Red Hat Enterprise Linux (RHEL) System Roles

Updated -

RHEL System Roles as a collection of Ansible roles and modules that provide a stable and consistent configuration interface to automate and manage multiple releases of Red Hat Enterprise Linux. The effort is based on development of the Linux System Roles upstream project. The following roles are provided and supported as follows:

Fully Supported in package rhel-system-roles.noarch Technology Preview
kdump postfix
network
selinux
storage
timesync
newly added in RHEL 8.3 to rhel-system-roles.noarch
certificate
kernel_settings
logging
metrics
nbde_client and nbde_server
tlog
in package rhel-system-roles-sap.noarch from RHEL for SAP offering
sap-hana-preconfigure
sap-netweaver-preconfigure
sap-preconfigure

Roles in Technology Preview status are tested as stable but the interface (role inputs) may receive future updates that could be incompatible with the current state. Additional Technology Preview content can be found in the upstream project and its respective project in Ansible Galaxy.

The RHEL System Roles are supported as provided from the following methods:
- As an RPM package in the RHEL 7 Extras repository
- As an RPM package in the RHEL 8 application Streams repository
- In the future, as a supported collection in the Red Hat Automation Hub

The RHEL System Roles can be used on any Ansible Automation Platform control node, such as Tower, or Red Hat Satellite. They can also be used locally on a managed node if the Ansible Engine is installed.

Note 1: The RHEL subscription provides support for the implementation of the RHEL System Roles and compatibility with Ansible Engine. The Ansible Engine repositories are made accessible as a convenience for the use of RHEL System Roles, as well as other layered products in the Red Hat product portfolio. However, the RHEL subscription does not include full support for Ansible Engine outside the scope of compatibility with the RHEL System Roles..

Note 2: A support subscription is required for all other use of Ansible Engine and Ansible Tower. Additional information can be found at Top Support Policies for Red Hat Ansible Automation.

Getting Started

Installing RHEL System Roles and Ansible

Perform the following steps to install RHEL System Roles and Red Hat Ansible Automation Platform. The rhel-system-roles and ansible RPM packages are provided in the RHEL Extras and Ansible Engine repositories, respectively.

1) Use subscription-manager to list the Ansible Engine repositories available. Note that the generic "2" repository will always provide the latest release of the 2.X stream as opposed to configuring a more specific version such as 2.8.
NOTE: The newest Ansible Engine version is recommended even when running on a RHEL 7 control node when managing RHEL 8 managed nodes to properly handle the transition to python3.

~~~
# subscription-manager refresh
# subscription-manager  repos  --list  | grep ansible
~~~

2) To persistently enable the Ansible Engine repository using Red Hat Subscription Manager:

  • In RHEL 8

    # subscription-manager repos --enable ansible-2-for-rhel-8-x86_64-rpms
    
  • In RHEL 7

    # subscription-manager  repos --enable=rhel-7-server-extras-rpms --enable=rhel-7-server-ansible-2-rpms
    

3) Next, install RHEL System Roles and Ansible Engine packages:

~~~
# yum install  rhel-system-roles  ansible
~~~

Documentation

Additional information is provided in the Red Hat Enterprise Linux 8 documentation for Configuring basic system settings: 1.5. Getting started with RHEL System Roles.

By default, the rhel-system-roles package are installed to the following locations:

  • Documentation

    /usr/share/doc/rhel-system-roles-<version>/SUBSYSTEM/
    
  • Ansible Roles

     /usr/share/ansible/roles/rhel-system-roles.SUBSYSTEM/
    

Where SUBSYSTEM is the name of the subsystem that contains the individual role management.

Examples include: network, timesync, or other subsystems as they become supported. See RHEL System Roles Overview for more details. Each subsystem role will include a README file which documents how to use the role and supported parameter values, as well as the matching README in the linux-system-roles Ansible Galaxy landing space.

