boston vmug usercon - run your first ansible playbook tomorrow
Post on 28-Jan-2018
198 Views
Preview:
TRANSCRIPT
Ansible
From zero to running you 1st playbook tomorrow!
Jonathan Frappier
Senior Technical Consultant, Dell EMC
Education
@jfrappier | @commitmas | @vbrownabag
/in/jonathanfrappier
github.com/jfrappier
github.com/commitmas
jfrap.com
vbrownbag.com
Disclaimer*
Always assume:
• When I say how awesome something is what I really mean “In most cases” that thing is awesome
• Here is one way you could do it, there are many others
• I can’t draw 7 red lines all perpendicular with red, green, or transparent ink
Why Ansible?
Also…
Your career
Get your bosses to buy in! http://www.cio.com/article/3197670/application-development/why-ansible-has-
become-the-devops-darling.html
Use cases
Think of a thing you did by hand this week…
Use cases
Think of a thing you did by hand this week…
THAT is probably a good use case!
Use cases
• Created, delete, manage and VMware VM
• Created, started, stopped an EC2 instance
• Archived log files
• Installed Apache
• Setup an ACL on a Cisco ASA firewall
• Verify server configuration is in a desired state or put it in the desired
state
Example - What can Ansible do for you?
Deploy VM’s:
e.g. vsphere_guest, ec2, azure, gce
Apply and enforce configurations
e.g. yum, apt-get, postgresql_db, win_iis_website
Backup files, databases
e.g. copy, mysql_db state=dump
Deploy software
e.g. git, subversion, hg
Control machine setup
Ubuntu – sudo apt-get install software-properties-common
sudo apt-add-repository ppa:ansible/ansible
sudo apt-get update
sudo apt-get install ansible
CentOS – sudo yum install epel
sudo yum install ansible
Source – git clone git://github.com/ansible/ansible.git –recursive
cd ./Ansible
source ./hacking/env-setup
git pull --rebaseRequires Python 2.7
https://docs.ansible.com/ansible/intro_installation.html
Connecting to hosts
Ansible connects to hosts using SSH or WinRM
SSH Key – Key based authentication
Password – append --ask-pass
and --ask-become-pass
Windows – PowerShell and WinRM
A few hosts pre-reqs
Linux
Python – at least 2.5, no issue with modern distributions
SSH – SSH/Port 22 must be open from the control machine to the host (agentless and all)
SSH Keys – Ensure user account used by Ansible has SSH keys added from control-machine to all hosts
User account – Account used by Ansible has correct permissions on hosts (e.g. sudo for installs)
Windows
PowerShell – 3.0 or higher
WinRM – Enabled/Port 5986 must be open from the control machine to the host
User account – Account used by Ansible has correct permissions on hosts
Inventory
Located in /etc/ansible/hosts - can be as simple as you want/need it to be
127.0.0.1
~
~
~
~
~
~
~
~
~
~
~
~
Inventory
Awesome as you wanna be…
127.0.0.1
[dev-web]
10.1.1.1
10.1.1.2
10.1.1.3
[prod-web]
10.3.1.[1:10] ansible_connectin=ssh ansible_port=2222 ansible_user=prodgod
[web:children]
prod-web
dev-web
Inventory
Dynamic Inventory
Facts
Stuff about your managed hosts
• OS – build, family
• Hardware info – processor, memory
Refer to facts in playbooks
Gather facts anytime by running ansible hostname –m setup
How do I do stuff
Core – Ansible supported
Curated – Ansible and Red Hat partner supported
Community – Community contributed
Playbooks, plays, and tasks
---
- hosts: sysdig
tasks:
- name: install sysdig
apt: name=sysdig state=present
Playbooks, plays, and tasks
---
- hosts: sysdig
vars:
package: sysdig
tasks:
- name: install sysdig
become: true
become_user: appgod
apt: name={{ package }} state=present
notify:
- start-sysdig
handlers
- name: start-sysdig
service:
name: sysdig
state: started
Running a playbook
[ansible@control-machine ~]# ansible-playbook sysdig.yml
Running a playbook
[ansible@control-machine ~]# ansible-playbook sysdig.yml
PLAY [all] ******************************************************************
TASK [Validating download directory] ****************************************
ok: [default]
TASK [Install Sysdig] *******************************************************
changed: [default]
PLAY RECAP ******************************************************************
default: ok=1 changed=1 unreachable=0 failed=0
Handy playbook options
--ask-pass – prompts for a password to connect to the specified host(s), used when not using SSH keys
--ask-become-pass – Use when sudo is required to run the playbook/command
--check – Checks the playbook to see if it will work, but doesn’t execute on the remote host (or –C)
