Ansible load epel and yum update

Question

trying to add epel and then do a yum update via ansible on a amazon-linux-2 server. The URL im using based on : https://aws.amazon.com/premiumsupport/knowledge-center/ec2-enable-epel/

My ansible script is:

---
- hosts: all
  remote_user: cloud_user

  tasks:

  - name: 01 add epel
    yum_repository:
      name: epel
      description: EPEL YUM repo
      baseurl: https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
    become: yes

  - name: 02 yum update 
    yum: name=* state=latest
    become: yes

and my error is on task 02 is (task 01 has a "changed" notice):

     FAILED! => {"changed": false, "msg": "https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm/repodata/repomd.xml: 
[Errno 14] HTTPS Error 404 - Not Found\nTrying other mirror.\n\n\n One of the configured repositories failed (EPEL YUM repo),\n and yum doesn't have enough cached data to continue. At this point the only\n safe thing yum can do is fail. There are a few ways to work \"fix\" this:\n\n     
1. Contact the upstream for the repository and get them to fix the problem.\n\n     
2. Reconfigure the baseurl/etc. for the repository, to point to a working\n        upstream. This is most often useful if you are using a newer\n        distribution release than is supported by the repository (and the\n        packages for the previous distribution release still work).\n\n     
3. Run the command with the repository temporarily disabled\n            yum --disablerepo=epel ...\n\n     
4. Disable the repository permanently, so yum won't use it by default. Yum\n        
will then just ignore the repository until you permanently enable it\n        again or use --enablerepo for temporary usage:\n\n            
yum-config-manager --disable epel\n        
or\n            
subscription-manager repos --disable=epel\n\n     
5. Configure the failing repository to be skipped, if it is unavailable.\n        Note that yum will try to contact the repo. when it runs most commands,\n        
so will have to try and fail each time (and thus. yum will be be much\n        
slower). If it is a very temporary problem though, this is often a nice\n        
compromise:\n\n            yum-config-manager --save --setopt=epel.skip_if_unavailable=true\n\nfailure: repodata/repomd.xml from epel:
 [Errno 256] No more mirrors to try.\nhttps://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm/repodata/repomd.xml: 
[Errno 14] HTTPS Error 404 - Not Found\n", "rc": 1, "results": []}

Any guidance,or help would be great.

Answer 1

https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm is not a yum repository, it is a yum package.

As you can see it in the documentation you are linking, they do a yum install of it:

sudo yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

Then they enable it via the command yum-config-manager

sudo yum-config-manager --enable epel

On the other hand, https://dl.fedoraproject.org/pub/epel/$releasever/$basearch/ is a yum repository URL.

So your first task should be

- name: 01 add epel
    yum_repository:
      name: epel
      description: EPEL YUM repo
      baseurl: https://dl.fedoraproject.org/pub/epel/$releasever/$basearch/
    become: yes

Your error actually shows it:

https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm/repodata/repomd.xml

See how it is trying to fetch a folder repodata and a file repomd.xml?

Now if you browse https://dl.fedoraproject.org/pub/epel/ and you look under the folder 7 for example, and then under any subfolder, you will find that exact repodata folder and that exact repomd.xml file.

Note: extra info on the variables $releasever and $basearch can be found: following this link

Also since your knowledge article instruct you to use the version 7 (see the 7 in epel-release-latest-7.noarch.rpm), what you can do is to pass it as an attribute to your yum task.

- name: 02 yum update 
  yum: 
    name: '*' 
    state: latest
    releasever: 7
  become: yes

Note: I also changed your syntax, I would say it is a bad idea to mix the attribute=value and the YAML syntax in the same playbook.

Answer 2

To have EPEL installed it is enough to just install the epel-release package from the base repo. Also, considering it is recommended not to use shell or command modules wherever possible, we may enable the repo through a direct update of its config file. So I would suggest the following:

- name: Install EPEL repository
  yum:
    name: epel-release
    state: present

- name: Ensure EPEL repo is enabled
  ini_file:
    dest: /etc/yum.repos.d/epel.repo
    section: epel
    option: enabled
    value: '1'

- name: Conduct yum update 
  yum: 
    name: * 
    state: latest
    become: True
    update_cache: True

Answer 3

Thanks for all the input. Not sure if its a amazon-linux-2 thing but the only one i got working was to use a galaxy role, code is below:

  roles:
    - role: geerlingguy.repo-epel
      vars:
        epel_repo_url: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm"
        epel_repo_gpg_key_url: "/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7"
      become: yes