Ansible: How to Get More Sleep and Require Less Coffee

  • 2,658 views
Uploaded on

Why you need automation, configuration management and remote execution in your life. An intro to Ansible and how it can make your life in Ops infinitely easier.

Why you need automation, configuration management and remote execution in your life. An intro to Ansible and how it can make your life in Ops infinitely easier.

More in: Technology
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
No Downloads

Views

Total Views
2,658
On Slideshare
0
From Embeds
0
Number of Embeds
4

Actions

Shares
Downloads
83
Comments
0
Likes
22

Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
    No notes for slide
  • Say we can put these fires out long enough to get ourselves into the next work day
  • Cluster ssh
    Bash scripts
    Building templates by hand
    Yo dawg, I heard you like snapshots of your snapshots
  • Don’t repeat yourself
    If you have to do a manual task more than two times, you need to rethink
    Consistency is key
  • You’ve heard of SCM, change management, release management, patch management…
    Configuration management
  • Describe the end state you want. Tool will get you to that state regardless of starting point.
  • structure
  • Restart livevault
  • Heartbleed/openssl
    Playbook that turned in to a role
  • Join machines to the domain
  • Full server build with roles
  • Phillip fry

Transcript

  • 1. How to Get More Sleep and Require Less Coffee Sarah Zelechoski @szelechoski Providence VMUG – 06/19/2014
  • 2. State of Ops
  • 3. Why We Sleep on the Couch We’re the ones they call when • “The website is down” • The customer is having an “weird” issue • A critical exploit just entered the wild • “I can’t login to the domain” • New deployment off hours • Offshore needs 6 new VMs for testing • “I’m doing a customer demo at 8AM”
  • 4. Why We Own DNKN We’re seriously overloaded • Building VM templates • Configuring clusters • Storage management • Networking • Software deployment • User/Group Authentication/Authorization • Performance Testing • OS Upgrades • Software Upgrades • Security Patching • Troubleshooting • Customer Support • Development Labs • Alerting/Monitoring
  • 5. Guys What R U Doin • Building VM templates • ISO install and configuration • Network setup • Set up users/group, security, authentication/authorization • Software install and configuration • Building out clusters • Cloning N number of VMs from X number of templates • Hostname/network configuration • Firewalling • Software deployments • Turn off monitoring/alerting • Pull nodes out of Load Balanced Group • Run DB migrations • Deploy application code • Restart web server • Put nodes back in/turn monitoring back on • Server maintenance • SSH in to every server and restart a service • Write complex scripts to log in to every server and update openssl
  • 6. Guys STAHP • Ad hoc is bad hoc • Complex shell scripts to account for every eventuality • DRY (yeah I used to be a ruby dev) • Any manual task can introduce human error • They shouldn’t have to call you on your on vacation
  • 7. Put an M on It • Configuration Management (CM) • authoritative centralization of configuration data and actions • history of updates, changes for auditing purposes • define the exact state a system should be in • Infrastructure CM • define the state that a system should be in with respect to it’s configuration and use tools that achieve that state • enforce consistency across an entire environment • automate to increase efficiency and repeatability • easier to affect change (cloud provider, OS, etc.) • remove the human factor • disaster recovery
  • 8. Tool Time • Puppet • great with Windows (as long as they’re not XP) • amazing Enterprise support • cryptic DSL (imo) • Chef • easy to learn if you’re a ruby developer! • amazing wealth of cookbooks • Almost too verbose • SaltStack
