To access _ansible_debug in a module, instantiate the AnsibleModule utility and access AnsibleModule._debug. For more details, see DEFAULT_DEBUG.

_ansible_diff

Type: bool

With this parameter you can configure your module to show a unified diff of changes that will be applied to the templated files. To access _ansible_diff in a module, instantiate the AnsibleModule utility and access AnsibleModule._diff. You can also access this parameter using the diff keyword in your playbook, or the relevant environment variable. For more details, see Playbook Keywords and the DIFF_ALWAYS configuration option.

_ansible_verbosity

Type: int

You can use this argument to control the level (0 for none) of verbosity in logging.

_ansible_selinux_special_fs

Type: list Elements: strings

This argument provides modules with the names of file systems which should have a special SELinux context. They are used by the AnsibleModule methods which operate on files (changing attributes, moving, and copying).

Most modules can use the built-in AnsibleModule methods to manipulate files. To access in a module that needs to know about these special context file systems, instantiate AnsibleModule and examine the list in AnsibleModule._selinux_special_fs.

This argument replaces ansible.module_utils.basic.SELINUX_SPECIAL_FS from Module Replacer framework. In the module replacer framework the argument was formatted as a comma-separated string of file system names. Under the Ansiballz framework it is a list. You can access _ansible_selinux_special_fs using the corresponding environment variable. For more details, see the DEFAULT_SELINUX_SPECIAL_FS configuration option.

_ansible_syslog_facility

This argument controls which syslog facility the module logs to. Most modules should just use the AnsibleModule.log() function which will then make use of this. If a module has to use this on its own, it should instantiate the AnsibleModule method and then retrieve the name of the syslog facility from AnsibleModule._syslog_facility. The Ansiballz code is less elegant than the Module Replacer framework code:

# Old module_replacer way
import syslog
syslog.openlog(NAME, 0, syslog.LOG_USER)

# New Ansiballz way
import syslog
facility_name = module._syslog_facility
facility = getattr(syslog, facility_name, syslog.LOG_USER)
syslog.openlog(NAME, 0, facility)

For more details, see the DEFAULT_SYSLOG_FACILITY configuration option.

_ansible_version

This argument passes the version of Ansible to the module. To access it, a module should instantiate the AnsibleModule method and then retrieve the version from AnsibleModule.ansible_version. This replaces ansible.module_utils.basic.ANSIBLE_VERSION from Module Replacer framework.

_ansible_module_name

Type: str

This argument passes the information to modules about their name. For more details see, the configuration option DEFAULT_MODULE_NAME.

_ansible_string_conversion_action

This argument provides instructions about what modules should do after the values of the user-specified module parameters are converted to strings. For more details, see the STRING_CONVERSION_ACTION configuration option.

_ansible_keep_remote_files

Type: bool

This argument provides instructions that modules must be ready if they need to keep the remote files. For more details, see the DEFAULT_KEEP_REMOTE_FILES configuration option.

_ansible_socket

This argument provides modules with a socket for persistent connections. The argument is created using the PERSISTENT_CONTROL_PATH_DIR configuration option.

_ansible_shell_executable

Type: bool

This argument ensures that modules use the designated shell executable. For more details, see the ansible_shell_executable remote host environment parameter.

_ansible_tmpdir

Type: str

This argument provides instructions to modules that all commands must use the designated temporary directory, if created. The action plugin designs this temporary directory.

Modules can access this parameter by using the public tmpdir property. The tmpdir property will create a temporary directory if the action plugin did not set the parameter.

The directory name is generated randomly, and the the root of the directory is determined by one of these:

• DEFAULT_LOCAL_TMP

• remote_tmp

• system_tmpdirs

As a result, using the ansible.cfg configuration file to activate or customize this setting will not guarantee that you control the full value.

_ansible_remote_tmp

The module’s tmpdir property creates a randomized directory name in this directory if the action plugin did not set _ansible_tmpdir. For more details, see the remote_tmp parameter of the shell plugin.

Pipelining

Ansible can transfer a module to a remote machine in one of two ways:

• it can write out the module to a temporary file on the remote host and then use a second connection to the remote host to execute it with the interpreter that the module needs

• or it can use what’s known as pipelining to execute the module by piping it into the remote interpreter’s stdin.

Pipelining only works with modules written in Python at this time because Ansible only knows that Python supports this mode of operation. Supporting pipelining means that whatever format the module payload takes before being sent over the wire must be executable by Python through stdin.

Why pass args over stdin?

Passing arguments through stdin was chosen for the following reasons:

• When combined with ANSIBLE_PIPELINING, this keeps the module’s arguments from temporarily being saved onto disk on the remote machine. This makes it harder (but not impossible) for a malicious user on the remote machine to steal any sensitive information that may be present in the arguments.

• Command line arguments would be insecure as most systems allow unprivileged users to read the full commandline of a process.

• Environment variables are usually more secure than the commandline but some systems limit the total size of the environment. This could lead to truncation of the parameters if we hit that limit.

