Ansible: How to Get More Sleep and Require Less Coffee

18,387 views

Published on

Why you need automation, configuration management and remote execution in your life. An intro to Ansible and how it can make your life in Ops infinitely easier.

Published in: Technology
2 Comments
90 Likes
Statistics
Notes
No Downloads
Views
Total views
18,387
On SlideShare
0
From Embeds
0
Number of Embeds
1,118
Actions
Shares
0
Downloads
614
Comments
2
Likes
90
Embeds 0
No embeds

No notes for slide
  • Say we can put these fires out long enough to get ourselves into the next work day
  • Cluster ssh
    Bash scripts
    Building templates by hand
    Yo dawg, I heard you like snapshots of your snapshots
  • Don’t repeat yourself
    If you have to do a manual task more than two times, you need to rethink
    Consistency is key
  • You’ve heard of SCM, change management, release management, patch management…
    Configuration management
  • Describe the end state you want. Tool will get you to that state regardless of starting point.
  • structure
  • Restart livevault
  • Heartbleed/openssl
    Playbook that turned in to a role
  • Join machines to the domain
  • Full server build with roles
  • Phillip fry
  • Ansible: How to Get More Sleep and Require Less Coffee

    1. 1. How to Get More Sleep and Require Less Coffee Sarah Zelechoski @szelechoski Providence VMUG – 06/19/2014
    2. 2. State of Ops
    3. 3. Why We Sleep on the Couch We’re the ones they call when • “The website is down” • The customer is having an “weird” issue • A critical exploit just entered the wild • “I can’t login to the domain” • New deployment off hours • Offshore needs 6 new VMs for testing • “I’m doing a customer demo at 8AM”
    4. 4. Why We Own DNKN We’re seriously overloaded • Building VM templates • Configuring clusters • Storage management • Networking • Software deployment • User/Group Authentication/Authorization • Performance Testing • OS Upgrades • Software Upgrades • Security Patching • Troubleshooting • Customer Support • Development Labs • Alerting/Monitoring
    5. 5. Guys What R U Doin • Building VM templates • ISO install and configuration • Network setup • Set up users/group, security, authentication/authorization • Software install and configuration • Building out clusters • Cloning N number of VMs from X number of templates • Hostname/network configuration • Firewalling • Software deployments • Turn off monitoring/alerting • Pull nodes out of Load Balanced Group • Run DB migrations • Deploy application code • Restart web server • Put nodes back in/turn monitoring back on • Server maintenance • SSH in to every server and restart a service • Write complex scripts to log in to every server and update openssl
    6. 6. Guys STAHP • Ad hoc is bad hoc • Complex shell scripts to account for every eventuality • DRY (yeah I used to be a ruby dev) • Any manual task can introduce human error • They shouldn’t have to call you on your on vacation
    7. 7. Put an M on It • Configuration Management (CM) • authoritative centralization of configuration data and actions • history of updates, changes for auditing purposes • define the exact state a system should be in • Infrastructure CM • define the state that a system should be in with respect to it’s configuration and use tools that achieve that state • enforce consistency across an entire environment • automate to increase efficiency and repeatability • easier to affect change (cloud provider, OS, etc.) • remove the human factor • disaster recovery
    8. 8. Tool Time • Puppet • great with Windows (as long as they’re not XP) • amazing Enterprise support • cryptic DSL (imo) • Chef • easy to learn if you’re a ruby developer! • amazing wealth of cookbooks • Almost too verbose • SaltStack
    9. 9. Ansible • Agentless! • Uses SSH (with one python requirement) • Everything is a YAML file • Structure is flexible (ad-hoc, playbooks, roles, orchestration) • Easily extensible via modules • Encryption and security built in • Full power at the CLI (open source!) • Even more features available in enterprise (Tower) • No Windows • Idempotent