  • 9. Ansible • Agentless! • Uses SSH (with one python requirement) • Everything is a YAML file • Structure is flexible (ad-hoc, playbooks, roles, orchestration) • Easily extensible via modules • Encryption and security built in • Full power at the CLI (open source!) • Even more features available in enterprise (Tower) • No Windows • Idempotent
  • 10. Idempo-what? “Operations in mathematics and computer science, that can be applied multiple times without changing the result beyond the initial application.” – wikipedia
  • 11. Idempodent: Example • You need all your application servers’ tomcat setenv.sh to look like: JAVA_HOME=/usr/java/latest JAVA_OPTS="-Xms512m -Xmx1024m -XX:PermSize=128m -XX:MaxPermSize=256m" CATALINA_HOME=/usr/local/tomcat • You could get the job done with a classic echo command echo JAVA_HOME=/usr/java/latest >> /usr/local/tomcat/bin/setenv.sh echo JAVA_OPTS="-Xms512m -Xmx1024m -XX:PermSize=128m -XX:MaxPermSize=256m" >> /usr/local/tomcat/bin/setenv.sh echo CATALINA_HOME=/usr/local/tomcat >> /usr/local/tomcat/bin/setenv.sh • But… • what if these lines already exist? • what if the file doesn’t exist on a few of the servers? • what if you needed to run your script again to update/restore another setting? • If you don’t know the beginning state of the system, the end state is unpredictable
  • 12. Idempotent: Example • You could write a more complex script for i in $tomcat_env_file do echo "Processing file $i" # i hate this trick, but since a non match is status code 1 and that # will kill this script do an unless here that forces a zero has_java_home=$(grep -cE "^JAVA_HOME=" $i || true) if [ $has_java_home -eq 0 ]; then sed –f setenv-without-java-home.sed -i $i elif [ $has_java_home -eq 1 ]; then sed -f setenv-with-java-home.sed -i $i else echo "Something went very wrong. Please review $i and make sure there is only a single line containing ’JAVA_HOME=' and run script again" fi done
  • 13. Ain’t Nobody Got Time For That • Use an idempotent CM tool • Tell the tool what state you need the system to be in • Tool will get you from A->Z or B->Z or even C->Z • Won’t get mangled configs • Won’t get conflicting packages • Won’t get mismatched versions • Won’t get error messages you have to handle for each unique case
  • 14. Ansible: Example • template the setenv.sh file we want # {{ ansible_managed }} JAVA_HOME={{java_home}}latest JAVA_OPTS="-Xms512m -Xmx1024m -XX:PermSize=128m -XX:MaxPermSize=256m" CATALINA_HOME={{tomcat_home}} • provide defaults (in yml!) --- java_home: /usr/java/ tomcat_home: /usr/local/tomcat tomcat_user: {name: ‘tomcat’, group: ‘tomcat’}
  • 15. Ansible: Example • write ansible task - name: Apache Tomcat | Configure | Overlay configuration template: src='setenv.j2' dest='{{tomcat_home}}/bin/setenv.sh' owner={{tomcat_user.name}} group={{tomcat_user.group}} • profit! $ cat /usr/local/tomcat/bin/setenv.sh # Ansible managed: /tmp/packer-provisioner-ansible-local/roles/roles/tomcat- 7/templates/cloud/app/setenv.j2 modified on 2014-04-04 13:18:35 by vagrant on vagrant JAVA_HOME=/usr/java/latest JAVA_OPTS="-Xms512m -Xmx1024m -XX:PermSize=128m -XX:MaxPermSize=256m" CATALINA_HOME=/usr/local/tomcat
  • 16. Structure • Inventory • Modules • Ad Hoc Commands • Playbooks • Tasks • Variables • Templates • Handlers • Roles
  • 17. Inventory: Example [production:children] webservers dbservers proxies [webservers] foo.example.com http_port=80 bar.example.com http_port=8080 [dbservers] db[01:03].example.com [dbservers:vars] pgsql_bind_nic=eth1 [proxies] 192.168.1.1 $ ansible production –a “echo hello” –u joe –k $ ansible dbservers –a “service postgresl restart” –u joe –U root –k -K