Example usage of the rhel-system-roles.network role

This example assumes the following

  • Generally, Ansible is not installed on every system, but rather on a single system designated as the Ansible management or control node whose purpose is to manage other systems via Ansible.
  • This example is executed from a RHEL 7.5 system used as the Ansible control node.
  • A target, or client test system with a hostname of rhel7.5-test
  • rhel7.5-test has a primary network interface to access (eth0), and a secondary interface for this example (eth1).
  • Either the rhel7.5-test FQDN or IP Address has been added to the Ansible Inventory file /etc/ansible/hosts on the control node.
  • The control node user ID running the test playbook has ssh access to, and sudo ability on rhel7.5-test. Alternatively, the -u option can be used to specify a user which does have this ability.
  • For further details, see the Ansible Getting Started or Quick Start Video at http://docs.ansible.com/ for further details on how to use Ansible.
  1. Using a text editor, create a file containing contents similar to the following:

    $ vim example-network-playbook.yml
    ---
    - hosts: rhel7.5-test
      vars:
        network_connections:
          - name: DBnic
            state: up
            type: ethernet
            interface_name: eth1
            autoconnect: yes
            ip:
              dhcp4: yes
              auto6: no
      roles:
        - role: rhel-system-roles.network
    
  2. Test that we have access to the machine. If not, refer to the Ansible documentation on how to enable Ansible to access a remote system.

    $ ansible -m ping rhel7.5-test
    rhel7.5-test | SUCCESS => {
        "changed": false, 
        "ping": "pong"
    }
    
  3. Query the Ansible Facts to see the guests network configuration.

    $ ansible rhel7.5-test -m setup -a 'gather_subset=network filter=ansible_interfaces' 
    
    rhel7.5-test | SUCCESS => {
        "ansible_facts": {
            "ansible_interfaces": [
                "lo", 
                "eth1", 
                "eth0"
            ]
        }, 
        "changed": false
    }
    
  4. Query the Ansible Facts to see the characteristics of eth1

    $ ansible rhel7.5-test -m setup -a 'gather_subset=network filter=ansible_eth1' 
    rhel7.5-test | SUCCESS => {
        "ansible_facts": {
            "ansible_eth1": {
                "active": true, 
                "device": "eth1", 
                "features": {
                    "busy_poll": "off [fixed]", 
                    "fcoe_mtu": "off [fixed]", 
                    "generic_receive_offload": "on", 
                    "generic_segmentation_offload": "on", 
                    "highdma": "on [fixed]", 
                    "hw_tc_offload": "off [fixed]", 
                    "l2_fwd_offload": "off [fixed]", 
                    "large_receive_offload": "off [fixed]", 
                    "loopback": "off [fixed]", 
                    "netns_local": "off [fixed]", 
                    "ntuple_filters": "off [fixed]", 
                    "receive_hashing": "off [fixed]", 
                    "rx_all": "off [fixed]", 
                    "rx_checksumming": "on [fixed]", 
                    "rx_fcs": "off [fixed]", 
                    "rx_vlan_filter": "on [fixed]", 
                    "rx_vlan_offload": "off [fixed]", 
                    "rx_vlan_stag_filter": "off [fixed]", 
                    "rx_vlan_stag_hw_parse": "off [fixed]", 
                    "scatter_gather": "on", 
                    "tcp_segmentation_offload": "on", 
                    "tx_checksum_fcoe_crc": "off [fixed]", 
                    "tx_checksum_ip_generic": "on", 
                    "tx_checksum_ipv4": "off [fixed]", 
                    "tx_checksum_ipv6": "off [fixed]", 
                    "tx_checksum_sctp": "off [fixed]", 
                    "tx_checksumming": "on", 
                    "tx_fcoe_segmentation": "off [fixed]", 
                    "tx_gre_segmentation": "off [fixed]", 
                    "tx_gso_robust": "off [fixed]", 
                    "tx_ipip_segmentation": "off [fixed]", 
                    "tx_lockless": "off [fixed]", 
                    "tx_mpls_segmentation": "off [fixed]", 
                    "tx_nocache_copy": "off", 
                    "tx_scatter_gather": "on", 
                    "tx_scatter_gather_fraglist": "off [fixed]", 
                    "tx_sctp_segmentation": "off [fixed]", 
                    "tx_sit_segmentation": "off [fixed]", 
                    "tx_tcp6_segmentation": "on", 
                    "tx_tcp_ecn_segmentation": "on", 
                    "tx_tcp_segmentation": "on", 
                    "tx_udp_tnl_segmentation": "off [fixed]", 
                    "tx_vlan_offload": "off [fixed]", 
                    "tx_vlan_stag_hw_insert": "off [fixed]", 
                    "udp_fragmentation_offload": "on", 
                    "vlan_challenged": "off [fixed]"
                }, 
                "macaddress": "52:54:00:e1:c2:4c", 
                "module": "virtio_net", 
                "mtu": 1500, 
                "pciid": "virtio4", 
                "promisc": false, 
                "type": "ether"
            }
        }, 
        "changed": false
    }
    
  5. Execute your example playbook. Note: You may safely ignore the warning message for now that the “wait for activation” feature is not yet implemented.

