Hi,
Azure (HyperV) is providing a device that can be used to time synchronization. We would like to incorporate this into our configuration.

refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0
https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync#chrony

It would be nice if this role could automatically detect these devices and use them or at least provide a parameter for usage.

Greetings
Klaas

The role doesn't check the value of the iburst option, only that it exists. Adding "iburst: no" to a server enables the iburst.

We started to use the role in a private cloud and we are using a single server that connect to externals ntp servers for synchronization while other are offline.

We would like to use it as an NTP server and client at the same time.
From what I read we need to use the configuration allow https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/sect-understanding_chrony_and-its_configuration

We should add a new variable to handle this in timesync/templates/chrony.conf.j2, for example:

timesync_allow_network:
  - ip_net: 127.0.1.0/24

Which would result in the vars like this:

{% if timesync_allow_network is defined %}
{% for value in timesync_allow_network %}
{{ 'allow' if 'ip_net' in value and value['ip_net'] }} {{value['ip_net'] }}
{% endfor %}
{% endif %}

Resulting in in the configuration as follow :

allow 127.0.1.0/24

vim timesynchro.yml

• hosts: all
  vars:
  timesync_ntp_servers:
  - hostname: 10.26.xx.xx
  iburst: yes
  roles:
  • rhel-system-roles.timesync

Hey,

Brand new to Ansible so sorry if this is just me being dumb but trying to run this and getting the following error:

TASK [linux-system-roles.timesync : Generate chronyd sysconfig file] ***************************************************************************************************************************************
fatal: [192.168.0.129]: FAILED! => {"changed": false, "checksum": "c86b9165a42f39a42071825554f79870abaee593", "msg": "Destination directory /etc/sysconfig does not exist"}

This is just using the example configuration from the readme.

- hosts: servers
  vars:
    timesync_ntp_servers:
      - hostname: 0.europe.pool.ntp.org
        iburst: yes
      - hostname: 1.europe.pool.ntp.org
        iburst: yes
      - hostname: 2.europe.pool.ntp.org
        iburst: yes
  roles:
    - linux-system-roles.timesync

Have I done something wrong here?

All path below
/etc/chrony# ls -la
total 20
drwxr-xr-x 4 root root 75 May 25 08:49 .
drwxr-xr-x 105 root root 8192 Jul 17 12:47 ..
-rw-r--r-- 1 root root 2232 Feb 8 2022 chrony.conf
-rw-r----- 1 root root 481 Feb 8 2022 chrony.keys
drwxr-xr-x 2 root root 20 May 25 08:49 conf.d
drwxr-xr-x 2 root root 20 May 25 08:49 sources.d

Hi linux-system-roles community

While volunteering at my local community radio station rabe I found myself writing a smallish wrapper role to to the linux-system-roles/timesync role to automate our deploy on a FreeIPA based domain.

Similar to what ipa-client-install does I found the DNS SRV records to be a handy way to get to the needed information. At the core of my PoC role is the following:

- name: "Find ntp servers in SRV records"
  set_fact: 
    rabe_ntp_servers: "{{ lookup('dig', '_ntp._udp.' + rabe_int_domain + './SRV', 'flat=0') | json_query('[*].target') }}"

- name: "Format dns results for linux-system-roles.timesync"
  set_fact:
    rabe_lsr_timesync_ntp_servers: "{{rabe_lsr_timesync_ntp_servers|default([]) + [ {'hostname': item, 'iburst':true} ] }}"
  with_items: "{{ rabe_ntp_servers }}"

- name: "Configure ntp using galaxy role and variables from dns"
  include_role:
    name: linux-system-roles.timesync
  vars:
    ntp_servers: "{{ rabe_lsr_timesync_ntp_servers }}"

After having implemented that I started thinking of adding full discovery based on ansible_fqdn by doing a lookup on the _kerberos TXT record to form the actual lookup.

Would this be a feature that you would welcome in a pull request? I was thinking that the feature would off by default but easily activated by using an ipa=true var.

I'm not sure if PTP is relevant to this case. I am planning our own PTP rollout but it seems to have it's own discovery protocols that are semi standardized. Any input on howto PTP are gladly appreciated and I'd add what's needed to an eventual IPA support PR.

I'd like to add this feature to your upstream repo. Let me know if you're ok with that and I'll refactor my code intro something PR worthy.