  • 18. Dynamic vSphere Inventory • Any script that can output JSON can be used to generate dynamic inventory • Use pysphere (python) or rbvmomi (ruby) to communicate with vSphere/vCenter • Organize your VMs by folder or resource pool to translate in to group
  • 19. Dynamic vSphere Inventory • https://github.com/RaymiiOrg/ansible-vmware $ python2 query.py -–list { "no_group": { "hosts": [ "vm0031", "vm0032", [...] "vm0999" ] }, "local": [ "127.0.0.1" ] }
  • 20. Dynamic vSphere Inventory • Preface each command with the script $ ANSIBLE_HOSTS="/src/vmware-ansible/query.py" ansible all -m ping • Export an environmental variable $ export ANSIBLE_HOSTS="/src/vmware-ansible/query.py” $ ansible no_group -m ping
  • 21. Modules • can be written in any language as long as they output JSON • take parameters and conditions to define desired state • handles processing of system resources, services, packages, files, etc. in idempotent fashion • “seek to avoid changes to the system unless a change needs to be made” • ansible comes preloaded with a plethora of modules • tons of community pull requests
  • 22. Ad Hoc Commands • run a single, one-off command • run on a full or partial inventory • run on a single host • no need to save for later $ ansible webservers –m command –a “dpkg-query –W openssl” –u joe –k SSH password: foo.example.com | success | rc=0 >> openssl 1.0.1e-2+deb7u10 bar.example.com | success | rc=0 >> openssl 1.0.1e-2+deb7u10
  • 23. Playbooks • More powerful configuration management • Kept in source control, developed, validated • Declare configurations of more complex mutli-system enviornments • Arrange and run tasks synchronously or asynchronously
  • 24. Playbooks: Example --- - hosts: all remote_user: vagrant sudo: true sudo_user: root vars_files: - roles/vars/webserver.encrypt vars: lifecycle: dev roles: - roles/debian - roles/vmware-tools - roles/local-users - roles/sudoers - roles/iptables - roles/clamav - roles/java-jdk-7 - roles/postgres - roles/apache - roles/tomcat-7 - { role: roles/tc-native, when: native== 'true' } - roles/ansible - roles/git - roles/liquibase - roles/cleanup post_tasks: - name: Reboot the Server command: '/sbin/reboot' - name: Wait for Server to come back wait_for: host='{{inventory_hostname}} ’port='22’ sudo: no delegate_to: localhost - name: Wait for Services to start fully wait_for: port='{{item}}' delay='5' timeout='600' with_items: - '8009' #ajp - '8080' #tomcat - '80' #httpd
  • 25. Playbooks: Example $ ansible-playbook –i production webserver.yml –k –K $ ansible-playbook –i production webserver.yml –f 10 –k –K $ ansible-playbook –i production webserver.yml --list-hosts -k –K $ ansible-playbook –i production webserver.yml –-check –k –K
  • 26. Tasks: Example module parameter iterator variable - name: Apache Tomcat | Install | Grab latest tomcat tarball get_url: url='{{tomcat.base_url}}{{item.sub_url}}{{item.file}}' dest='/tmp/{{item.file}}' with_items: tomcat.files - name: Apache Tomcat | Install | Extract archive shell: tar -xvzf /tmp/{{item.file}} -C /usr/local creates=/usr/local/{{item.target}} with_items: tomcat.files - name: Apache Tomcat | Install | Give ownership of install to tomcat user file: path=/usr/local/{{item.target}} state=directory owner={{tomcat.user.name}} group={{tomcat.user.group}} with_items: tomcat.files - name: Apache Tomcat | Install | Symlink install directory file: src='/usr/local/{{item.target}}' path='/usr/local/tomcat' state='link' with_items: tomcat.files - name: Apache Tomcat | Configure | Overlay configuration template: src=‘{{item.file}}' dest='{{item.target}}' owner={{tomcat.user.name}} group={{tomcat.user.group}} with_items: tomcat.config_files
  • 27. Variables: • Simple YAML format • Can create arrays and hashes • Can substitute vars into vars • Vars can be defined at many levels (default, role ,playbook) • Can test conditionals on vars and require them • Can be filtered and manipulated with jinja2 • Can be matched to regex!
