aoh

commit 7b5fe4525007459fc669eebca930150b1c1635f3
parent dcd377e4e807aa48d9c7054ac4fc87b65c56ad99
Author: Asher Morgan <asher@ashermorgan.net>
Date:   Thu, 10 Sep 2026 17:35:06 -0700

Implement playbook limit option

Diffstat:
M
README.md
 | 
5
+++++
M
aoh/playbook.py
 | 
11
+++++++++++
M
aoh/runner.py
 | 
1
+
M
aoh/security.py
 | 
1
-
M
demo/playbooks.yml
 | 
5
+++++

5 files changed, 22 insertions(+), 1 deletion(-)
diff --git a/README.md b/README.md
@@ -100,6 +100,11 @@ main.yml: # The playbook name
     - group1
     - group2
 
+  # Whether to restrict play execution to the AoH client using
+  # ansible-playbook's --limit option. If enabled, the --limit option must not
+  # be present in allow_opts or extra_args. Defaults to true.
+  limit: true
+
   # Whether to require a password to execute the playbook. Passwords must be
   # specified separately in the $AOH_PASSWORDS_FILE file (see below). Defaults
   # to false.
diff --git a/aoh/playbook.py b/aoh/playbook.py
@@ -20,6 +20,7 @@ class Playbook:
             'config': str,
             'host': str,
             'groups': list,
+            'limit': bool,
             'password': bool,
             'output': bool,
             'allow_opts': list,
@@ -43,6 +44,7 @@ class Playbook:
         self.config = dict.get('config', None)
         self.host = dict.get('host')
         self.groups = dict.get('groups', [])
+        self.limit = dict.get('limit', True)
         self.password = dict.get('password', False)
         self.output = dict.get('output', True)
         self.allow_opts = dict.get('allow_opts', [])
@@ -55,6 +57,15 @@ class Playbook:
         self.config = os.path.abspath(os.path.join(_PLAYBOOKS_DIR, self.config))
 
 
+        if self.limit:
+            if '--limit' in self.allow_opts or '-l' in self.allow_opts:
+                raise PlaybookError('allow_opts cannot contain "--limit" if '
+                                    'limit is true')
+            if '--limit' in self.extra_args or '-l' in self.extra_args:
+                raise PlaybookError('extra_args cannot contain "--limit" if '
+                                    'limit is true')
+
+
 def get_playbook(name):
     """Lookup a playbook configuration."""
 
diff --git a/aoh/runner.py b/aoh/runner.py
@@ -137,6 +137,7 @@ class Runner:
             ident=self.id,
             envvars=env,
             cmdline=cmdline,
+            limit=self.playbook.host if self.playbook.limit else None,
             passwords=pw_prompt_answers,
             playbook=self.playbook.path,
             finished_callback=_finished_callback,
diff --git a/aoh/security.py b/aoh/security.py
@@ -11,7 +11,6 @@ _CLI_OPT_WHITELIST = [
     '--ask-vault-password', '--ask-vault-pass', '-J',
     '--check', '-C',
     '--diff', '-D',
-    '--limit', '-l',
     '--list-tags',
     '--skip-tags',
     '--start-at-task',
diff --git a/demo/playbooks.yml b/demo/playbooks.yml
@@ -18,6 +18,11 @@ main.yml: # The playbook name
     - group1
     - group2
 
+  # Whether to restrict play execution to the AoH client using
+  # ansible-playbook's --limit option. If enabled, the --limit option must not
+  # be present in allow_opts or extra_args. Defaults to true.
+  limit: true
+
   # Whether to require a password to execute the playbook. Passwords must be
   # specified separately in the $AOH_PASSWORDS_FILE file (see below). Defaults
   # to false.