Recently in ceph-ansible I've been playing around with adding an entry to an existing line, in a configuration file that isn't managed by Ansible.
In general you would want to use the template module to manage a configuration file, which would mean you can completely control the contents of the file.
This isn't suitable for some configuration files, for example
/etc/ssh/sshd_config, for which you don't want to carry a template file that can get out of date, and for which you generally don't want to make too many changes, and use the package defaults as set out by your distribution.
A simple example
There are some easy options, for example the
PermitEmptyPasswords setting in
/etc/ssh/sshd_config can only have 1 value, and be specified once.
You could adjust this by doing the following:
- name: Adjust PermitEmptyPasswords setting in /etc/ssh/sshd_config lineinfile: dest: /etc/ssh/sshd_config regexp: "^PermitEmptyPasswords" line: "PermitEmptyPasswords no"
This will look for a line starting with
PermitEmptyPasswords and replace it with
Note that this would add a new line if
#PermitEmptyPasswords existed as a line, since it's commented out and the line doesn't start with
We could adjust this to include looking for lines starting with a # by doing the following:
- name: Adjust PermitEmptyPasswords setting in /etc/ssh/sshd_config lineinfile: dest: /etc/ssh/sshd_config regexp: "^(#)?PermitEmptyPasswords" line: "PermitEmptyPasswords no"
Using Regular Expressions
At this point it gets a bit more complicated unless you are familiar with Regular Expressions! Ansible uses Python Regular Expresions and you can find out more by clicking the link.
The above regular expression says the line will match if the it starts with (
^) 0 or 1 repetitions (
?) of the
# character, followed by
PermitEmptyPasswords. In other words, if it starts with a
# followed by
PermitEmptyPasswords or just
PermitEmptyPasswords without a
If that regular expression is matched, replace the line with
PermitEmptyPasswords no. If the regular expression isn't matched the entry will be added to the end of the file.
If the line is exactly the same as what you are trying to add (
PermitEmptyPasswords no) then the line won't be added because the
lineinfile Ansible module will see it as no change.
How about multiple entries of the same value?
This is actually even easier! Since we don't care if other values of the setting have been specified, we can just ensure the line exists, for example:
- name: Add HostKey value to /etc/ssh/sshd_config lineinfile: dest: /etc/ssh/sshd_config line: "HostKey /path/to/my/host.key"
This will add the line entry if it doesn't exist.
This has a downside, your /etc/ssh/sshd_config will have a weird ordering, and you could get options all over the show, that aren't easy to view. We can fix that though, using the
- name: Add HostKey value to /etc/ssh/sshd_config in order lineinfile: dest: /etc/ssh/sshd_config line: "HostKey /path/to/my/host.key" insertafter: "^(#)?HostKey"
You'll recognize the regular expression from the last section, in this case we are using it with the
insertafter setting, which will mean our HostKey line is inserted into the file after the last entry that matches the regular expression. If the regular expression isn't matched it'll be added at the end of the file.
How about a setting that takes multiple values?
This is a bit trickier, and the crux of the article. I was playing around with it, and it occurred to me that this isn't that straight forward, especially if you are just starting out.
If you have a setting that takes multiple values in one line, for example the
PRUNEPATHS setting in /etc/updatedb.conf, which will contain a list of paths that are to be skipped when running
updatedb. When we update this line we don't want to replace the whole line, but what we want to do is ensure a specific entry is there, and update the line to include the entry if not (but not remove any existing entries!).
This is a bit trickier but can be done in 2 ways, using either the
lineinfile module as before, or the
- name: add /var/lib/ceph to PRUNEPATHS in /etc/updatedb.conf replace: dest: /etc/updatedb.conf regexp: '^(PRUNEPATHS(?!.*/var/lib/ceph).*)"$' replace: '\1 /var/lib/ceph"'
The regular expression here is a bit more complex, but what it says is, look for a line that starts with(
PRUNEPATHS, and isn't followed by (
?!) any character (
.) any number of times (
*), followed by
/var/lib/ceph, but is followed by any character (
.) any number of times (
*), followed by a
" character and the end of line (
This means if /var/lib/ceph exists in the
PRUNEPATHS line we won't replace the line, but if
PRUNEPATHS exists and doesn't have
/var/lib/ceph in it, it will match and initiate the replace.
The replace line says to take the matched text (
\1) and add
/var/lib/ceph" to it, and it's that simple!
Ok great, but what are the parenthesis for?
So what are all the parenthesis
) for, and is their placement important?
The parenthesis denote what will be matched - this is really important, in this example we don't want to match on the final
" otherwise we will end up with
/some/path" /var/lib/ceph" at the end of the line, which would cause problems.
So that means the line starts with (
^) and begins a match (
PRUNEPATHS that is NOT followed (
?!) by another match (
() that consists of any character (
.) any number of times (
*), followed by
/var/lib/ceph, which is the end of the match (
)) for what can't follow
PRUNEPATHS. The initial match, which started with
PRUNEPATHS will match if any character (
.) appears any number of times (
*), which ends the text to be matched (
)), and the line ends (
$) with a
" character, which isn't included in the match.
We are using the parenthesis to manipulate what is and isn't matched by the regular expression.
If we use the lineinfile module to do that there is one extra thing we need to do, and that's enable
backrefs, as follows:
- name: add /var/lib/ceph to PRUNEPATHS in /etc/updatedb.conf using lineinfile lineinfile: dest: /etc/updatedb.conf regexp: '^(PRUNEPATHS(?!.*/var/lib/ceph).*)"$' line: '\1 /var/lib/ceph"' backrefs: true
That's pretty much it! I personally like
replace, since it has
backrefs enabled by default, I think
lineinfile is more useful for multiple entries, and ensuring a specific line exists, but if you know the line exists and you want to change it,
replace works well!
Knowing your Regular Expressions is pretty much the only way to use
replace to their full potential, but once you get the hang of reading them and understanding what is going on, it isn't so frightening. Hopefully that helped!