|
|
|
@ -424,84 +424,105 @@ specific variables with a particular linefeed style.
|
|
|
|
|
|
|
|
|
|
|
|
.. _ansible_tempfiles:
|
|
|
|
.. _ansible_tempfiles:
|
|
|
|
|
|
|
|
|
|
|
|
...
|
|
|
|
Temporary Files
|
|
|
|
|
|
|
|
~~~~~~~~~~~~~~~
|
|
|
|
Temporary Files
|
|
|
|
|
|
|
|
~~~~~~~~~~~~~~~
|
|
|
|
Temporary file handling in Ansible is tricky, and the precise behaviour varies
|
|
|
|
|
|
|
|
across major versions. A variety of temporary files and directories are
|
|
|
|
Temporary file handling in Ansible is incredibly tricky business, and the exact
|
|
|
|
created, depending on the operating mode:
|
|
|
|
behaviour varies across major releases.
|
|
|
|
|
|
|
|
|
|
|
|
In the best case when pipelining is enabled and no temporary uploads are
|
|
|
|
Ansible creates a variety of temporary files and directories depending on its
|
|
|
|
required, for each task Ansible will create one directory below a
|
|
|
|
operating mode.
|
|
|
|
system-supplied temporary directory returned by :func:`tempfile.mkdtemp`, owned
|
|
|
|
|
|
|
|
by the target account a new-style module will execute in.
|
|
|
|
In the best case when pipelining is enabled and no temporary uploads are
|
|
|
|
|
|
|
|
required, for each task Ansible will create one directory below a
|
|
|
|
In other cases depending on the task type, whether become is active, whether
|
|
|
|
system-supplied temporary directory returned by :func:`tempfile.mkdtemp`, owned
|
|
|
|
the target become user is privileged, whether the associated action plugin
|
|
|
|
by the target account a new-style module will execute in.
|
|
|
|
needs to upload files, and whether the associated module needs to store files,
|
|
|
|
|
|
|
|
Ansible may:
|
|
|
|
In other cases depending on the task type, whether become is active, whether
|
|
|
|
|
|
|
|
the target become user is privileged, whether the associated action plugin
|
|
|
|
* Create a directory owned by the SSH user either under ``remote_tmp``, or a
|
|
|
|
needs to upload files, and whether the associated module needs to store files,
|
|
|
|
system-default directory,
|
|
|
|
Ansible may:
|
|
|
|
* Upload action dependencies such as non-new style modules or rendered
|
|
|
|
|
|
|
|
templates to that directory via `sftp(1)`_ or `scp(1)`_.
|
|
|
|
* Create a directory owned by the SSH user either under ``remote_tmp``, or a
|
|
|
|
* Attempt to modify the directory's access control list to grant access to the
|
|
|
|
system-default directory,
|
|
|
|
target user using `setfacl(1) <https://linux.die.net/man/1/setfacl>`_,
|
|
|
|
* Upload action dependencies such as non-new style modules or rendered
|
|
|
|
requiring that tool to be installed and a supported filesystem to be in use,
|
|
|
|
templates to that directory via `sftp(1)`_ or `scp(1)`_.
|
|
|
|
or for the ``allow_world_readable_tmpfiles`` setting to be :data:`True`.
|
|
|
|
* Attempt to modify the directory's access control list to grant access to the
|
|
|
|
* Create a directory owned by the target user either under ``remote_tmp``, or
|
|
|
|
target user using `setfacl(1) <https://linux.die.net/man/1/setfacl>`_,
|
|
|
|
a system-default directory, if a new-style module needs a temporary directory
|
|
|
|
requiring that tool to be installed and a supported filesystem to be in use,
|
|
|
|
and one was not previously created for a supporting file earlier in the
|
|
|
|
or for the ``allow_world_readable_tmpfiles`` setting to be :data:`True`.
|
|
|
|
invocation.
|
|
|
|
* Create a directory owned by the target user either under ``remote_tmp``, or
|
|
|
|
|
|
|
|
a system-default directory, if a new-style module needs a temporary directory
|
|
|
|
In summary, for each task Ansible may create one or more of:
|
|
|
|
and one was not previously created for a supporting file earlier in the
|
|
|
|
|
|
|
|
invocation.
|
|
|
|
* ``~ssh_user/<remote_tmp>/...`` owned by the login user,
|
|
|
|
|
|
|
|
* ``$TMPDIR/ansible-tmp-...`` owned by the login user,
|
|
|
|
In summary, for each task Ansible may create one or more of:
|
|
|
|
* ``$TMPDIR/ansible-tmp-...`` owned by the login user with ACLs permitting
|
|
|
|
|
|
|
|
write access by the become user,
|
|
|
|
* ``~ssh_user/<remote_tmp>/...`` owned by the login user,
|
|
|
|
* ``~become_user/<remote_tmp>/...`` owned by the become user,
|
|
|
|
* ``$TMPDIR/ansible-tmp-...`` owned by the login user,
|
|
|
|
* ``$TMPDIR/ansible_<modname>_payload_.../`` owned by the become user,
|
|
|
|
* ``$TMPDIR/ansible-tmp-...`` owned by the login user with ACLs permitting
|
|
|
|
* ``$TMPDIR/ansible-module-tmp-.../`` owned by the become user.
