feat: add role fingerprint to system journal

richm · richm · commit 800953f9c4ae · 2026-04-17T16:14:25.000-06:00
Feature: Add role fingerprint to system journal as the first task in the role.

Reason: The journal is often exported to reporting systems making it easy to
tell if the role is being used, and when.

Result: Users can get information in their reporting and log aggregation systems
of role usage.
diff --git a/.sanity-ansible-ignore-2.10.txt b/.sanity-ansible-ignore-2.10.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/.sanity-ansible-ignore-2.11.txt b/.sanity-ansible-ignore-2.11.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/.sanity-ansible-ignore-2.12.txt b/.sanity-ansible-ignore-2.12.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/.sanity-ansible-ignore-2.13.txt b/.sanity-ansible-ignore-2.13.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/.sanity-ansible-ignore-2.14.txt b/.sanity-ansible-ignore-2.14.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/.sanity-ansible-ignore-2.15.txt b/.sanity-ansible-ignore-2.15.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/.sanity-ansible-ignore-2.16.txt b/.sanity-ansible-ignore-2.16.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/.sanity-ansible-ignore-2.17.txt b/.sanity-ansible-ignore-2.17.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/.sanity-ansible-ignore-2.18.txt b/.sanity-ansible-ignore-2.18.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/.sanity-ansible-ignore-2.19.txt b/.sanity-ansible-ignore-2.19.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/.sanity-ansible-ignore-2.20.txt b/.sanity-ansible-ignore-2.20.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/.sanity-ansible-ignore-2.21.txt b/.sanity-ansible-ignore-2.21.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/.sanity-ansible-ignore-2.22.txt b/.sanity-ansible-ignore-2.22.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/.sanity-ansible-ignore-2.9.txt b/.sanity-ansible-ignore-2.9.txt
@@ -5,3 +5,4 @@ plugins/modules/find_unused_disk.py validate-modules:missing-gplv3-license
 plugins/modules/lvm_gensym.py validate-modules:missing-gplv3-license
 plugins/modules/resolve_blockdev.py validate-modules:missing-gplv3-license
 tests/storage/scripts/generate_tests.py shebang!skip
+plugins/modules/sr_fingerprint.py validate-modules:missing-gplv3-license
diff --git a/library/sr_fingerprint.py b/library/sr_fingerprint.py
@@ -0,0 +1,88 @@
+#!/usr/bin/python
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: sr_fingerprint
+short_description: Write a message string to syslog
+description:
+    - Writes the given string to the system log using Python's C{syslog} library.
+    - Intended for role-internal or diagnostic use.
+author: Rich Megginson (@richm)
+options:
+    sr_message:
+        description: Text to record in syslog.
+        type: str
+        required: true
+"""
+
+EXAMPLES = """
+- name: Record a fingerprint message in syslog
+  sr_fingerprint:
+    sr_message: "system_role:ROLENAME"
+"""
+
+RETURN = r""" # """
+
+from ansible.module_utils.basic import AnsibleModule
+
+import datetime
+
+
+def _local_iso8601_no_microseconds():
+    """System local wall clock with local tz offset, ISO 8601, seconds only."""
+    try:
+        utc = datetime.timezone.utc
+    except AttributeError:
+        import time
+
+        return time.strftime("%Y-%m-%dT%H:%M:%S%z", time.localtime())
+    # Prefer the local clock interpreted in the system timezone (not UTC displayed).
+    now = datetime.datetime.now()
+    astimezone = getattr(now, "astimezone", None)
+    if astimezone is not None:
+        try:
+            return astimezone().replace(microsecond=0).isoformat()
+        except (OSError, TypeError, ValueError):
+            pass
+    return datetime.datetime.now(utc).astimezone().replace(microsecond=0).isoformat()
+
+
+def run_module():
+    module_args = dict(
+        sr_message=dict(type="str", required=True),
+    )
+
+    module = AnsibleModule(
+        argument_spec=module_args,
+        supports_check_mode=True,
+    )
+
+    log_message = "%s %s" % (
+        module.params["sr_message"],
+        _local_iso8601_no_microseconds(),
+    )
+
+    if module.check_mode:
+        module.exit_json(
+            changed=False,
+            message="Check mode: message not logged - [%s]" % log_message,
+        )
+
+    module.log(log_message)
+
+    # we don't actually change anything, so we're not changed - writing a log message
+    # is not considered a change
+    # also, we don't want to report changed every time the role runs
+    module.exit_json(changed=False)
+
+
+def main():
+    run_module()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tasks/main.yml b/tasks/main.yml
@@ -1,4 +1,8 @@
 ---
+- name: Record storage role fingerprint in syslog
+  sr_fingerprint:
+    sr_message: "system_role:storage ansible_version={{ ansible_version.full }}"
+
 - name: Set platform/version specific variables
   include_tasks: tasks/set_vars.yml
 
diff --git a/tests/tests_default.yml b/tests/tests_default.yml
@@ -4,3 +4,14 @@
   tasks:
     - name: Run the role
       include_tasks: tasks/run_role_with_clear_facts.yml
+
+    # look for the exact module invocation, not some other message that might contain the string
+    - name: Check system journal contains role fingerprint
+      shell: >-
+        set -eo pipefail;
+        journalctl --since "-1 hour" --no-pager |
+        grep "ansible-sr_fingerprint.*system_role:storage" |
+        grep -v ": Invoked with"
+      args:
+        executable: /bin/bash
+      changed_when: false