  • 28. Variables: Example #################################### ## TOMCAT ## tomcat_home: '/usr/local/tomcat' tomcat: config_files: - {file: 'tomcat.j2', target: '/etc/init.d/tomcat'} - {file: 'setenv.j2', target: '{{tomcat_home}}/bin/setenv.sh'} - {file: 'server.j2', target: '{{tomcat_home}}/conf/server.xml'} default_webapps: ['ROOT','docs','examples','host-manager','manager'] base_url: 'http://www.gtlib.gatech.edu/pub/apache/tomcat/tomcat-7/v7.0.54/bin/' files: - {file: 'apache-tomcat-7.0.54.tar.gz', target: 'apache-tomcat-7.0.54'} user: {name: 'tomcat', group: 'tomcat'}
  • 29. Templates • Templates are interpreted by jinja2 • stub out files • fill variables in differently depending on conditions • Powerful conditionals • Loops and iterators • Replace a file completely every time? • Yes. We configure for an end state.
  • 30. Templates: Example # {{ ansible_managed }} Defaults env_reset Defaults mail_badpass Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin” # User privilege specification root ALL=(ALL:ALL) ALL # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL {% for item in admins %} {% if item.nopasswd is true %} {{item.name}} ALL= NOPASSWD: ALL Defaults:{{item.name}} !requiretty {% else %} {{item.name}} ALL=(ALL) ALL {% endif %} {% endfor %} {% if ad is defined %} {% for item in ad.sudoers_groups %} %{{item}} ALL=(ALL) ALL {% endfor %} {% endif %}
  • 31. Templates: Example # Ansible managed: /tmp/packer-provisioner-ansible-local/roles/roles/sudoers/templates/sudoers- debian.j2 modified on 2014-06-09 10:08:44 by vagrant on vagrant Defaults env_reset Defaults mail_badpass Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin” # User privilege specification root ALL=(ALL:ALL) ALL # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL yoda ALL= NOPASSWD: ALL Defaults:yoda !requiretty luke ALL=(ALL) ALL anakin ALL=(ALL) ALL %jedi ALL=(ALL) ALL
  • 32. Handlers • Written just like a regular task • Only run if triggered by the notify directive • Indicates a change in the system state • Any module can be used for the handler action Handler - name: Restart Tomcat service: name=tomcat state=restarted Task - name: Apache Tomcat | Configure | Overlay configuration template: src=‘{{item.file}}' dest='{{item.target}}’ with_items: tomcat.config_files notify: Restart Tomcat
  • 33. Roles • Break up configuration into repeatable chunks • Reduce, reuse, recycle • Clean, understandable structure • Stack on top of each other • Ansible Galaxy
  • 34. Roles • active directory • ansible • apache • app-dynamics • artifactory • centos • clamav • cleanup • debian • git • gradle • iptables • java-jdk-6 • java-jdk-7 • jenkins • keystore • liquibase • local-users • postgres • sudoers • swarm • packer • tomcat-6 • tomcat-7 • tomcat-native • vmware-tools • zeromq
  • 35. Roles • Structure roles/ tomcat-7/ defaults/ main.yml files/ blah.txt handlers/ main.yml meta/ main.yml tasks/ main.yml templates/ setenv.j2 tomcat.j2 server.j2 limits.j2 vars/ main.yml
  • 36. Roles • Dependencies • Always run before the roles that depend on them • If dependencies are duplicated amongst roles, they will only be run once by default • Can use allow_duplicates to require a role to be run more than once with different conditions --- dependencies: - { role: liquibase } - { role: apache, port: 80 } - { role: postgres, dbname: appdb, bind_nice: eth1 }
  • 37. Orchestration • “Rolling Updates” • Performing very complex infrastructure or cluster operations • Run plays in serial instead of parallel • Wait for certain conditions to move forward • Abort if certain percentage of failure
  • 38. Orchestration: Example • turn off monitoring and alerting • remove application server from load balanced group • stop services • wait for services to stop fully • checkout new code from git • deploy webapp • restart services • wait for services to start fully • return to load blanced group
  • 39. Example: Simple Service Restart • Problem • 50ish production customer VMs • Older CentOS 5 mixed with CentOS 6 • May or may not have python installed • Domain authentication • Need to restart livevault service
  • 40. Example: Simple Service Restart • Create inventory • Dump IP addresses of customer VM into simple ansible inventory [customer_vms:vars] [customer_vms] 192.168.32.117 192.168.32.39 192.168.34.176 192.168.34.28 192.168.33.100 192.168.32.197 192.168.34.181 192.168.34.158 ...