    10. 10. Idempo-what? “Operations in mathematics and computer science, that can be applied multiple times without changing the result beyond the initial application.” – wikipedia
    11. 11. Idempodent: Example • You need all your application servers’ tomcat setenv.sh to look like: JAVA_HOME=/usr/java/latest JAVA_OPTS="-Xms512m -Xmx1024m -XX:PermSize=128m -XX:MaxPermSize=256m" CATALINA_HOME=/usr/local/tomcat • You could get the job done with a classic echo command echo JAVA_HOME=/usr/java/latest >> /usr/local/tomcat/bin/setenv.sh echo JAVA_OPTS="-Xms512m -Xmx1024m -XX:PermSize=128m -XX:MaxPermSize=256m" >> /usr/local/tomcat/bin/setenv.sh echo CATALINA_HOME=/usr/local/tomcat >> /usr/local/tomcat/bin/setenv.sh • But… • what if these lines already exist? • what if the file doesn’t exist on a few of the servers? • what if you needed to run your script again to update/restore another setting? • If you don’t know the beginning state of the system, the end state is unpredictable
    12. 12. Idempotent: Example • You could write a more complex script for i in $tomcat_env_file do echo "Processing file $i" # i hate this trick, but since a non match is status code 1 and that # will kill this script do an unless here that forces a zero has_java_home=$(grep -cE "^JAVA_HOME=" $i || true) if [ $has_java_home -eq 0 ]; then sed –f setenv-without-java-home.sed -i $i elif [ $has_java_home -eq 1 ]; then sed -f setenv-with-java-home.sed -i $i else echo "Something went very wrong. Please review $i and make sure there is only a single line containing ’JAVA_HOME=' and run script again" fi done
    13. 13. Ain’t Nobody Got Time For That • Use an idempotent CM tool • Tell the tool what state you need the system to be in • Tool will get you from A->Z or B->Z or even C->Z • Won’t get mangled configs • Won’t get conflicting packages • Won’t get mismatched versions • Won’t get error messages you have to handle for each unique case
    14. 14. Ansible: Example • template the setenv.sh file we want # {{ ansible_managed }} JAVA_HOME={{java_home}}latest JAVA_OPTS="-Xms512m -Xmx1024m -XX:PermSize=128m -XX:MaxPermSize=256m" CATALINA_HOME={{tomcat_home}} • provide defaults (in yml!) --- java_home: /usr/java/ tomcat_home: /usr/local/tomcat tomcat_user: {name: ‘tomcat’, group: ‘tomcat’}
    15. 15. Ansible: Example • write ansible task - name: Apache Tomcat | Configure | Overlay configuration template: src='setenv.j2' dest='{{tomcat_home}}/bin/setenv.sh' owner={{tomcat_user.name}} group={{tomcat_user.group}} • profit! $ cat /usr/local/tomcat/bin/setenv.sh # Ansible managed: /tmp/packer-provisioner-ansible-local/roles/roles/tomcat- 7/templates/cloud/app/setenv.j2 modified on 2014-04-04 13:18:35 by vagrant on vagrant JAVA_HOME=/usr/java/latest JAVA_OPTS="-Xms512m -Xmx1024m -XX:PermSize=128m -XX:MaxPermSize=256m" CATALINA_HOME=/usr/local/tomcat
    16. 16. Structure • Inventory • Modules • Ad Hoc Commands • Playbooks • Tasks • Variables • Templates • Handlers • Roles
    17. 17. Inventory: Example [production:children] webservers dbservers proxies [webservers] foo.example.com http_port=80 bar.example.com http_port=8080 [dbservers] db[01:03].example.com [dbservers:vars] pgsql_bind_nic=eth1 [proxies] 192.168.1.1 $ ansible production –a “echo hello” –u joe –k $ ansible dbservers –a “service postgresl restart” –u joe –U root –k -K
    18. 18. Dynamic vSphere Inventory • Any script that can output JSON can be used to generate dynamic inventory • Use pysphere (python) or rbvmomi (ruby) to communicate with vSphere/vCenter • Organize your VMs by folder or resource pool to translate in to group
    19. 19. Dynamic vSphere Inventory • https://github.com/RaymiiOrg/ansible-vmware $ python2 query.py -–list { "no_group": { "hosts": [ "vm0031", "vm0032", [...] "vm0999" ] }, "local": [ "127.0.0.1" ] }
    20. 20. Dynamic vSphere Inventory • Preface each command with the script $ ANSIBLE_HOSTS="/src/vmware-ansible/query.py" ansible all -m ping • Export an environmental variable $ export ANSIBLE_HOSTS="/src/vmware-ansible/query.py” $ ansible no_group -m ping