Argument spec

The argument_spec provided to AnsibleModule defines the supported arguments for a module, as well as their type, defaults and more.

Example argument_spec:

module = AnsibleModule(argument_spec=dict(
    top_level=dict(
        type='dict',
        options=dict(
            second_level=dict(
                default=True,
                type='bool',
            )
        )
    )
))

This section will discuss the behavioral attributes for arguments:

type:

type allows you to define the type of the value accepted for the argument. The default value for type is str. Possible values are:

• str

• list

• dict

• bool

• int

• float

• path

• raw

• jsonarg

• json

• bytes

• bits

The raw type, performs no type validation or type casting, and maintains the type of the passed value.

elements:

elements works in combination with type when type='list'. elements can then be defined as elements='int' or any other type, indicating that each element of the specified list should be of that type.

default:

The default option allows sets a default value for the argument for the scenario when the argument is not provided to the module. When not specified, the default value is None.

fallback:

fallback accepts a tuple where the first argument is a callable (function) that will be used to perform the lookup, based on the second argument. The second argument is a list of values to be accepted by the callable.

The most common callable used is env_fallback which will allow an argument to optionally use an environment variable when the argument is not supplied.

Example:

username=dict(fallback=(env_fallback, ['ANSIBLE_NET_USERNAME']))

choices:

choices accepts a list of choices that the argument will accept. The types of choices should match the type.

required:

required accepts a boolean, either True or False that indicates that the argument is required. When not specified, required defaults to False. This should not be used in combination with default.

no_log:

no_log accepts a boolean, either True or False, that indicates explicitly whether or not the argument value should be masked in logs and output.

Note

In the absence of no_log, if the parameter name appears to indicate that the argument value is a password or passphrase (such as “admin_password”), a warning will be shown and the value will be masked in logs but not output. To disable the warning and masking for parameters that do not contain sensitive information, set no_log to False.

aliases:

aliases accepts a list of alternative argument names for the argument, such as the case where the argument is name but the module accepts aliases=['pkg'] to allow pkg to be interchangeably with name. Use of aliases can make module interfaces confusing, so we recommend adding them only when necessary. If you are updating argument names to fix a typo or improve the interface, consider moving the old names to deprecated_aliases rather than keeping them around indefinitely.

options:

options implements the ability to create a sub-argument_spec, where the sub options of the top level argument are also validated using the attributes discussed in this section. The example at the top of this section demonstrates use of options. type or elements should be dict is this case.

apply_defaults:

apply_defaults works alongside options and allows the default of the sub-options to be applied even when the top-level argument is not supplied.

In the example of the argument_spec at the top of this section, it would allow module.params['top_level']['second_level'] to be defined, even if the user does not provide top_level when calling the module.

removed_in_version:

removed_in_version indicates which version of ansible-core or a collection a deprecated argument will be removed in. Mutually exclusive with removed_at_date, and must be used with removed_from_collection.

Example:

option = {
  'type': 'str',
  'removed_in_version': '2.0.0',
  'removed_from_collection': 'testns.testcol',
},

removed_at_date:

removed_at_date indicates that a deprecated argument will be removed in a minor ansible-core release or major collection release after this date. Mutually exclusive with removed_in_version, and must be used with removed_from_collection.

Example:

option = {
  'type': 'str',
  'removed_at_date': '2020-12-31',
  'removed_from_collection': 'testns.testcol',
},

removed_from_collection:

Specifies which collection (or ansible-core) deprecates this deprecated argument. Specify ansible.builtin for ansible-core, or the collection’s name (format foo.bar). Must be used with removed_in_version or removed_at_date.

deprecated_aliases:

Deprecates aliases of this argument. Must contain a list or tuple of dictionaries having some the following keys:

name:

The name of the alias to deprecate. (Required.)

version:

The version of ansible-core or the collection this alias will be removed in. Either version or date must be specified.

date:

The a date after which a minor release of ansible-core or a major collection release will no longer contain this alias.. Either version or date must be specified.

collection_name:

Specifies which collection (or ansible-core) deprecates this deprecated alias. Specify ansible.builtin for ansible-core, or the collection’s name (format foo.bar). Must be used with version or date.

Examples:

option = {
  'type': 'str',
  'aliases': ['foo', 'bar'],
  'deprecated_aliases': [
    {
      'name': 'foo',
      'version': '2.0.0',
      'collection_name': 'testns.testcol',
    },
    {
      'name': 'foo',
      'date': '2020-12-31',
      'collection_name': 'testns.testcol',
    },
  ],
},

mutually_exclusive:

If options is specified, mutually_exclusive refers to the sub-options described in options and behaves as in Dependencies between module options.

required_together:

If options is specified, required_together refers to the sub-options described in options and behaves as in Dependencies between module options.

required_one_of:

If options is specified, required_one_of refers to the sub-options described in options and behaves as in Dependencies between module options.

required_if:

If options is specified, required_if refers to the sub-options described in options and behaves as in Dependencies between module options.

required_by:

If options is specified, required_by refers to the sub-options described in options and behaves as in Dependencies between module options.

context:

New in version 2.17.