  • 41. Example: Simple Service Restart • Use an ad hoc command to make sure VMs are bootstrapped for Ansible $ ansible cusomter_vms -i oldvms –u domainjoe -s -U root -m raw -a "sudo yum install -y python-simplejson" -k –K • Restart the live vault service $ ansible customer_vms –i oldvms –u domainjoe –s –U root -m service –a "name=livevault state=restarted" –k -K
  • 42. Example: Heartbleed • openssl exploit • good news: patched for your OS • other packages updated along with openssl • 6 different environments (production, test, demo, etc.) • may require service restarts • need verification of final state version
  • 43. Example: Heartbleed --- hosts: all sudo: yes sudo_user: root tasks: - name: OpenSSL | Get current version shell: 'dpkg-query -W openssl' register: openssl_version - name: OpenSSL | Get current version shell: 'dpkg-query -W libssl1.0.0' register: libssl_version - name: OpenSSL | Confirm new version debug: msg="OpenSSL version installed is {{openssl_version.stdout}}, libssl version installed is {{libssl_version.stdout}}" - name: OpenSSL | Apt | Install debconf-utils apt: pkg='debconf-utils' state='latest'
  • 44. Example: Heartbleed - name: OpenSSL | Apt | Prevent restart services dialog debconf: name='libssl1.0.0' question='libssl1.0.0/restart-services' vtype='string' value='ntp’ - name: OpenSSL | Apt | Prevent restart services dialog debconf: name='libssl1.0.0:amd64' question='libssl1.0.0/restart-services' vtype='string' value='ntp’ - name: OpenSSL | Apt | Upgrade Openssl apt: pkg='{{item}}' state='latest' update_cache='yes' install_recommends='yes' force='yes' with_items: - 'openssl' - 'libssl1.0.0' - name: OpenSSL | Get new version shell: 'dpkg-query -W openssl' register: openssl_version - name: OpenSSL | Get new version shell: 'dpkg-query -W libssl1.0.0' register: libssl_version - name: OpenSSL | Confirm new version debug: msg="OpenSSL version installed is {{openssl_version.stdout}}, libssl version installed is {{libssl_version.stdout}}"
  • 45. Example: Heartbleed $ ansible-playbook -i cloud-daily, openssl.yml -u joe -k -K SSH password: sudo password [defaults to SSH password]: PLAY [all] ******************************************************************** GATHERING FACTS *************************************************************** ok: [cloud-daily] TASK: [OpenSSL | Get current version] ***************************************** changed: [cloud-daily] TASK: [OpenSSL | Get current version] ***************************************** changed: [cloud-daily] TASK: [OpenSSL | Confirm new version] ***************************************** ok: [cloud-daily] => { "msg": "OpenSSL version installed is opensslt1.0.1e-2+deb7u9, libssl version installed is libssl1.0.0:amd64t1.0.1e-2+deb7u9" }
  • 46. Example: Heartbleed TASK: [OpenSSL | Apt | Install debconf-utils] ********************************* ok: [cloud-daily] TASK: [OpenSSL | Apt | Prevent restart services dialog] *********************** ok: [cloud-daily] TASK: [OpenSSL | Apt | Prevent restart services dialog] *********************** ok: [cloud-daily] TASK: [OpenSSL | Apt | Upgrade Openssl] *************************************** changed: [cloud-daily] => (item=openssl,libssl1.0.0) TASK: [OpenSSL | Get new version] ********************************************* changed: [cloud-daily] TASK: [OpenSSL | Get new version] ********************************************* changed: [cloud-daily] TASK: [OpenSSL | Confirm new version] ***************************************** ok: [cloud-daily] => { "msg": "OpenSSL version installed is opensslt1.0.1e-2+deb7u11, libssl version installed is libssl1.0.0:amd64t1.0.1e-2+deb7u11" } PLAY RECAP ******************************************************************** cloud-daily : ok=11 changed=5 unreachable=0 failed=0