    21. 21. Modules • can be written in any language as long as they output JSON • take parameters and conditions to define desired state • handles processing of system resources, services, packages, files, etc. in idempotent fashion • “seek to avoid changes to the system unless a change needs to be made” • ansible comes preloaded with a plethora of modules • tons of community pull requests
    22. 22. Ad Hoc Commands • run a single, one-off command • run on a full or partial inventory • run on a single host • no need to save for later $ ansible webservers –m command –a “dpkg-query –W openssl” –u joe –k SSH password: foo.example.com | success | rc=0 >> openssl 1.0.1e-2+deb7u10 bar.example.com | success | rc=0 >> openssl 1.0.1e-2+deb7u10
    23. 23. Playbooks • More powerful configuration management • Kept in source control, developed, validated • Declare configurations of more complex mutli-system enviornments • Arrange and run tasks synchronously or asynchronously
    24. 24. Playbooks: Example --- - hosts: all remote_user: vagrant sudo: true sudo_user: root vars_files: - roles/vars/webserver.encrypt vars: lifecycle: dev roles: - roles/debian - roles/vmware-tools - roles/local-users - roles/sudoers - roles/iptables - roles/clamav - roles/java-jdk-7 - roles/postgres - roles/apache - roles/tomcat-7 - { role: roles/tc-native, when: native== 'true' } - roles/ansible - roles/git - roles/liquibase - roles/cleanup post_tasks: - name: Reboot the Server command: '/sbin/reboot' - name: Wait for Server to come back wait_for: host='{{inventory_hostname}} ’port='22’ sudo: no delegate_to: localhost - name: Wait for Services to start fully wait_for: port='{{item}}' delay='5' timeout='600' with_items: - '8009' #ajp - '8080' #tomcat - '80' #httpd
    25. 25. Playbooks: Example $ ansible-playbook –i production webserver.yml –k –K $ ansible-playbook –i production webserver.yml –f 10 –k –K $ ansible-playbook –i production webserver.yml --list-hosts -k –K $ ansible-playbook –i production webserver.yml –-check –k –K
    26. 26. Tasks: Example module parameter iterator variable - name: Apache Tomcat | Install | Grab latest tomcat tarball get_url: url='{{tomcat.base_url}}{{item.sub_url}}{{item.file}}' dest='/tmp/{{item.file}}' with_items: tomcat.files - name: Apache Tomcat | Install | Extract archive shell: tar -xvzf /tmp/{{item.file}} -C /usr/local creates=/usr/local/{{item.target}} with_items: tomcat.files - name: Apache Tomcat | Install | Give ownership of install to tomcat user file: path=/usr/local/{{item.target}} state=directory owner={{tomcat.user.name}} group={{tomcat.user.group}} with_items: tomcat.files - name: Apache Tomcat | Install | Symlink install directory file: src='/usr/local/{{item.target}}' path='/usr/local/tomcat' state='link' with_items: tomcat.files - name: Apache Tomcat | Configure | Overlay configuration template: src=‘{{item.file}}' dest='{{item.target}}' owner={{tomcat.user.name}} group={{tomcat.user.group}} with_items: tomcat.config_files
    27. 27. Variables: • Simple YAML format • Can create arrays and hashes • Can substitute vars into vars • Vars can be defined at many levels (default, role ,playbook) • Can test conditionals on vars and require them • Can be filtered and manipulated with jinja2 • Can be matched to regex!
    28. 28. Variables: Example #################################### ## TOMCAT ## tomcat_home: '/usr/local/tomcat' tomcat: config_files: - {file: 'tomcat.j2', target: '/etc/init.d/tomcat'} - {file: 'setenv.j2', target: '{{tomcat_home}}/bin/setenv.sh'} - {file: 'server.j2', target: '{{tomcat_home}}/conf/server.xml'} default_webapps: ['ROOT','docs','examples','host-manager','manager'] base_url: 'http://www.gtlib.gatech.edu/pub/apache/tomcat/tomcat-7/v7.0.54/bin/' files: - {file: 'apache-tomcat-7.0.54.tar.gz', target: 'apache-tomcat-7.0.54'} user: {name: 'tomcat', group: 'tomcat'}
    29. 29. Templates • Templates are interpreted by jinja2 • stub out files • fill variables in differently depending on conditions • Powerful conditionals • Loops and iterators • Replace a file completely every time? • Yes. We configure for an end state.