|
|
|
|
write access by the become user,
|
|
|
|
|
|
|
|
* ``~become_user/<remote_tmp>/...`` owned by the become user,
|
|
|
|
|
|
|
|
* ``$TMPDIR/ansible_<modname>_payload_.../`` owned by the become user,
|
|
|
|
Mitogen for Ansible
|
|
|
|
* ``$TMPDIR/ansible-module-tmp-.../`` owned by the become user.
|
|
|
|
^^^^^^^^^^^^^^^^^^^
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
As Mitogen can execute new-style modules from RAM, and transfer files to target
|
|
|
|
Mitogen for Ansible
|
|
|
|
user accounts without first writing an intermediary file in any separate login
|
|
|
|
^^^^^^^^^^^^^^^^^^^
|
|
|
|
account, handling is relatively simplified.
|
|
|
|
|
|
|
|
|
|
|
|
Temporary h
|
|
|
|
Temporary directories must exist to maintain compatibility with Ansible, as
|
|
|
|
Temporary directory handling is fiddly and varies across major Ansible
|
|
|
|
many modules introspect :data:`sys.argv` to find a directory where they may
|
|
|
|
releases.
|
|
|
|
write files, however only one directory exists for the lifetime of each
|
|
|
|
|
|
|
|
interpreter, its location is consistent for each account, and it is always
|
|
|
|
|
|
|
|
privately owned by that account.
|
|
|
|
Temporary directories must exist to maintain compatibility with Ansible, as
|
|
|
|
|
|
|
|
many modules introspect :data:`sys.argv` to find a directory where they may
|
|
|
|
During startup, the persistent remote interpreter tries the paths below until
|
|
|
|
write files, however only one directory exists for the lifetime of each
|
|
|
|
one is found that is writeable and lives on a filesystem with ``noexec``
|
|
|
|
interpreter, its location is consistent for each target account, and it is
|
|
|
|
disabled:
|
|
|
|
always privately owned by that account.
|
|
|
|
|
|
|
|
|
|
|
|
1. ``$variable`` and tilde-expanded ``remote_tmp`` setting from
|
|
|
|
The paths below are tried until one is found that is writeable and lives on a
|
|
|
|
``ansible.cfg``
|
|
|
|
filesystem with ``noexec`` disabled:
|
|
|
|
2. ``$variable`` and tilde-expanded ``system_tmpdirs`` setting from
|
|
|
|
|
|
|
|
``ansible.cfg``
|
|
|
|
1. ``$variable`` and tilde-expanded ``remote_tmp`` setting from
|
|
|
|
3. ``TMPDIR`` environment variable
|
|
|
|
``ansible.cfg``
|
|
|
|
4. ``TEMP`` environment variable
|
|
|
|
2. ``$variable`` and tilde-expanded ``system_tmpdirs`` setting from
|
|
|
|
5. ``TMP`` environment variable
|
|
|
|
``ansible.cfg``
|
|
|
|
6. ``/tmp``
|
|
|
|
3. ``TMPDIR`` environment variable
|
|
|
|
7. ``/var/tmp``
|
|
|
|
4. ``TEMP`` environment variable
|
|
|
|
8. ``/usr/tmp``
|
|
|
|
5. ``TMP`` environment variable
|
|
|
|
9. Current working directory
|
|
|
|
6. ``/tmp``
|
|
|
|
|
|
|
|
7. ``/var/tmp``
|
|
|
|
The directory is created at startup and recursively destroyed during interpeter
|
|
|
|
8. ``/usr/tmp``
|
|
|
|
shutdown. Subdirectories are automatically created and destroyed by the
|
|
|
|
9. Current working directory
|
|
|
|
controller for each task that requires them.
|
|
|
|
|
|
|
|
|
|
|
|
The directory is created once at startup, and subdirectories are automatically
|
|
|
|
|
|
|
|
created and destroyed for every new task. Management of subdirectories happens
|
|
|
|
Round-trip Avoidance
|
|
|
|
on the controller, but management of the parent directory happens entirely on
|
|
|
|
^^^^^^^^^^^^^^^^^^^^
|
|
|
|
the target.
|
|
|
|
|
|
|
|
|
|
|
|
Mitogen avoids many round-trips due to temporary file handling that are present
|
|
|
|
|
|
|
|
in regular Ansible:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* During task startup, it is not necessary to wait until the target has
|
|
|
|
|
|
|
|
succeeded in creating a temporary directory. Instead, any failed attempt to
|
|
|
|
|
|
|
|
create the directory will cause any subsequent RPC belonging to the same task
|
|
|
|
|
|
|
|
to fail with the error that occurred.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* As temporary directories are privately owned by the target user account,
|
|
|
|
|
|
|
|
operations relating to modifying the directory to support cross-account
|
|
|
|
|
|
|
|
access are avoided.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* An explicit work-around is included to avoid the `copy` and `template`
|
|
|
|
|
|
|
|
actions needlessly triggering a round-trip to set their temporary file as
|
|
|
|
|
|
|
|
executable.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* During task shutdown, it is not necessary to wait to learn if the target has
|
|
|
|
|
|
|
|
succeeded in deleting a temporary directory, since any error that may occur
|
|
|
|
|
|
|
|
can is logged asynchronously via the logging framework, and the persistent
|
|
|
|
|
|
|
|
remote interpreter arranges for all subdirectories to be destroyed during
|
|
|
|
|
|
|
|
interpreter shutdown.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
.. _ansible_process_env:
|
|
|
|
.. _ansible_process_env:
|
|
|
|
|
David Wilson
7 years ago