  • 47. Example: Join Domain • every new VM needs to be added to a domain • packages needed (winbind/samba) • domain could depend on environment • samba/winbind configuration different per machine • sudoers will be different per machine • domain admin must authenticate • this happens a lot • reusable playbook and roles
  • 48. Example: Join Domain • Roles • install active directory requirements (active-directory) • join the assigned domain (active-directory-join) • maniuplate sudoers (sudoers)
  • 49. Example: Join Domain • active-directory active-directory/ tasks/ main.yml templates/ nsswitch.j2 • tasks (main.yml) --- - name: AD Authentication| Install | Install dependencies for AD authentication apt: pkg={{item}} state=installed force=yes with_items: - krb5-user - libpam-krb5 - winbind - samba - name: AD Authentication | Configure | Allow for authentication using winbind template: src='nsswitch.j2' dest='/etc/nsswitch.conf'
  • 50. Example: Join Domain • active-directory-join active-directory-join/ tasks/ main.yml templates/ krb5.j2 pam/ common-account.j2 common-auth.j2 common-password.j2 common-session-interactive.j2 sudo.j2 smb.j2 vars/ example.com office.lan
  • 51. Example: Join Domain • vars (office.lan) --- #################################### ## ACTIVE DIRECTORY ## ad_domain: office.lan ad_primary_dc: ad1.office.lan ad_secondary_dc: ad2.office.lan ad_workgroup: OFFICE ad_sudoers_groups: - 'domain admins' - 'qasudoers' - 'devsudoers'
  • 52. Example: Join Domain • templates (smb.j2) # {{ ansible_managed }} # #======================= Global Settings ======================= [global] bind interfaces only = yes interfaces = lo eth0 wlan workgroup = {{ad_workgroup}} netbios name = {{ansible_hostname|truncate(15, True, end='')}} password server = {{ad_primary_dc}} {{ad_secondary_dc}} realm = {% filter upper %}{{ad_domain}}{% endfilter %} security = ads idmap uid = 16777216-33554431 idmap gid = 16777216-33554431
  • 53. Example: Join Domain • tasks (main.yml) --- - name: AD Authentication | Configure | Place kerberos config for domain authentication template: src='krb5.j2' dest='/etc/krb5.conf' - name: AD Authentication | Configure | Place samba config for domain authentication template: src='smb.j2' dest='/etc/samba/smb.conf' - name: AD Authentication | Configure | Start services and enable on boot (Debian) service: name={{item}} state='restarted' enabled='yes' with_items: - winbind - name: AD Authentication | Configure | Start services and do not enable on boot (Debian) service: name={{item}} state='restarted' enabled='no' with_items: - samba - name: AD Authentication | Configure | kinit shell: echo "{{ad_domain_admin_password}}" | kinit {{ad_domain_admin_username}}@{% filter upper %}{{ad_domain}}{% endfilter %}
  • 54. Example: Join Domain - name: AD Authentication | Configure | Join Active Directory shell: net ads join -U{{ad_domain_admin_username}}%'{{ad_domain_admin_password}}' - name: AD Authentication | Configure | Enable pam authentication via winbind (Debian) template: src='pam/{{item.name}}' dest='/etc/pam.d/{{item.target}}' with_items: - {name: 'common-session-interactive.j2', target: 'common-session-interactive'} - {name: 'common-password.j2', target: 'common-password'} - {name: 'common-account.j2', target: 'common-account'} - {name: 'common-auth.j2', target: 'common-auth'} - {name: 'sudo.j2', target: 'sudo'} - name: AD Authentication | Configure | Set domain controllers to be ntp servers lineinfile: regexp='^server {{item}}' insertafter='^#server ntp.your-provider.example' line='server {{item}}' state=present dest='/etc/ntp.conf' with_items: - "{{ad_primary_dc}}" - "{{ad_secondary_dc}}" - name: AD Authentication | Configure | Restart services service: name={{item}} state='restarted' with_items: - winbind - samba - ntpd
