Support for executing job and adhoc commands on isolated Tower nodes (#6524)

awx/playbooks/check_isolated.yml

@@ -0,0 +1,28 @@
+---
+
+# The following variables will be set by the runner of this playbook:
+# src: /tmp/some/path/private_data_dir/
+# job_id: <pk>
+
+- hosts: all
+  gather_facts: false
+
+  tasks:
+
+    - name: copy artifacts from the isolated host
+      synchronize:
+        src: "{{src}}/artifacts/"
+        dest: "{{src}}/artifacts/"
+        mode: pull
+        recursive: yes
+
+    - name: check to see if the job is inactive
+      command: "systemctl is-active playbook@{{job_id}}.service"
+      register: is_active
+      failed_when: "is_active.rc == 0"
+
+    - shell: journalctl -u playbook@{{job_id}}.service --no-pager
+      register: systemctl_logs
+      ignore_errors: True
+
+    - local_action: copy content={{ systemctl_logs.stdout }} dest={{src}}/artifacts/systemctl_logs mode=0600

awx/playbooks/clean_isolated.yml

@@ -0,0 +1,18 @@
+---
+
+# The following variables will be set by the runner of this playbook:
+# private_dirs: ['/tmp/path/private_data_dir/', '/tmp//path/proot_temp_dir/']
+# job_id: <pk>
+
+- hosts: all
+  gather_facts: false
+
+  tasks:
+
+    - name: cancel the job
+      command: "systemctl stop playbook@{{job_id}}.service"
+      ignore_errors: yes
+
+    - name: remove build artifacts
+      file: path="{{item}}" state=absent
+      with_items: "{{private_dirs}}"

awx/playbooks/library/mkfifo.py

@@ -0,0 +1,24 @@
+import os
+import stat
+
+from ansible.module_utils.basic import AnsibleModule
+
+
+def main():
+    module = AnsibleModule(
+        argument_spec={
+            'path': {'required': True, 'type': 'str'},
+            'content': {'required': True, 'type': 'str'}
+        },
+        supports_check_mode=False
+    )
+
+    path = module.params['path']
+    os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)
+    with open(path, 'w') as fifo:
+        fifo.write(module.params['content'])
+    module.exit_json(dest=path, changed=True)
+
+
+if __name__ == '__main__':
+    main()

awx/playbooks/run_isolated.yml

@@ -0,0 +1,45 @@
+---
+
+# The following variables will be set by the runner of this playbook:
+# src: /tmp/some/path/private_data_dir
+# dest: /tmp/some/path/
+# proot_temp_dir: /tmp/some/path
+# job_id: <pk>
+
+- hosts: all
+  gather_facts: false
+  vars_prompt:
+    - prompt: "Secret"
+      name: "secret"
+
+  tasks:
+
+    - name: create a proot/bwrap temp dir (if necessary)
+      synchronize:
+        src: "{{proot_temp_dir}}"
+        dest: "/tmp"
+      when: proot_temp_dir is defined
+
+    - name: synchronize job environment with isolated host
+      synchronize:
+        copy_links: true
+        src: "{{src}}"
+        dest: "{{dest}}"
+
+    - name: create a directory for running jobs
+      file: path=/tmp/ansible_tower/jobs state=directory mode=0700
+
+    - name: create symlink keyed by job ID
+      file: src="{{src}}" dest="/tmp/ansible_tower/jobs/{{job_id}}" state=link
+
+    - name: create a named pipe for secret environment data
+      command: "mkfifo /tmp/ansible_tower/jobs/{{job_id}}/env"
+
+    - name: spawn the playbook
+      command: "systemctl start playbook@{{job_id}}.service"
+
+    - name: write the secret environment data
+      mkfifo:
+        content: "{{secret}}"
+        path: "/tmp/ansible_tower/jobs/{{job_id}}/env"
+      no_log: True