You can set the value of the context key to a dict of custom content. This allows you to provide additional context in the argument spec. The content provided is not validated or utilized by the core engine.

Example:

option = {
    'type': 'str',
    'context': {
        'disposition': '/properties/apiType',
    },
    'choices': ['http', 'soap'],
}

Dependencies between module options

The following are optional arguments for AnsibleModule():

module = AnsibleModule(
  argument_spec,
  mutually_exclusive=[
    ('path', 'content'),
  ],
  required_one_of=[
    ('path', 'content'),
  ],
)

mutually_exclusive:

Must be a sequence (list or tuple) of sequences of strings. Every sequence of strings is a list of option names which are mutually exclusive. If more than one options of a list are specified together, Ansible will fail the module with an error.

Example:

mutually_exclusive=[
  ('path', 'content'),
  ('repository_url', 'repository_filename'),
],

In this example, the options path and content must not specified at the same time. Also the options repository_url and repository_filename must not be specified at the same time. But specifying path and repository_url is accepted.

To ensure that precisely one of two (or more) options is specified, combine mutually_exclusive with required_one_of.

required_together:

Must be a sequence (list or tuple) of sequences of strings. Every sequence of strings is a list of option names which are must be specified together. If at least one of these options are specified, the other ones from the same sequence must all be present.

Example:

required_together=[
  ('file_path', 'file_hash'),
],

In this example, if one of the options file_path or file_hash is specified, Ansible will fail the module with an error if the other one is not specified.

required_one_of:

Must be a sequence (list or tuple) of sequences of strings. Every sequence of strings is a list of option names from which at least one must be specified. If none one of these options are specified, Ansible will fail module execution.

Example:

required_one_of=[
  ('path', 'content'),
],

In this example, at least one of path and content must be specified. If none are specified, execution will fail. Specifying both is explicitly allowed; to prevent this, combine required_one_of with mutually_exclusive.

required_if:

Must be a sequence of sequences. Every inner sequence describes one conditional dependency. Every sequence must have three or four values. The first two values are the option’s name and the option’s value which describes the condition. The further elements of the sequence are only needed if the option of that name has precisely this value.

If you want that all options in a list of option names are specified if the condition is met, use one of the following forms:

('option_name', option_value, ('option_a', 'option_b', ...)),
('option_name', option_value, ('option_a', 'option_b', ...), False),

If you want that at least one option of a list of option names is specified if the condition is met, use the following form:

('option_name', option_value, ('option_a', 'option_b', ...), True),

Example:

required_if=[
  ('state', 'present', ('path', 'content'), True),
  ('force', True, ('force_reason', 'force_code')),
],

In this example, if the user specifies state=present, at least one of the options path and content must be supplied (or both). To make sure that precisely one can be specified, combine required_if with mutually_exclusive.

On the other hand, if force (a boolean parameter) is set to true, yes and so on, both force_reason and force_code must be specified.

required_by:

Must be a dictionary mapping option names to sequences of option names. If the option name in a dictionary key is specified, the option names it maps to must all also be specified. Note that instead of a sequence of option names, you can also specify one single option name.

Example:

required_by={
  'force': 'force_reason',
  'path': ('mode', 'owner', 'group'),
},

In the example, if force is specified, force_reason must also be specified. Also, if path is specified, then three three options mode, owner and group also must be specified.

Declaring check mode support

To declare that a module supports check mode, supply supports_check_mode=True to the AnsibleModule() call:

module = AnsibleModule(argument_spec, supports_check_mode=True)

The module can determine whether it is called in check mode by checking the boolean value module.check_mode. If it evaluates to True, the module must take care not to do any modification.

If supports_check_mode=False is specified, which is the default value, the module will exit in check mode with skipped=True and message remote module (<insert module name here>) does not support check mode.

Adding file options

To declare that a module should add support for all common file options, supply add_file_common_args=True to the AnsibleModule() call:

module = AnsibleModule(argument_spec, add_file_common_args=True)

You can find a list of all file options here. It is recommended that you make your DOCUMENTATION extend the doc fragment ansible.builtin.files (see Documentation fragments) in this case, to make sure that all these fields are correctly documented.

The helper functions module.load_file_common_arguments() and module.set_fs_attributes_if_different() can be used to handle these arguments for you:

argument_spec = {
  'path': {
    'type': 'str',
    'required': True,
  },
}

module = AnsibleModule(argument_spec, add_file_common_args=True)
changed = False

# TODO do something with module.params['path'], like update its contents

# Ensure that module.params['path'] satisfies the file options supplied by the user
file_args = module.load_file_common_arguments(module.params)
changed = module.set_fs_attributes_if_different(file_args, changed)

module.exit_json(changed=changed)