Ansible, voyage au centre de l'automatisation

HUBERT Mickaël / Allo-Media 2020
HUBERT Mickaël
Ansible, voyage au centre de l’automatisation
1

Ansible, c’est quoi ?
Créé en 2012 par Michael DeHaan
Racheté par Red Hat en 2015
Développé en Python
Agentless architecture
C’est une solution pour les feignants !
● Déploiements
● Exécution de tâches
● Gestion de configurations
Le tout sur plusieurs environnements en parallèle
2
www.ansible.com

Plus de 1400 modules
disponibles
regroupés en grandes
familles
● Cloud modules
● Clustering modules
● Commands modules
● Crypto modules
● Database modules
● Files modules
● Identity modules
● Inventory modules
● Messaging modules
● Monitoring modules
● Net Tools modules
● Network modules
● Notification modules
● Packaging modules
● Remote Management modules
● Source Control modules
● Storage modules
● System modules
● Utilities modules
● Web Infrastructure modules
● Windows modules
3

disponibles
familles
● Cloud modules
● Crypto modules
● Files modules
● Network modules
● Storage modules
● System modules
● Windows modules
4

disponibles
familles
● Cloud modules
● Crypto modules
● Files modules
● Network modules
● Storage modules
● System modules
● Windows modules
5

Comment l’installer et l’utiliser
Retour si OK:
192.168.1.1 | success >> {
"changed": false,
"ping": "pong"
}
$ sudo pip install ansible
$ ssh-keygen
$ ssh-copy-id -i ~/.ssh/id_rsa.pub ansible@192.168.1.1
$ sudo vim /etc/ansible/hosts
192.168.1.1
$ ansible all -m ping -u ansible
6

Vocabulaire
● inventory : C’est l’inventaire des serveurs que l’on souhaite provisionner
● fact : L’ensemble des informations que Ansible va être capable de récupérer sur le host (IP, OS, version
d’OS, etc …)
● var : L’ensemble des variables que l’on va utiliser dans nos actions avec Ansible
● template : C’est un template de fichier au format Jinja2 (comparable à Twig en PHP)
● module : Les fameux 1400 modules composant Ansible
● task : Utilisation d’un module que l’on va exécuter
● role : Regroupement d’un ensemble de tasks, variables, templates
● playbook : Regroupement d’un ensemble de roles ou tasks
7

Diagramme
WEB 1
WEB 2
WEB 3
WEB 4
Variables
Inventaires
Tâches
La machine hébergeant Ansible
- Un serveur commun aux admins
- Votre laptop
Templates / files
8

Ansible directories best practices
inventories/
production/
hosts # inventory file for production servers
group_vars/
group1.yml # here we assign variables to
particular groups
group2.yml
host_vars/
hostname1.yml # here we assign variables to
particular systems
hostname2.yml
site.yml
roles/
common/
webtier/
monitoring/
fooapp/
sources: https://docs.ansible.com/ansible/latest/user_guide/playbooks_best_practices.html
9

Roles directories best practices
site.yml
roles/
common/
tasks/
handlers/
files/
templates/
vars/
defaults/
meta/
test/
webservers/
tasks/
defaults/
# contains the main list of tasks to be executed by the role.
# contains handlers, which may be used by this role or even anywhere outside this role.
# default variables for the role.
# other variables for the role.
# contains files which can be deployed via this role.
# contains templates which can be deployed via this role.
sources: https://docs.ansible.com/ansible/latest/user_guide/playbooks_reuse_roles.html#role-directory-structure
# role / author description.
# how to test your role (not in Ansible best practices).
10

Structure de fichiers chez Allo-Media
- ansible-voip - inventories
- dev
- preprod
- prod
- group_vars
- hosts
hosts file
[scr-servers]
am-scr-001
am-scr-002
[rtp-servers]
am-rtp-001
am-rtp-002
[isbc-servers]
am-isbc-001
am-isbc-002
[asbc-servers]
am-asbc-001
…..
group_vars directory
- all.crypt
- all_asbc.yml
- all_mrcp.yml
- all_scr.yml
- all_rtp.yml
- am-isbc-001.crypt
- am-isbc-002.crypt
- am-rtp-001.crypt
- am-rtp-002.crypt
...
11

inventories/prod/group_vars/all_asbc.yml
asbc_conf_path: /usr/local/freeswitch
asbc_customers_conf_path: /conf/dialplan/customers_config
asbc_graylog2_host: 10.1.0.42
asbc_graylog2_port: 12201
asbc_freeswitch_version: v1.8
asbc_from_internal_domain: am-isbc-002.allo-media.tech
asbc_user: freeswitch
asbc_group: freeswitch
asbc_scr_gateways_list:
- { name: "GWSCR1", host: "10.1.15.141" }
- { name: "GWSCR2", host: "10.1.15.142" }
asbc_proxies_gateways_list:
- { name: "GWPROXY1", host: "10.1.15.153" }
12

inventories/prod/group_vars/all_asbc.yml
asbc_customers_conf_path: /conf/dialplan/customers_config
asbc_graylog2_host: 10.1.0.42
asbc_graylog2_port: 12201
asbc_freeswitch_version: v1.8
asbc_user: freeswitch
asbc_group: freeswitch
- { name: "GWSCR1", host: "10.1.15.141" }
- { name: "GWSCR2", host: "10.1.15.142" }
13