    30. 30. Templates: Example # {{ ansible_managed }} Defaults env_reset Defaults mail_badpass Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin” # User privilege specification root ALL=(ALL:ALL) ALL # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL {% for item in admins %} {% if item.nopasswd is true %} {{item.name}} ALL= NOPASSWD: ALL Defaults:{{item.name}} !requiretty {% else %} {{item.name}} ALL=(ALL) ALL {% endif %} {% endfor %} {% if ad is defined %} {% for item in ad.sudoers_groups %} %{{item}} ALL=(ALL) ALL {% endfor %} {% endif %}
    31. 31. Templates: Example # Ansible managed: /tmp/packer-provisioner-ansible-local/roles/roles/sudoers/templates/sudoers- debian.j2 modified on 2014-06-09 10:08:44 by vagrant on vagrant Defaults env_reset Defaults mail_badpass Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin” # User privilege specification root ALL=(ALL:ALL) ALL # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL yoda ALL= NOPASSWD: ALL Defaults:yoda !requiretty luke ALL=(ALL) ALL anakin ALL=(ALL) ALL %jedi ALL=(ALL) ALL
    32. 32. Handlers • Written just like a regular task • Only run if triggered by the notify directive • Indicates a change in the system state • Any module can be used for the handler action Handler - name: Restart Tomcat service: name=tomcat state=restarted Task - name: Apache Tomcat | Configure | Overlay configuration template: src=‘{{item.file}}' dest='{{item.target}}’ with_items: tomcat.config_files notify: Restart Tomcat
    33. 33. Roles • Break up configuration into repeatable chunks • Reduce, reuse, recycle • Clean, understandable structure • Stack on top of each other • Ansible Galaxy
    34. 34. Roles • active directory • ansible • apache • app-dynamics • artifactory • centos • clamav • cleanup • debian • git • gradle • iptables • java-jdk-6 • java-jdk-7 • jenkins • keystore • liquibase • local-users • postgres • sudoers • swarm • packer • tomcat-6 • tomcat-7 • tomcat-native • vmware-tools • zeromq
    35. 35. Roles • Structure roles/ tomcat-7/ defaults/ main.yml files/ blah.txt handlers/ main.yml meta/ main.yml tasks/ main.yml templates/ setenv.j2 tomcat.j2 server.j2 limits.j2 vars/ main.yml
    36. 36. Roles • Dependencies • Always run before the roles that depend on them • If dependencies are duplicated amongst roles, they will only be run once by default • Can use allow_duplicates to require a role to be run more than once with different conditions --- dependencies: - { role: liquibase } - { role: apache, port: 80 } - { role: postgres, dbname: appdb, bind_nice: eth1 }
    37. 37. Orchestration • “Rolling Updates” • Performing very complex infrastructure or cluster operations • Run plays in serial instead of parallel • Wait for certain conditions to move forward • Abort if certain percentage of failure
    38. 38. Orchestration: Example • turn off monitoring and alerting • remove application server from load balanced group • stop services • wait for services to stop fully • checkout new code from git • deploy webapp • restart services • wait for services to start fully • return to load blanced group
    39. 39. Example: Simple Service Restart • Problem • 50ish production customer VMs • Older CentOS 5 mixed with CentOS 6 • May or may not have python installed • Domain authentication • Need to restart livevault service
    40. 40. Example: Simple Service Restart • Create inventory • Dump IP addresses of customer VM into simple ansible inventory [customer_vms:vars] [customer_vms] 192.168.32.117 192.168.32.39 192.168.34.176 192.168.34.28 192.168.33.100 192.168.32.197 192.168.34.181 192.168.34.158 ...
