Ansible lists a nice set of best practices in its documentation. One of the items is:
Always mention the state
For many modules, the
stateparameter is optional. Different modules have different default settings for
state, and some modules support several
statesettings. Explicitly setting
state=absentmakes playbooks and roles clearer.
In my case the main point isn't so much about making playbooks or roles clearer, instead my goal is to manage the presence/absence of items throughout the lifetime of my servers.
Probably many of you have had the issue of installing package
xyz as a "bread'n'butter" package on your machines, but a few months later it turns out your workflow has changed and you don't really need
xyz anymore. Or it was replaced by
xyz-ng ... or what have you ...
So now it's time to express somehow to remove that
xyz package consistently across your infrastructure. In my case with Debian/Ubuntu I'd use the
apt module with
state=absent for the respective packages. No surprise.
However, I'd like to factor this into my roles from the outset. As an example it would be nice to have a dictionary variable (as an example):
packages: present: - elinks absent: - lynx
This way the presence and absence would dynamically be managed by variables and I can use
when: to cover for an empty list and so on; potentially even by including a task dynamically and passing along a
state variable that coincides with the key in the dictionary.
Another case where this must have come up for someone before is the creation of local users, or has everyone moved to directory services? When someone leaves the company I'd like to be able to put that someone on a list populated with usernames to be put into a locked state.
However, since there are established best practices for Ansible in general, I was wondering:
Q: are there best practices about managing the state of "entities" on the configured infrastructure?