- ansible-voip - roles - asbc_config - tasks
- templates
tasks directory
- main.yml
templates directory
- internal.xml.j2
14

Task
roles/asbc_config/tasks/main.yml
- name: copy FS configurations files
template:
src: "{{ item.src }}"
dest: "{{ asbc_conf_path }}/{{ item.path | regex_replace('.j2','')
}}"
owner: "{{ asbc_user }}"
group: "{{ asbc_group }}"
mode: "0440"
with_filetree: templates/
when: item.state == 'file'
tags:
- never
- fs-config
internal.xml.j2
15

Template Jinja2
roles/asbc_config/templates/internal.xml.j2
#jinja2: lstrip_blocks: "True"
<?xml version="1.0" encoding="UTF-8"?>
<profile name="INTERNAL">
<settings>
...........
</settings>
<gateways>
{% for gateway in asbc_scr_gateways_list + asbc_proxies_gateways_list
%}
<gateway name="{{ gateway.name }}">
<param name="from-domain" value="{{ asbc_from_internal_domain }}"/>
<param name="proxy" value="{{ gateway.host }}"/>
<param name="register" value="false"/>
<param name="retry-seconds" value="30"/>
<param name="ping" value="25"/>
</gateway>
{% endfor %}
</gateways>
</profile>
- { name: "GWSCR1", host: "10.1.15.141" }
- { name: "GWSCR2", host: "10.1.15.142" }
16

Résultat
/usr/local/freeswitch/conf/internal.xml
<gateways>
<gateway name="GWSCR1">
<param name="from-domain" value="am-isbc-002.allo-media.tech"/>
<param name="caller-id-in-from" value="true"/>
<param name="proxy" value="10.1.15.141"/>
</gateway>
<gateway name="GWSCR2">
<param name="from-domain" value="am-isbc-002.allo-media.tech"/>
<param name="caller-id-in-from" value="true"/>
<param name="proxy" value="10.1.15.142"/>
</gateway>
....
</gateways>
{{ gateway.name }} {{ asbc_from_internal_domain }}
{{ gateway.host }}
17

Playbook
asbc-install_config.yml file
---
- name: ASBC installation + configuration deployment for asbc servers
hosts: asbc-servers
gather_facts: yes
become: yes
vars_files:
- inventories/{{ deploy_env }}/group_vars/all_asbc.yml
- inventories/{{ deploy_env }}/group_vars/{{ inventory_hostname
}}.crypt
roles:
- { role: fs_install, tags: [never,install] }
- { role: asbc_config, tags: [always] }
18

Y’a plus qu’à
$ cd /home/moi/ansible-voip/
$ ansible-playbook
asbc-install_config.yml
-i inventories/prod/hosts
-v
-e deploy_env=prod
-t install
19
- inventories/{{ deploy_env }}/group_vars/all_asbc.yml
- inventories/{{ deploy_env }}/group_vars/{{ inventory_hostname }}.crypt

Comment tester son truc ?
main.yml
---
- name: Freeswitch installation by sources compilation
hosts: all
become: yes
pre_tasks:
- name: Verify Ansible version requirements.
....
roles:
- ../../fs_install
Avec Vagrant
- ansible-voip - roles - fs_install - tasks
- templates
- test
20

Comment tester son truc ?
Vagrantfile
# -*- mode: ruby -*-
# vi: set ft=ruby :
Vagrant.configure("2") do |config|
config.vm.box = "debian/stretch64"
# freeswitch
config.vm.define "freeswitch-dev" do |freeswitch|
freeswitch.vm.hostname = "freeswitch-dev"
freeswitch.vm.network :private_network, ip: "10.99.0.224"
freeswitch.vm.network :private_network, ip: "10.99.1.224"
end
config.vm.provider :virtualbox do |vb|
vb.customize ["modifyvm", :id, "--memory", 1024]
vb.customize ["modifyvm", :id, "--cpus", 2]
end
config.vm.provision "ansible" do |ansible|
ansible.playbook = "main.yml"
end
config.vm.provider "virtualbox" do |vb|
vb.gui = false
vb.name = "freeswitch-dev"
end
end
# vagrant up
ou
# vagrant provision
21

Créer son propre rôle
et le partager à la communauté
https://galaxy.ansible.com https://github.com/Mickaelh51/ar-opensips-from-sources
22

Comparatif avec d’autres solutions
sources: https://www.edureka.co/blog/chef-vs-puppet-vs-ansible-vs-saltstack
23

Pour aller un peu plus loin
Dynamic inventory:
https://github.com/Mickaelh51/ansible-dyninv-mysql
GitCrypt:
$ sudo apt-get install -y git-crypt
$ git-crypt keygen /path/to/keyfile
$ cd repo
$ git-crypt init /path/to/keyfile
$ echo "*.crypt filter=git-crypt diff=git-crypt" > .gitattributes
$ git commit
$ git push
24

Fin
Twitter: @mikedunord
Email: mickael@winlux.fr
Github: https://github.com/mickaelh51
25

Ansible, voyage au centre de l'automatisation

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Ansible, voyage au centre de l'automatisation

Similar to Ansible, voyage au centre de l'automatisation (20)

Recently uploaded

Recently uploaded (20)

Ansible, voyage au centre de l'automatisation