    41. 41. Example: Simple Service Restart • Use an ad hoc command to make sure VMs are bootstrapped for Ansible $ ansible cusomter_vms -i oldvms –u domainjoe -s -U root -m raw -a "sudo yum install -y python-simplejson" -k –K • Restart the live vault service $ ansible customer_vms –i oldvms –u domainjoe –s –U root -m service –a "name=livevault state=restarted" –k -K
    42. 42. Example: Heartbleed • openssl exploit • good news: patched for your OS • other packages updated along with openssl • 6 different environments (production, test, demo, etc.) • may require service restarts • need verification of final state version
    43. 43. Example: Heartbleed --- hosts: all sudo: yes sudo_user: root tasks: - name: OpenSSL | Get current version shell: 'dpkg-query -W openssl' register: openssl_version - name: OpenSSL | Get current version shell: 'dpkg-query -W libssl1.0.0' register: libssl_version - name: OpenSSL | Confirm new version debug: msg="OpenSSL version installed is {{openssl_version.stdout}}, libssl version installed is {{libssl_version.stdout}}" - name: OpenSSL | Apt | Install debconf-utils apt: pkg='debconf-utils' state='latest'
    44. 44. Example: Heartbleed - name: OpenSSL | Apt | Prevent restart services dialog debconf: name='libssl1.0.0' question='libssl1.0.0/restart-services' vtype='string' value='ntp’ - name: OpenSSL | Apt | Prevent restart services dialog debconf: name='libssl1.0.0:amd64' question='libssl1.0.0/restart-services' vtype='string' value='ntp’ - name: OpenSSL | Apt | Upgrade Openssl apt: pkg='{{item}}' state='latest' update_cache='yes' install_recommends='yes' force='yes' with_items: - 'openssl' - 'libssl1.0.0' - name: OpenSSL | Get new version shell: 'dpkg-query -W openssl' register: openssl_version - name: OpenSSL | Get new version shell: 'dpkg-query -W libssl1.0.0' register: libssl_version - name: OpenSSL | Confirm new version debug: msg="OpenSSL version installed is {{openssl_version.stdout}}, libssl version installed is {{libssl_version.stdout}}"
    45. 45. Example: Heartbleed $ ansible-playbook -i cloud-daily, openssl.yml -u joe -k -K SSH password: sudo password [defaults to SSH password]: PLAY [all] ******************************************************************** GATHERING FACTS *************************************************************** ok: [cloud-daily] TASK: [OpenSSL | Get current version] ***************************************** changed: [cloud-daily] TASK: [OpenSSL | Get current version] ***************************************** changed: [cloud-daily] TASK: [OpenSSL | Confirm new version] ***************************************** ok: [cloud-daily] => { "msg": "OpenSSL version installed is opensslt1.0.1e-2+deb7u9, libssl version installed is libssl1.0.0:amd64t1.0.1e-2+deb7u9" }
    46. 46. Example: Heartbleed TASK: [OpenSSL | Apt | Install debconf-utils] ********************************* ok: [cloud-daily] TASK: [OpenSSL | Apt | Prevent restart services dialog] *********************** ok: [cloud-daily] TASK: [OpenSSL | Apt | Prevent restart services dialog] *********************** ok: [cloud-daily] TASK: [OpenSSL | Apt | Upgrade Openssl] *************************************** changed: [cloud-daily] => (item=openssl,libssl1.0.0) TASK: [OpenSSL | Get new version] ********************************************* changed: [cloud-daily] TASK: [OpenSSL | Get new version] ********************************************* changed: [cloud-daily] TASK: [OpenSSL | Confirm new version] ***************************************** ok: [cloud-daily] => { "msg": "OpenSSL version installed is opensslt1.0.1e-2+deb7u11, libssl version installed is libssl1.0.0:amd64t1.0.1e-2+deb7u11" } PLAY RECAP ******************************************************************** cloud-daily : ok=11 changed=5 unreachable=0 failed=0
    47. 47. Example: Join Domain • every new VM needs to be added to a domain • packages needed (winbind/samba) • domain could depend on environment • samba/winbind configuration different per machine • sudoers will be different per machine • domain admin must authenticate • this happens a lot • reusable playbook and roles
    48. 48. Example: Join Domain • Roles • install active directory requirements (active-directory) • join the assigned domain (active-directory-join) • maniuplate sudoers (sudoers)
