RHEL System Roles and Ansible Vault: Linux and Red Hat (RHCSA to RHCE) (Expert)

RHEL System Roles

Writing a correct role for time sync or SELinux across RHEL 7, 8, 9 and 10 is hard work. Red Hat ships tested roles that do it, with one consistent interface. You do not write tasks; you set the role's variables and include it.

bash

# dnf install -y rhel-system-roles
$ ls /usr/share/ansible/roles/ | head -5
linux-system-roles.certificate
linux-system-roles.firewall
...
rhel-system-roles.timesync
$ ls /usr/share/doc/rhel-system-roles/timesync/
example-timesync-playbook.yml  README.md  ...

Each role has a README and example playbooks under /usr/share/doc/rhel-system-roles/. The same roles are also in the collection redhat.rhel_system_roles.

yaml

- name: Time sync for all servers
  hosts: all
  become: true
  vars:
    timesync_ntp_servers:
      - hostname: ntp1.example.com
        iburst: true
      - hostname: ntp2.example.com
        iburst: true
  roles:
    - redhat.rhel_system_roles.timesync

You can also write the role name as rhel-system-roles.timesync.

yaml

- name: SELinux settings with the system role
  hosts: webservers
  become: true
  vars:
    selinux_state: enforcing
    selinux_policy: targeted
    selinux_booleans:
      - { name: httpd_can_network_connect_db, state: on, persistent: true }
    selinux_fcontexts:
      - { target: '/web(/.*)?', setype: httpd_sys_content_t, state: present }
    selinux_restore_dirs:
      - /web
    selinux_ports:
      - { ports: '82', proto: tcp, setype: http_port_t, state: present }
  roles:
    - redhat.rhel_system_roles.selinux

Everything from the SELinux module of this course, as data. Check the README for the exact variable names in your version.

Other useful system roles: network, storage (LVM and file systems), firewall, kdump, sshd, logging, metrics, crypto_policies, podman. Exam tasks often say "use the RHEL system role X to do Y"; the README and examples on the machine are your reference.

Ansible Vault: secrets in the open

Playbooks need secrets: database passwords, API tokens, user password hashes. Putting them in plain YAML in Git is a serious leak. Ansible Vault encrypts a file (or a single string) with AES-256. The encrypted file can be committed safely; only someone with the vault password can read it.

bash

$ ansible-vault create secrets.yml          # opens your editor; saved encrypted
New Vault password:
Confirm New Vault password:
$ cat secrets.yml | head -2
$ANSIBLE_VAULT;1.1;AES256
62313365396662343061393464336163383764373764613633653634306231386433626436623361
$ ansible-vault view secrets.yml
$ ansible-vault edit secrets.yml
$ ansible-vault encrypt old-plain.yml       # encrypt an existing file
$ ansible-vault decrypt secrets.yml         # back to plain text (careful)
$ ansible-vault rekey secrets.yml           # change the vault password

yaml

# secrets.yml (shown decrypted)
db_password: "S3cure-Example-Only"
app_api_token: "replace-me"

# site.yml
- name: Database clients
  hosts: appservers
  become: true
  vars_files:
    - secrets.yml
  tasks:
    - name: App config with the password
      ansible.builtin.template:
        src: app.conf.j2
        dest: /etc/notes/app.conf
        mode: "0600"
      no_log: true

no_log: true stops Ansible printing the secret in its output and logs.

bash

$ ansible-playbook site.yml --ask-vault-pass
Vault password:
$ echo 'my-vault-password' > ~/.vault_pass && chmod 600 ~/.vault_pass
$ ansible-playbook site.yml --vault-password-file ~/.vault_pass

A password file is handy for automation; keep it OUT of Git (add it to .gitignore) and readable only by you. With ansible-navigator, interactive prompts may need extra options; check ansible-navigator --help.

Common mistakes

Committing the vault password file to Git next to the vault: that is like taping the key to the lock.
Running a playbook that uses a vault file without --ask-vault-pass or a password file: "Attempting to decrypt but no vault secrets found".
Printing secrets with debug, or letting a failing task print them. Use no_log: true on tasks that handle secrets.
Guessing System Role variable names. Copy them from the README in /usr/share/doc/rhel-system-roles/.

RHEL System Roles and Ansible Vault

Explanation