    $ ansible-playbook -l rhel7.5-test example-network-playbook.yml
    PLAY [rhel7.5-test] *********************************************************************
    
    TASK [Gathering Facts] *********************************************************
    ok: [rhel7.5-test]
    
    TASK [rhel-system-roles.network : Check which services are running] ************
    ok: [rhel7.5-test]
    
    TASK [rhel-system-roles.network : Check which packages are installed] **********
    ok: [rhel7.5-test]
    
    TASK [rhel-system-roles.network : Install packages] ****************************
    skipping: [rhel7.5-test]
    
    TASK [rhel-system-roles.network : Enable network service] **********************
    ok: [rhel7.5-test]
    
    TASK [rhel-system-roles.network : Print network provider] **********************
    ok: [rhel7.5-test] => {
        "msg": "Using network provider: nm"
    }
    
    TASK [rhel-system-roles.network : Configure networking connection profiles] ****
     [WARNING]: [003] <info>  #0, state:up persistent_state:present, 'DBnic': add
    connection DBnic, b62a7ea6-f1a4-408a-843e-ea292aa58b44
    
     [WARNING]: [004] <info>  #0, state:up persistent_state:present, 'DBnic': up
    connection DBnic, b62a7ea6-f1a4-408a-843e-ea292aa58b44 (is-modified)
    
    changed: [rhel7.5-test]
    
    TASK [rhel-system-roles.network : Re-test connectivity] ************************
    ok: [rhel7.5-test]
    
    PLAY RECAP *********************************************************************
    rhel7.5-test : ok=7    changed=1    unreachable=0    failed=0   
    
  6. Query again to see that eth1 is now online and has a IP Address assigned.

    $ ansible rhel7.5-test -m setup -a 'gather_subset=network filter=ansible_eth1' 
    
    rhel7.5-test | SUCCESS => {
        "ansible_facts": {
            "ansible_eth1": {
                "active": true, 
                "device": "eth1", 
                "features": {
                    "busy_poll": "off [fixed]", 
                    "fcoe_mtu": "off [fixed]", 
                    "generic_receive_offload": "on", 
                    "generic_segmentation_offload": "on", 
                    "highdma": "on [fixed]", 
                    "hw_tc_offload": "off [fixed]", 
                    "l2_fwd_offload": "off [fixed]", 
                    "large_receive_offload": "off [fixed]", 
                    "loopback": "off [fixed]", 
                    "netns_local": "off [fixed]", 
                    "ntuple_filters": "off [fixed]", 
                    "receive_hashing": "off [fixed]", 
                    "rx_all": "off [fixed]", 
                    "rx_checksumming": "on [fixed]", 
                    "rx_fcs": "off [fixed]", 
                    "rx_vlan_filter": "on [fixed]", 
                    "rx_vlan_offload": "off [fixed]", 
                    "rx_vlan_stag_filter": "off [fixed]", 
                    "rx_vlan_stag_hw_parse": "off [fixed]", 
                    "scatter_gather": "on", 
                    "tcp_segmentation_offload": "on", 
                    "tx_checksum_fcoe_crc": "off [fixed]", 
                    "tx_checksum_ip_generic": "on", 
                    "tx_checksum_ipv4": "off [fixed]", 
                    "tx_checksum_ipv6": "off [fixed]", 
                    "tx_checksum_sctp": "off [fixed]", 
                    "tx_checksumming": "on", 
                    "tx_fcoe_segmentation": "off [fixed]", 
                    "tx_gre_segmentation": "off [fixed]", 
                    "tx_gso_robust": "off [fixed]", 
                    "tx_ipip_segmentation": "off [fixed]", 
                    "tx_lockless": "off [fixed]", 
                    "tx_mpls_segmentation": "off [fixed]", 
                    "tx_nocache_copy": "off", 
                    "tx_scatter_gather": "on", 
                    "tx_scatter_gather_fraglist": "off [fixed]", 
                    "tx_sctp_segmentation": "off [fixed]", 
                    "tx_sit_segmentation": "off [fixed]", 
                    "tx_tcp6_segmentation": "on", 
                    "tx_tcp_ecn_segmentation": "on", 
                    "tx_tcp_segmentation": "on", 
                    "tx_udp_tnl_segmentation": "off [fixed]", 
                    "tx_vlan_offload": "off [fixed]", 
                    "tx_vlan_stag_hw_insert": "off [fixed]", 
                    "udp_fragmentation_offload": "on", 
                    "vlan_challenged": "off [fixed]"
                }, 
                "ipv4": {
                    "address": "192.168.122.216", 
                    "broadcast": "192.168.122.255", 
                    "netmask": "255.255.255.0", 
                    "network": "192.168.122.0"
                }, 
                "ipv6": [
                    {
                        "address": "fe80::5054:ff:fee1:c24c", 
                        "prefix": "64", 
                        "scope": "link"
                    }
                ], 
                "macaddress": "52:54:00:e1:c2:4c", 
                "module": "virtio_net", 
                "mtu": 1500, 
                "pciid": "virtio4", 
                "promisc": false, 
                "type": "ether"
            }
        }, 
        "changed": false
    }
    