--module-name – specific the module you want to run for ad-hoc commands (or –m)
--module-path – path to the module if required (or –M)
--tree – path to log output (or –t)
--verbose – more output from the playbook run (or –v)
--limit – limit the playbook run to a specific host/group (or –l)
---
- hosts: sysdig
vars:
package: sysdig
sysdig_key_url: https://s3.amazonaws.com/download.draios.com
sysdig_key: DRAIOS-GPG-KEY.public
sysdig_url: https://s3.amazonaws.com/download.draios.com/stable/install-sysdig
dl_dir: /downloads
sysdig_ins: install-sysdig
sysdig_repo: http://download.draios.com/stable/deb stable-$(ARCH)/
linux_headers: linux-headers-{{ ansible_kernel }}
remote_user: sshgod
become_method: sudo
become: yes
tasks:
- name: Validating download directory
file: path={{ dl_dir }} state=directory
- name: Download Sysdig public key
get_url: url={{ sysdig_key_url }}/{{ sysdig_key }} dest={{ dl_dir }} validate_certs=no
- name: Installing Sysdig public key
apt_key: file={{ dl_dir }}/{{ sysdig_key }} state=present
- name: Adding Sysdig apt repository
apt_repository: repo='deb {{ sysdig_repo }}' state=present
- name: Update apt repositories
apt: update_cache=yes
- name: Install Linux Headers
apt: name={{ linux_headers }} state=present
- name: Install Sysdig
apt: name={{ package }} state=present
Roles
Example playbook for a role
---
- hosts: web
become: yes
roles:
- sensu
Example playbook for a role
---
- hosts: web
become: yes
roles:
- sensu
- web
- openssl
- nginx
Example main task
---
# tasks file for ansible-gocd
- include: debian-srv.yml
when: ansible_os_family == "Debian"
- include: redhat-srv.yml
when: ansible_os_family == "RedHat"
Roles
Running a role
[ansible@control-machine ~]# ansible-playbook sensu.yml
Vault
• Stuff about vault
Shell Module
• Don’t just convert existing bash scripts with
the shell module
• Use native modules whenever possible
• There isn’t always a module, that’s when you
use shell
Got APIs?
uri (not University of Rhode Island)
# Create a JIRA issue
- uri:
url: https://your.jira.example.com/rest/api/2/issue/
method: POST
user: your_username
password: your_password
body: "{{ lookup('file','issue.json') }}”
force_basic_auth: yes
status_code: 201
body_format: json
# Check that a page returns a status 200 and fail
if the word AWESOME is not in the page
contents.
- action:
uri url=http://www.example.com
return_content=yes
register: webpage
- action: fail
when: "'AWESOME' not in webpage.content"
Using vSphere 6.5 REST APIs with Ansible
---
- hosts: localhost
become: no
tasks:
- name: vcenter login
uri:
url: https://cloudvc.student.lab/rest/com/vmware/cis/session
force_basic_auth: yes
method: POST
user: administrator@vsphere.local
password: P@ssw0rd
status_code: 200
validate_certs: no
register: login
- name: disable ssh
uri:
url: https://cloudvc.student.lab/rest/appliance/access/ssh
force_basic_auth: yes
method: PUT
body_format: json
body: "{{ lookup('file','sshoff.json') }}"
validate_certs: no
headers:
Cookie: "{{login.set_cookie}}"
Using vSphere 6.5 REST APIs with Ansible Links
Getting Started with the vSphere Automation SDK for REST by Kyle Ruddy
https://blogs.vmware.com/code/2017/02/02/getting-started-vsphere-automation-sdk-rest/
Ansible uri module documentation
https://docs.ansible.com/ansible/uri_module.html
Shameless blog post and examples
https://jfrap.com/vsphere-65-api-ansible/
https://github.com/jfrappier/vSphere-6.5-API-Playbook-Examples
Simple
Ansible can be useful using just two files (though you can do a lot more as well)
Inventory (hosts file) – List of all hosts for Ansible to
manage
Playbook – List of commands processed in order (no
guessing) for the specified hosts
Easy to backup
All you need is love… no wait wrong presentation
All you need is GitHub (or a backup of your playbooks and hosts file)
MOAR LEARNING
https://www.geekandi.com/2016/01/26/ansible-v2-0-vs-windows-update/
http://everythingshouldbevirtual.com/ansible-setting-up-an-ansible-control-machine-part-1
http://docs.ansible.com/ansible/intro_windows.html
https://www.udemy.com/learn-ansible/ by Mumshad Mannambeth
Udemy
Patch Windows Example
Books
MOAR
http://professionalvmware.com/?s=ansible
https://github.com/ansible/ansible-blog-examples/
https://blog.emccode.com/2016/02/09/automating-docker-swarm-and-rex-ray-installs-in-gce-with-ansible/
https://www.ansiblefordevops.com/ by Jeff Geerling (@geerlingguy)
https://www.packtpub.com/networking-and-servers/mastering-ansible-second-
edition by Jesse Keating
top related