Thanks for coding what seems to be the most complete timesync module in the galaxy 😜
Lucas

From the logs:

TASK [Run pmc] *********************************************************************************************************************************************************************************************
task path: /tmp/tmpm7q5012t/tests/tests_ptp_multi.yml:42
changed: [/home/till/lsr-test-harness-files/cache/rhel-guest-image-8.0-1854.x86_64.qcow2] => {"changed": true, "cmd": ["pmc", "-u", "-b", "0", "-d", "0", "-s", "/var/run/timemaster/ptp4l.0.socket", "GET DOMAIN"], "delta": "0:00:00.104295", "end": "2019-05-25 05:47:21.447882", "rc": 0, "start": "2019-05-25 05:47:21.343587", "stderr": "", "stderr_lines": [], "stdout": "sending: GET DOMAIN", "stdout_lines": ["sending: GET DOMAIN"]}

TASK [Check PTP domain] ************************************************************************************************************************************************************************************
task path: /tmp/tmpm7q5012t/tests/tests_ptp_multi.yml:46
fatal: [/home/till/lsr-test-harness-files/cache/rhel-guest-image-8.0-1854.x86_64.qcow2]: FAILED! => {
    "assertion": "'domainNumber 0' in pmc.stdout",
    "changed": false,
    "evaluated_to": false,
    "msg": "Assertion failed"
}

I am playing with this module for the first time - still slightly inexperienced with ansible but following the instructions and hitting a wall generating ntp.conf

TASK [linux-system-roles.timesync : Generate ntp.conf file] ********************************************
fatal: [tumbleweed-x]: FAILED! => {"changed": false, "msg": "AnsibleFilterError: Version comparison: 'dict object' has no attribute 'stdout'"}

I am trying to get the basics to work and then looking at modifying this role/module to incorporate settings for timekeeper. - I am also looking for options to use this on SLES if possible.

Hello,

at the template files you are using # {{ ansible_managed }}.
In the Ansible documentation is described how to distribute ansible_managed to several lines for better readability.

It can be done by {{ ansible_managed | comment }}.

Could you please adapt the template files from # {{ ansible_managed }} to {{ ansible_managed | comment }}?

Thank you very much.

Best regards

The timesync role places the chrony.conf into /etc for each OS. Ubuntu (DEBIAN) expects the config in the /etc/chrony/ directory. Should be handled inside /tasks/main.yml as os specific variable.

- name: Generate chrony.conf file
  template:
    src: chrony.conf.j2
    dest: /etc/chrony.conf
    backup: true
    mode: 0644
  notify: restart {{ 'chronyd' if timesync_mode == 1 else 'timemaster' }}
  when:
    - timesync_mode != 2
    - timesync_ntp_provider == 'chrony'
    - "'chrony' in ansible_facts.packages"

noselect is a valid option for server & pool entries for both chronyd and ntpd. It has usefulness when you want to have a reference clock available but not utilized as a synchronization option such as in a tightly controlled network. It would be a boolean value, much the same as pool or nts.

Ansible Galaxy gives timesync a quality score of 2.5/5 solely because of whitespace warnings in tests. The import page says:

===== LINTING ROLE =====
 yamllint Warnings:
 ./tests/tests_default.yml:1:1: [error] too many blank lines (1 > 0) (empty-lines)
 ./tests/tests_ntp.yml:1:1: [error] too many blank lines (1 > 0) (empty-lines)
 ./tests/tests_ntp_provider1.yml:1:1: [error] too many blank lines (1 > 0) (empty-lines)
 ./tests/tests_ntp_provider2.yml:1:1: [error] too many blank lines (1 > 0) (empty-lines)
 ./tests/tests_ntp_provider3.yml:1:1: [error] too many blank lines (1 > 0) (empty-lines)
 ./tests/tests_ntp_provider4.yml:1:1: [error] too many blank lines (1 > 0) (empty-lines)
 ./tests/tests_ntp_provider5.yml:1:1: [error] too many blank lines (1 > 0) (empty-lines)
 ./tests/tests_ntp_provider6.yml:1:1: [error] too many blank lines (1 > 0) (empty-lines)
 ./tests/tests_ntp_ptp.yml:1:1: [error] too many blank lines (1 > 0) (empty-lines)
 ./tests/tests_ptp_multi.yml:1:1: [error] too many blank lines (1 > 0) (empty-lines)
 ./tests/tests_ptp_single.yml:1:1: [error] too many blank lines (1 > 0) (empty-lines)

Tests are not checked by Molecule which otherwise does a yamllint pass over the role, so this did not get caught.