  • 55. Example: Join Domain • sudoers sudoers/ tasks/ main.yml templates/ sudoers-debian.j2 • tasks (main.yml) --- - name: User | sudo Configure | Don't always set home and Preserve env home template: src='sudoers-debian.j2' dest='/tmp/sudoers' owner='root' group='root' mode='0600' validate='visudo -cf %s’ - name: User | sudo Configure | Place new config shell: 'cp -vf /tmp/sudoers /etc/sudoers’ - name: User | sudo Configure | Clean up temporary files file: path='/tmp/sudoers' state='absent’
  • 56. Example: Join Domain • templates (sudoers-debian.j2) # {{ ansible_managed }} Defaults env_reset Defaults mail_badpass Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" root ALL=(ALL:ALL) ALL %sudo ALL=(ALL:ALL) ALL {% for item in admins %} {% if item.nopasswd == 'true' %} {{item.name}} ALL= NOPASSWD: ALL Defaults:{{item.name}} !requiretty {% else %} {{item.name}} ALL=(ALL) ALL {% endif %} {% endfor %} {% if ad_sudoers_groups is defined %} {% for item in ad_sudoers_groups %} %{{item}} ALL=(ALL) ALL {% endfor %} {% endif %}
  • 57. Example: Join Domain • Put it all together in a playbook --- - hosts: all sudo: True sudo_user: root vars_prompt: - name: "ad_domain" prompt: "Domain to join (e.g. office.lan)" private: no - name: "ad_domain_admin_username" prompt: "Domain Admin username" private: no - name: "ad_domain_admin_password" prompt: "Domain Admin password" private: yes vars_files: - ../roles/active-directory-join/vars/{{ad_domain}}.encrypt roles: - ../roles/active-directory - ../roles/active-directory-join - ../roles/sudoers tasks: - name: Reboot the Server command: '/sbin/reboot' - name: Wait for Server to come back wait_for: host='{{inventory_hostname}}' port='22' delay='5' timeout='300' sudo: no delegate_to: localhost
  • 58. Example: Join Domain $ ansible-playbook -i new-vm-clone, ad-join.yml –u joe -k -K SSH password: sudo password [defaults to SSH password]: Domain to join (e.g. office.lan): office.lan Domain Admin username: admin Domain Admin password: PLAY [all] ******************************************************************** GATHERING FACTS *************************************************************** ok: [new-vm-clone] TASK: [../roles/active-directory | AD Authentication| Install | Install dependencies for AD authentication] *** ok: [new-vm-clone] => (item=krb5-user,libpam-krb5,winbind,samba) TASK: [../roles/active-directory | AD Authentication | Configure | Allow for authentication using winbind] *** changed: [new-vm-clone] TASK: [../roles/active-directory-join | AD Authentication | Configure | Place kerberos config for domain authentication] *** changed: [new-vm-clone] TASK: [../roles/active-directory-join | AD Authentication | Configure | Place samba config for domain authentication] *** changed: [new-vm-clone] TASK: [../roles/active-directory-join | AD Authentication | Configure | Start services and enable on boot] *** changed: [new-vm-clone] => (item=winbind)
