Aborting, target uses selinux but python bindings (libselinux-python) aren't installed

The problem

When running Ansible in a Python virtual environment. Or when running molecule --debug test, you encounter the following error:

Aborting, target uses selinux but python bindings (libselinux-python) aren't installed!

The investigation

There are a couple of possible root causes for this:

1. Maybe the error is right, and that libselinux-python is not installed. 

2. Python libraries for selinux are not available in a Python virtual environment.

The solution

To make sure libselinux-python is installed on Fedora:

sudo dnf install -y libselinux-python

To make sure libselinux-python is installed on CentOS/Fedora:
sudo yum install -y libselinux-python

Imaging you have a virtual environment called ansible26, you first need to activate that virtual environment and then copy the Python libraries for selinux over:

workon ansible26

cp -r /usr/lib64/python2.7/site-packages/selinux $VIRTUAL_ENVv/lib/python2.7/site-packages

cp /usr/lib64/python2.7/site-packages/_selinux.so $VIRTUAL_ENVv/lib/python2.7/site-packages

Please note that workon is a command from https://virtualenvwrapper.readthedocs.io/ and if you haven't installed virtualenvwrapper, you would rather navigate to your virtual environment directory, and then run source bin/activate

Credits to https://github.com/metacloud/molecule/issues/1209 where I found this solution.

Using Azure Service Principal login with Ansible

The problem

When using the Azure REST API from Ansible using the uri module you need to ensure you are authenticated towards Azure. The easiest way to do that is to set a Bearer token based on a Service Principal user on Azure. 

This is the official Azure REST API documentation: https://docs.microsoft.com/en-us/rest/api/azure/

This is how you can create a service principal:

https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal

When you have created an Azure service principal you will have 4 necessary pieces of information:

• Tenant id (the protected resource)
• Client id (username)
• Client secret (password)
• Subscription id (you already had that from your user profile)

Make sure to save those values to an Ansible Vault. In my example I have called them:

• vault_az_tenant_id
• vault_az_client_id
• vault_az_client_secret
• vault_az_subscription_id

The solution

Create a playbook.yml with the following information:

---

- hosts: localhost

  vars:

    az_tenant_id: "{{ vault_az_tenant_id }}"

    az_client_id: "{{ vault_az_client_id }}"

    az_client_secret: "{{ vault_az_client_secret }}"

    az_subscription_id: "{{ vault_az_subscription_id }}"

    az_token_url: "https://login.microsoftonline.com/{{ az_tenant_id }}/oauth2/token"

    az_token_body: >

        resource=https://management.core.windows.net/

        &client_id={{ az_client_id }}

        &grant_type=client_credentials

        &client_secret={{ az_client_secret }}

  tasks:

    - name: Login to Azure

      uri:

        url: "{{ az_token_url }}"

        method: POST

        body: "{{ az_token_body }}"

        headers:

          Content-Type: "application/x-www-form-urlencoded"

        status_code: 200

      register: login

    - name: Setting Bearer token as fact

      set_fact:

        az_bearer: "{{ login.json.access_token }}"

 

That is how easy it is to authenticate with Azure from the Ansible uri module. Thanks to Vivek to helping out with the az_token_body.

Now every time you us the Ansible uri module in the same playbook, you just need to add the Bearer token to the request header, like this:

- uri:

        url: "{{ whatever-azure-url }}"

        method: POST

        headers:

          Authorization: "Bearer {{ az_bearer }}"

Released my second role to Ansible Galaxy today

The ansible-role-tint2 is an Ansible role for installing the tint2 panel for Linux. Currently the role supports the following platforms (in alphabetic order):

• Arch Linux
• Debian sid
• Debian stretch
• Fedora 24
• Fedora 25 
• Ubuntu 16.04
• Ubuntu 16.10

The Ansible role can be found here: https://github.com/avnes/ansible-role-tint2
It has been released under the liberal MIT license.

While this Ansible role and this blog post of somewhat similar to my previous Ansible role, I used a much more flexible and portable test framework based on mulecule.

Released my first role to Ansible Galaxy today

The ansible-role-conky is an Ansible role for installing the conky monitoring overlay tool. Currently the role supports the following platforms (in alphabetic order):

• Arch Linux
• Debian sid
• Debian stretch
• Fedora 24
• Fedora 25 
• Ubuntu 16.04
• Ubuntu 16.10

The Ansible role can be found here: https://galaxy.ansible.com/avnes/ansible-role-conky/
It has been released under the liberal MIT license.