    49. 49. Example: Join Domain • active-directory active-directory/ tasks/ main.yml templates/ nsswitch.j2 • tasks (main.yml) --- - name: AD Authentication| Install | Install dependencies for AD authentication apt: pkg={{item}} state=installed force=yes with_items: - krb5-user - libpam-krb5 - winbind - samba - name: AD Authentication | Configure | Allow for authentication using winbind template: src='nsswitch.j2' dest='/etc/nsswitch.conf'
    50. 50. Example: Join Domain • active-directory-join active-directory-join/ tasks/ main.yml templates/ krb5.j2 pam/ common-account.j2 common-auth.j2 common-password.j2 common-session-interactive.j2 sudo.j2 smb.j2 vars/ example.com office.lan
    51. 51. Example: Join Domain • vars (office.lan) --- #################################### ## ACTIVE DIRECTORY ## ad_domain: office.lan ad_primary_dc: ad1.office.lan ad_secondary_dc: ad2.office.lan ad_workgroup: OFFICE ad_sudoers_groups: - 'domain admins' - 'qasudoers' - 'devsudoers'
    52. 52. Example: Join Domain • templates (smb.j2) # {{ ansible_managed }} # #======================= Global Settings ======================= [global] bind interfaces only = yes interfaces = lo eth0 wlan workgroup = {{ad_workgroup}} netbios name = {{ansible_hostname|truncate(15, True, end='')}} password server = {{ad_primary_dc}} {{ad_secondary_dc}} realm = {% filter upper %}{{ad_domain}}{% endfilter %} security = ads idmap uid = 16777216-33554431 idmap gid = 16777216-33554431
    53. 53. Example: Join Domain • tasks (main.yml) --- - name: AD Authentication | Configure | Place kerberos config for domain authentication template: src='krb5.j2' dest='/etc/krb5.conf' - name: AD Authentication | Configure | Place samba config for domain authentication template: src='smb.j2' dest='/etc/samba/smb.conf' - name: AD Authentication | Configure | Start services and enable on boot (Debian) service: name={{item}} state='restarted' enabled='yes' with_items: - winbind - name: AD Authentication | Configure | Start services and do not enable on boot (Debian) service: name={{item}} state='restarted' enabled='no' with_items: - samba - name: AD Authentication | Configure | kinit shell: echo "{{ad_domain_admin_password}}" | kinit {{ad_domain_admin_username}}@{% filter upper %}{{ad_domain}}{% endfilter %}
    54. 54. Example: Join Domain - name: AD Authentication | Configure | Join Active Directory shell: net ads join -U{{ad_domain_admin_username}}%'{{ad_domain_admin_password}}' - name: AD Authentication | Configure | Enable pam authentication via winbind (Debian) template: src='pam/{{item.name}}' dest='/etc/pam.d/{{item.target}}' with_items: - {name: 'common-session-interactive.j2', target: 'common-session-interactive'} - {name: 'common-password.j2', target: 'common-password'} - {name: 'common-account.j2', target: 'common-account'} - {name: 'common-auth.j2', target: 'common-auth'} - {name: 'sudo.j2', target: 'sudo'} - name: AD Authentication | Configure | Set domain controllers to be ntp servers lineinfile: regexp='^server {{item}}' insertafter='^#server ntp.your-provider.example' line='server {{item}}' state=present dest='/etc/ntp.conf' with_items: - "{{ad_primary_dc}}" - "{{ad_secondary_dc}}" - name: AD Authentication | Configure | Restart services service: name={{item}} state='restarted' with_items: - winbind - samba - ntpd
    55. 55. Example: Join Domain • sudoers sudoers/ tasks/ main.yml templates/ sudoers-debian.j2 • tasks (main.yml) --- - name: User | sudo Configure | Don't always set home and Preserve env home template: src='sudoers-debian.j2' dest='/tmp/sudoers' owner='root' group='root' mode='0600' validate='visudo -cf %s’ - name: User | sudo Configure | Place new config shell: 'cp -vf /tmp/sudoers /etc/sudoers’ - name: User | sudo Configure | Clean up temporary files file: path='/tmp/sudoers' state='absent’
    56. 56. Example: Join Domain • templates (sudoers-debian.j2) # {{ ansible_managed }} Defaults env_reset Defaults mail_badpass Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" root ALL=(ALL:ALL) ALL %sudo ALL=(ALL:ALL) ALL {% for item in admins %} {% if item.nopasswd == 'true' %} {{item.name}} ALL= NOPASSWD: ALL Defaults:{{item.name}} !requiretty {% else %} {{item.name}} ALL=(ALL) ALL {% endif %} {% endfor %} {% if ad_sudoers_groups is defined %} {% for item in ad_sudoers_groups %} %{{item}} ALL=(ALL) ALL {% endfor %} {% endif %}