  • 59. Example: Join Domain TASK: [../roles/active-directory-join | AD Authentication | Configure | Start services and do not enable on boot] *** changed: [new-vm-clone] => (item=samba) TASK: [../roles/active-directory-join | AD Authentication | Configure | kinit] *** changed: [new-vm-clone] TASK: [../roles/active-directory-join | AD Authentication | Configure | Join Active Directory] *** changed: [new-vm-clone] TASK: [../roles/active-directory-join | AD Authentication | Configure | Enable pam authentication via winbind] *** changed: [new-vm-clone] => (item={'name': 'common-session-interactive.j2', 'target': 'common-session-interactive'}) changed: [new-vm-clone] => (item={'name': 'common-password.j2', 'target': 'common-password'}) changed: [new-vm-clone] => (item={'name': 'common-account.j2', 'target': 'common-account'}) changed: [new-vm-clone] => (item={'name': 'common-auth.j2', 'target': 'common-auth'}) changed: [new-vm-clone] => (item={'name': 'sudo.j2', 'target': 'sudo'}) TASK: [../roles/active-directory-join | AD Authentication | Configure | Set domain controllers to be ntp servers] *** ok: [new-vm-clone] => (item=ad1.office.lan) ok: [new-vm-clone] => (item=ad2.office.lan) TASK: [../roles/active-directory-join | AD Authentication | Configure | Restart services] *** changed: [new-vm-clone] => (item=winbind) changed: [new-vm-clone] => (item=samba)
  • 60. Example: Join Domain TASK: [../roles/sudoers | User | sudo Configure | Don't always set home and Preserve env home] *** changed: [new-vm-clone] TASK: [../roles/sudoers | User | sudo Configure | Place new config] *********** changed: [new-vm-clone] TASK: [../roles/sudoers | User | sudo Configure | Clean up temporary files] *** changed: [new-vm-clone] TASK: [Reboot the Server] ***************************************************** changed: [new-vm-clone] TASK: [Wait for Server to come back] ****************************************** ok: [new-vm-clone] PLAY RECAP ******************************************************************** new-vm-clone : ok=18 changed=13 unreachable=0 failed=0
  • 61. Example: Server provisioner • Build and configure webserver --- #packer provisioning only - hosts: all connection: local remote_user: vagrant sudo: True sudo_user: root vars_files: - roles/vars/cloud.encrypt vars: lifecycle: 'production' build_flavor: 'cloud' app_flavor: 'app' roles: - roles/debian - roles/vmware-tools - roles/local-users - roles/active-directory - roles/cloud-baseline - roles/sudoers - roles/iptables - roles/java-jdk-7 - roles/tomcat-7 - { role: roles/tomcat-native, when: native == 'true' } - roles/ansible - roles/app-dynamics - roles/opsview - roles/cleanup - roles/git tasks: - name: Reboot the Server command: '/sbin/reboot' - name: Wait for Server to come back wait_for: host='{{inventory_hostname}}' port='22’ sudo: no delegate_to: localhost - name: Wait for Services to start fully wait_for: port='{{item}}' delay='5' timeout='600' with_items: - '8009' #ajp - '8080' #tomcat
  • 62. Where do I go from here? • Stop doing everything by hand! • If you find yourself logging in to more than one VM to do the same task... • If you have been meaning to get around to patching or updating a bunch of VMs... • If you know all of the prompts of the OS installer by heart... • If scp and vi are your favorite tools... • If you dread the next release of your application • If you wince every time your phone rings
  • 63. Use Ansible • Get more sleep • Require less coffee
  • 64. Recommended Reading • http://docs.ansible.com/ • https://github.com/ansible/ansible-examples • https://gist.github.com/marktheunissen/2979474 • http://jpmens.net/ • https://galaxy.ansible.com/ • http://docs.ansible.com/vsphere_guest_module.html