Ansible-pan with Ansible Tower and Git

[bgburns01]

We are using Ansible Tower 3.5 and Ansible 2.8 to schedule and run network and security automation playbooks. We are looking at using the Ansible Galaxy modules for automating PANOS configurations. I was able to write the playbooks to do what we need, but whenever I run the playbook with the ansible-pan modules, the main task runs PIP to install pan-python, pandevice, xmltodict everytime we execute the PAN-OS automation playbook. We also use GIT as a repository and version control of the playbooks, so Tower pulls the playbooks directly from the GIT server. When I install the Ansible Galaxy modules, the modules install in the same path as the playbook, and then the install the latest pan-python, pandevice, xmltodict. Since we are using GIT to store the playbooks, these modules will update everytime after Tower pulls the GIT repo. Tower releases the local copy of the repo when the task has completed.

Is there a way I can install the Ansible Galaxy roles to a different path or a global path, and is there any way I can avoid running PIP install every time I run the ansible-pan module?

Thanks,

Brian Burns

[rhagen]

Hi Brian,

The pip installs of pan-python, pandevice, and xmltodict are actually called from the main tasks file in the role itself. I don’t believe there’s anything you can do in your Tower configuration to avoid it. 

We’re likely going to remove those tasks going forward since most of the modules check to ensure those libraries are installed and will error out if they’re not found. 

Regards,

-Bob

[hbalzac]

Is this still the behavior? It will install the mentioned modules evrytime i run a playbook?

(I dont have access to a ansible installation to test with atm)

[gfreeman]

The Ansible role (here) has entered maintenance mode as Ansible is pushing non-core modules into the new collections framework.  As such, the Palo Alto Networks Ansible collection does not have this same behavior.