More examples

The roles carry their own example playbooks under their respective documentation directories (see above).

10 Comments

This article needs an update as RHEL 7.4 is now out of beta and the rhel-server-roles packages are available in the following channel (not beta):

Red Hat Enterprise Linux 7 Server - Extras (RPMs)

The rhel-7-server-ansible-2-rpms contains all of the last 5 releases (currently 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4 and 2.5.0 releases, as of 2018 April). In most cases, the supporting packages are several releases behind what is available on extras and epel.

What is the value in maintaining all of these version specific channels? Administration should not need to know the release levels to enable, but rather select a general application set, and pick "latest", which is the entire point of ansible. This version specific channel idea is the exact opposite of what the product itself is intending to promote.

I'd like to see this article updated (or another separate article) for RHEL 8 (8.0 and above, not beta).

tried these:

subscription-manager repos --enable ansible-2.8-for-rhel-8-x86_64-rpms
subscription-manager repos --enable rhel-8-for-x86_64-supplementary-rpms

Yet neither of these provided the rpm ansible for rhel 8.

I did an rpm search as well, and easily found the rhel7 anisble rpm, but not the rhel8 ansible rpm.

RJ

I, too, would like to see this document updated.  But I have a quick question, R. Hinton:  Ansible 2.8 is the first version to run on RHEL 8, and it was not released until May 21st.  What happens, now, if you execute

subscription-manager repos --enable ansible-2.8-for-rhel-8-x86_64-rpms

(Or ansible-2-for-rhel-8-x86_64-rpms if you always want the latest 2.y version.)

I have updated this document to reflect the updates for RHEL 8 and Ansible Engine 2.8. Thank you for the feedback and apologies for the technical delay in release Ansible 2.8 a few weeks after RHEL 8.

I'm relatively new to Ansible and Ansible Tower. How do I use the rhel-system-roles from Ansible Tower?

Hello Colin, Yes, with either Tower or Satellite installed on top of RHEL, you can simply install the rhel-system-roles package. Then you can execute them from playbooks just like any other role.

yum install rhel-system-roles

Can you tell me where "rhel-7-workstation-ansible-2-rpms" might be found, if it even exists? What if I want to run Ansible (2.9.13 for example) on my workstation, rather than a server?

Hello Ben,

There is no workstation variant, so just use the Server repo version which should be available to the Workstation subscription. If you have any trouble with this, you can open a support case for further assistance.

#  subscription-manager repos  --enable=rhel-7-server-ansible-2-rpms

I would like to use the system roles in azure, however the ansible repository is not accessible there: https://bugzilla.redhat.com/show_bug.cgi?id=1870674 Could you please clarify internally that this is part of the rhel subscription?