Configure Kernel Parameters in RedHat-like Linux systems - Ansible system role

How to automate the configuration of Kernel Parameters (sysctl, sysfs, and hugepages) in RedHat-like Linux systems using Linux System Role "linux-system-role.kernel_settings" from Ansible Galaxy.

January 13, 2022

Access the Complete Video Course and Learn Quick Ansible by 200+ Practical Lessons

#ansible #sysctl #module #linux #security #rhel #centos #fedora #ubuntu #debian #suse #kernel

How to Configure Kernel Parameters in RedHat-like Linux systems with Ansible using system role? I’m going to show you a live demo with some simple Ansible code. I’m Luca Berton and welcome to today’s episode of Ansible Pilot.

Ansible Configure Kernel Parameters in RedHat-like systems

linux-system-roles Fedora, Enterprise Linux & CentOS
rhel-system-roles package Red Hat Enterprise Linux

Today we’re talking about linux-system-role. This is a swiss army that you need to absolutely add to your IT knowledge. Currently, there are 21 roles to configure a lot of system properties. The roles are developed and tested for RedHat-like systems but the project might expand in the future. It’s available as a package named linux-system-role for Fedora, Enterprise Linux, and CentOS. In Red Hat Enterprise Linux is named rhel-system-roles and is available since RHEL 8. If you would like to know more about the available roles and jump immediately to the Ansible Galaxy page or the official website.

demo

Configure Kernel Parameters in RedHat-like Linux systems with Ansible System Role

code

---
- name: kernel_settings demo
  hosts: all
  become: true
  vars:
    kernel_settings_sysctrl:
      - name: fs.file-max
        value: 400000
      - name: kernel.threads-max
        value: 65536
    kernel_settings_sysfs:
      - name: /sys/class/net/lo/mtu
        value: 65000
    kernel_settings_transparent_hugepages: madvise
roles:
    - linux-system-roles.kernel_settings

execution

$ ansible-playbook -i inventory kernel_settings.yml
PLAY [kernel_settings demo] ***********************************************************************
TASK [Gathering Facts] ****************************************************************************
[DEPRECATION WARNING]: Distribution fedora 35 on host fedora.example.com should use
/usr/bin/python3, but is using /usr/bin/python for backward compatibility with prior Ansible
releases. A future Ansible release will default to using the discovered platform python for this
host. See https://docs.ansible.com/ansible/2.9/reference_appendices/interpreter_discovery.html for
more information. This feature will be removed in version 2.12. Deprecation warnings can be
disabled by setting deprecation_warnings=False in ansible.cfg.
ok: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : Set version specific variables] ************************
ok: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : Ensure required packages are installed] ****************
ok: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : Ensure required services are enabled and started] ******
ok: [fedora.example.com] => (item=tuned)
TASK [linux-system-roles.kernel_settings : Ensure kernel settings profile directory exists] *******
ok: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : Generate a configuration for kernel settings] **********
ok: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : Apply kernel settings] *********************************
changed: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : tuned apply settings] **********************************
changed: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : verify settings] ***************************************
included: /usr/share/linux-system-roles/kernel_settings/tasks/verify_settings.yml for fedora.example.com
TASK [linux-system-roles.kernel_settings : check that settings are applied correctly] *************
ok: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : get last verify results from log] **********************
skipping: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : report errors that are not bootloader errors] **********
skipping: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : notify user that reboot is needed to apply changes] ****
skipping: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : set the flag that reboot is needed to apply changes] ***
skipping: [fedora.example.com]
RUNNING HANDLER [linux-system-roles.kernel_settings : reboot the managed host to apply kernel_settings changes] ***
skipping: [fedora.example.com]
RUNNING HANDLER [linux-system-roles.kernel_settings : clear the kernel_settings_reboot_required flag] ***
skipping: [fedora.example.com]
PLAY RECAP ****************************************************************************************
fedora.example.com         : ok=10   changed=2    unreachable=0    failed=0    skipped=6    rescued=0    ignored=0
[devops@fedora ~]$

idempotency

$ ansible-playbook -i inventory kernel_settings.yml
PLAY [kernel_settings demo] ***********************************************************************
TASK [Gathering Facts] ****************************************************************************
[DEPRECATION WARNING]: Distribution fedora 35 on host fedora.example.com should use
/usr/bin/python3, but is using /usr/bin/python for backward compatibility with prior Ansible
releases. A future Ansible release will default to using the discovered platform python for this
host. See https://docs.ansible.com/ansible/2.9/reference_appendices/interpreter_discovery.html for
more information. This feature will be removed in version 2.12. Deprecation warnings can be
disabled by setting deprecation_warnings=False in ansible.cfg.
ok: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : Set version specific variables] ************************
ok: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : Ensure required packages are installed] ****************
ok: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : Ensure required services are enabled and started] ******
ok: [fedora.example.com] => (item=tuned)
TASK [linux-system-roles.kernel_settings : Ensure kernel settings profile directory exists] *******
ok: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : Generate a configuration for kernel settings] **********
ok: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : Apply kernel settings] *********************************
ok: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : tuned apply settings] **********************************
skipping: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : verify settings] ***************************************
skipping: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : notify user that reboot is needed to apply changes] ****
skipping: [fedora.example.com]
TASK [linux-system-roles.kernel_settings : set the flag that reboot is needed to apply changes] ***
skipping: [fedora.example.com]
PLAY RECAP ****************************************************************************************
fedora.example.com         : ok=7    changed=0    unreachable=0    failed=0    skipped=4    rescued=0    ignored=0
[devops@fedora ~]$

Verification

[devops@fedora ~]$ sysctl kernel.threads-max
kernel.threads-max = 7414
[devops@fedora ~]$ cat /sys/class/net/lo/mtu
65001
[devops@fedora ~]$ cat /sys/kernel/mm/transparent_hugepage/enabled
always [madvise] never
[devops@fedora ~]$

code with ❤️ in GitHub

Recap

Now you know how to Configure Kernel Parameters in RedHat-like systems with Ansible System Role. Subscribe to the YouTube channel, Medium, Website, Twitter, and Substack to not miss the next episode of the Ansible Pilot.