How can I set an Ansible variable whose value won't be known until after running the playlist?

Question

I'm working on an Ansible script to set up a new TeamCity build agent, and there's one part of the process that I don't know how to automate. After installing a TeamCity build agent, it must be authorized by an admin, who logs into the build server and clicks the "Authorize" button next to the build agent. This creates an authorization token, which is then saved in the agent's buildAgent.properties file. What I'd like to do is extract that token and save it in the host variables for that build agent, so that if I re-run the Ansible script, the right authorization token will be copied over and the agent will not need to be re-authorized.

I could easily do this manually: after the admin logs in and authorizes the agent, I could copy the authorization key out of the agent's buildAgent.properties file, put it in host_vars/(agent name)/buildagent.yml, and be done. But is there a way to do this automatically? Any manual step is a step that has to be documented, and that someone might forget to do -- that's why we use Ansible in the first place.

I found the set_fact module that looked promising at first, but it says "These variables will survive between plays during an Ansible run, but will not be saved across executions even if you use a fact cache." (Emphasis mine). Fact caching and registered variables also don't seem to be quite what I'm looking for.

Maybe I could have an Ansible task that rewrites host_vars/(agent name)/buildagent.yml on the Ansible host machine -- I suppose that could work. But that seems rather kludgy. Is there an "official" way to set host variables for future playbook runs, which I just haven't found? Or am I just going to have to accept a single manual step in my process here?

The solution is always going to be a bit kludgy, because Ansible's config is supposed to be the sole effective source of truth. Reading agent properties is a fair workaround, but Ansible should be able to restore your setup even if the hard drive explodes. After you've read the token from the file, you could use delegate_to: localhost to verify that the token is known and correct, and if not to add an easily-edited fix to your inventory or host_vars for human review, and then explode noisily, so it's obvious someone needs to fix and commit - since Ansible never normally updates its config. — Tim Baverstock, Nov 02 '22 at 22:37

score 1 · Answer 1 · answered Apr 26 '16 at 05:06

You could always just read the authorization token from the file live, and fail if it isn't set.

- name: Read authorization token
  command: "grep authorizationToken .../buildAgent.properties | cut -f 2 -d ="
  register: result
  failed_when: result.stdout == ""

- name: Set authorization token fact
  set_fact: authorization_token="{{result.stdout}}"

How can I set an Ansible variable whose value won't be known until after running the playlist?

1 Answers1