I am using Ubuntu and in the task Get chrony version get the following error:

package chrony is not installed

The role uses chkconfig https://github.com/linux-system-roles/timesync/blob/master/tasks/setup/RedHat_6.yml and systemctl list-unit-files https://github.com/linux-system-roles/timesync/blob/master/tasks/setup/default.yml to get a list of services on the system. Instead, the role should use https://docs.ansible.com/ansible/latest/modules/service_facts_module.html if possible. @pavel-z1 fyi @pcahyna @mlichvar

#92 has the logic in the template to consider various versions of chrony and operating system and platform. This should be refactored into vars/ files.

Have vars/Fedora.yml like this:

timesync_can_use_dhcp_ntp_servers: "{{ 'yes' if __timesync_chrony_version is version('4.0', '>=') else 'no' }}"

Then for the fedora platforms that do not support it e.g. vars/Fedora_32.yml, vars/Fedora_31.yml (don't need to go back before that as Fedora 30 is EOL):

timesync_can_use_dhcp_ntp_servers: no

create vars/RedHat.yml like this:

timesync_can_use_dhcp_ntp_servers: no

Also add that to vars/RedHat_6.yml and vars/CentOS_6.yml

Then create vars/RedHat_9.yml and vars/CentOS_9.yml like Fedora.yml:

timesync_can_use_dhcp_ntp_servers: "{{ 'yes' if __timesync_chrony_version is version('4.0', '>=') else 'no' }}"

Then the logic in templates/chrony.conf.j2 can be simplified like this:

{% if timesync_dhcp_ntp_servers and timesync_can_use_dhcp_ntp_servers %}
# Use NTP servers from DHCP.
sourcedir /run/chrony-dhcp

{% endif %}

Hello,

When applying the timesync role on fedora35 it tries to disable ntpd and it failed because it is not installed.

somehow it failed to check that ntpd was not installed.

ansible and collections versions

ansible [core 2.12.0]
  config file = /home/rob/code/playbooks/ansible.cfg
  configured module search path = ['/home/rob/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/rob/code/playbooks/venv/lib64/python3.10/site-packages/ansible
  ansible collection location = /home/rob/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/rob/code/playbooks/venv/bin/ansible
  python version = 3.10.0 (default, Oct  4 2021, 00:00:00) [GCC 11.2.1 20210728 (Red Hat 11.2.1-1)]
  jinja version = 3.0.2
  libyaml = True

ansible-galaxy collection list                                                                             127   master 

# /home/rob/.ansible/collections/ansible_collections
Collection                Version
------------------------- -------
RobVerduijn.lab           0.1.2  
ansible.netcommon         2.4.0  
ansible.posix             1.3.0  
ansible.utils             2.4.2  
ansible.windows           1.8.0  
community.crypto          2.0.0  
community.general         4.0.1  
community.libvirt         1.0.2  
community.windows         1.8.0  
fedora.linux_system_roles 1.10.1 
freeipa.ansible_freeipa   0.4.2  
theforeman.foreman        3.0.0  
theforeman.operations     0.3.0

I consider configuring a timezone to be part of making sure the system displays the correct time.

Do you guys agree? If so, I can make a PR that will implement it :-)

The following warning is displayed at several places if I turn the warnings on:

[DEPRECATION WARNING]: Using tests as filters is deprecated. Instead of using result|version_compare use result is version_compare. This feature will be
removed in version 2.9. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.

I suppose that is a fairly simple fix.

Followup to #27 .

We fixed failures in check mode some time ago and now the role does not fail if executed in check mode after having been executed in normal mode. There is still a problem though when the role is executed in check mode on a fresh system (without having been applied in normal mode before), because it assumes that some packages are installed, and in check mode they do not get installed. This is the case described in ansible/molecule#128 (comment) (note that the current Molecule setup does not test for it, as explained in that link).
The change submitted by @hhaniel in #27 (comment) should fix this case as well.
Test playbook:

- name: Ensure that the role runs with default parameters
  hosts: all
  roles:
    - name: timesync
      vars:
        timesync_ntp_provider: ntp

error:

TASK [timesync : Get ntp version] **********************************************
fatal: [/home/pcahyna/linux-system-roles-testing/local/CentOS-7-x86_64-GenericCloud-1702.qcow2c]: FAILED! => {"changed": false, "cmd": ["rpm", "-q", "--qf", "%{version}", "ntp"], "delta": "0:00:00.033978", "end": "2019-09-30 14:53:22.430978", "msg": "non-zero return code", "rc": 1, "start": "2019-09-30 14:53:22.397000", "stderr": "", "stderr_lines": [], "stdout": "package ntp is not installed", "stdout_lines": ["package ntp is not installed"]}

PLAY RECAP *********************************************************************
/home/pcahyna/linux-system-roles-testing/local/CentOS-7-x86_64-GenericCloud-1702.qcow2c : ok=3 changed=1 unreachable=0 failed=1 skipped=9 rescued=0 ignored=0

I'm not 100% sure if this is the correct repo to report this issue to. If I need to be directed somewhere else, please let me know.

On the timesync Galaxy page README (https://galaxy.ansible.com/linux-system-roles/timesync), I believe there's a typo at the bottom of the example playbook reference.

Specifically, here:

  roles:
    - timesync

When I execute this playbook using the preceding role definition, I get an error saying that timesync is not a valid role. However, the playbook correctly executes when defining it like this:

  roles:
    - linux-system-roles.timesync

I think timesync needs to be switched to linux-system-roles.timesync. Thanks! :)

See the CI results on #3. Note that the PR did not change anything relevant AFAICT and it merely triggered a test run. The error is "No package matching 'linuxptp' found available, installed or updated". The same error was already noted in the last comment on #1.

Surprisingly, the tests pass for CentOS 7.

meta: end_play aborts the play on all host, not just the current one: ansible/ansible#27973, which would be a problem if someone tried to test multiple images in parallel. Also I am not sure what variables are used for the conditional...

systemd-timesyncd offers very basic NTP time synchronization support, but is often times sufficient. Is there a reason why this Ansible system role does not support it? If not, is there an interest to receive a pull request for this? Has it maybe been tried before and should I be aware of any caveats? I couldn't find any closed issues on the topic.

The 'prefer' keyword is a standard config setting for ntp and chrony applications, and is commonly in use (in my experience). I don't see in the documentation here or downstream for rhel-system-roles that the 'prefer' keyword is supported. I've specified in vars 'prefer: true' and applied the role, but it does not configure the keyword in my targets chrony.conf (I was testing if this was an undocumented feature).

It would be helpful to add support for this standard and seemingly somewhat simple parameter.

Thanks for your consideration.

See the CI results on #3 . Note that the PR did not change anything relevant AFAICT and it merely triggered a test run. The error is "no package matching 'chrony' found available, installed or updated".

Surprisingly, the tests pass for CentOS 6.

As part of the conscious language project, the master branch is to be renamed to the main branch.

Here are the instructions.

1. Rename the master branch to main: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch
2. Check this to ensure the default branch has been changed to main: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/changing-the-default-branch - this should keep the github history, as well as updating the default branch configuration and updating any existing PRs

If you use the gh cli (highly recommended) you can use this to check which repos need to be updated:

gh repo list linux-system-roles -L 100 --json name,defaultBranchRef --source | \
  jq --raw-output '.[] | select(.defaultBranchRef.name == "master") | .name'

Thanks.

See https://travis-ci.com/vcrhonek/timesync/builds/107422467

--> Executing Ansible Lint on /home/travis/build/vcrhonek/timesync/tests/tests_default.yml...
[204] Lines should be no longer than 160 chars
/home/travis/build/vcrhonek/timesync/tests/roles/linux-system-roles.timesync/tasks/main.yml:11
when: timesync_mode is not defined and (timesync_ntp_servers|length == 0) and timesync_ptp_domains|length == 1 and timesync_ptp_domains[0].interfaces|length == 1

[602] Don't compare to empty string
/home/travis/build/vcrhonek/timesync/tests/roles/linux-system-roles.timesync/tasks/main.yml:20
  when: timesync_mode != 2 and (timesync_ntp_provider is not defined or timesync_ntp_provider == '')

[602] Don't compare to empty string
/home/travis/build/vcrhonek/timesync/tests/roles/linux-system-roles.timesync/tasks/main.yml:24
    timesync_ntp_provider: "{{ timesync_ntp_provider_os_default if timesync_ntp_provider_current == '' else timesync_ntp_provider_current }}"

[602] Don't compare to empty string
/home/travis/build/vcrhonek/timesync/tests/roles/linux-system-roles.timesync/tasks/main.yml:25
  when: timesync_mode != 2 and (timesync_ntp_provider is not defined or timesync_ntp_provider == '')

Should we begin looking at adding support for NTS as it is planned to be added to Fedora 33? https://fedoraproject.org/wiki/Changes/NetworkTimeSecurity