    57. 57. Example: Join Domain • Put it all together in a playbook --- - hosts: all sudo: True sudo_user: root vars_prompt: - name: "ad_domain" prompt: "Domain to join (e.g. office.lan)" private: no - name: "ad_domain_admin_username" prompt: "Domain Admin username" private: no - name: "ad_domain_admin_password" prompt: "Domain Admin password" private: yes vars_files: - ../roles/active-directory-join/vars/{{ad_domain}}.encrypt roles: - ../roles/active-directory - ../roles/active-directory-join - ../roles/sudoers tasks: - name: Reboot the Server command: '/sbin/reboot' - name: Wait for Server to come back wait_for: host='{{inventory_hostname}}' port='22' delay='5' timeout='300' sudo: no delegate_to: localhost
    58. 58. Example: Join Domain $ ansible-playbook -i new-vm-clone, ad-join.yml –u joe -k -K SSH password: sudo password [defaults to SSH password]: Domain to join (e.g. office.lan): office.lan Domain Admin username: admin Domain Admin password: PLAY [all] ******************************************************************** GATHERING FACTS *************************************************************** ok: [new-vm-clone] TASK: [../roles/active-directory | AD Authentication| Install | Install dependencies for AD authentication] *** ok: [new-vm-clone] => (item=krb5-user,libpam-krb5,winbind,samba) TASK: [../roles/active-directory | AD Authentication | Configure | Allow for authentication using winbind] *** changed: [new-vm-clone] TASK: [../roles/active-directory-join | AD Authentication | Configure | Place kerberos config for domain authentication] *** changed: [new-vm-clone] TASK: [../roles/active-directory-join | AD Authentication | Configure | Place samba config for domain authentication] *** changed: [new-vm-clone] TASK: [../roles/active-directory-join | AD Authentication | Configure | Start services and enable on boot] *** changed: [new-vm-clone] => (item=winbind)
    59. 59. Example: Join Domain TASK: [../roles/active-directory-join | AD Authentication | Configure | Start services and do not enable on boot] *** changed: [new-vm-clone] => (item=samba) TASK: [../roles/active-directory-join | AD Authentication | Configure | kinit] *** changed: [new-vm-clone] TASK: [../roles/active-directory-join | AD Authentication | Configure | Join Active Directory] *** changed: [new-vm-clone] TASK: [../roles/active-directory-join | AD Authentication | Configure | Enable pam authentication via winbind] *** changed: [new-vm-clone] => (item={'name': 'common-session-interactive.j2', 'target': 'common-session-interactive'}) changed: [new-vm-clone] => (item={'name': 'common-password.j2', 'target': 'common-password'}) changed: [new-vm-clone] => (item={'name': 'common-account.j2', 'target': 'common-account'}) changed: [new-vm-clone] => (item={'name': 'common-auth.j2', 'target': 'common-auth'}) changed: [new-vm-clone] => (item={'name': 'sudo.j2', 'target': 'sudo'}) TASK: [../roles/active-directory-join | AD Authentication | Configure | Set domain controllers to be ntp servers] *** ok: [new-vm-clone] => (item=ad1.office.lan) ok: [new-vm-clone] => (item=ad2.office.lan) TASK: [../roles/active-directory-join | AD Authentication | Configure | Restart services] *** changed: [new-vm-clone] => (item=winbind) changed: [new-vm-clone] => (item=samba)
    60. 60. Example: Join Domain TASK: [../roles/sudoers | User | sudo Configure | Don't always set home and Preserve env home] *** changed: [new-vm-clone] TASK: [../roles/sudoers | User | sudo Configure | Place new config] *********** changed: [new-vm-clone] TASK: [../roles/sudoers | User | sudo Configure | Clean up temporary files] *** changed: [new-vm-clone] TASK: [Reboot the Server] ***************************************************** changed: [new-vm-clone] TASK: [Wait for Server to come back] ****************************************** ok: [new-vm-clone] PLAY RECAP ******************************************************************** new-vm-clone : ok=18 changed=13 unreachable=0 failed=0
    61. 61. Example: Server provisioner • Build and configure webserver --- #packer provisioning only - hosts: all connection: local remote_user: vagrant sudo: True sudo_user: root vars_files: - roles/vars/cloud.encrypt vars: lifecycle: 'production' build_flavor: 'cloud' app_flavor: 'app' roles: - roles/debian - roles/vmware-tools - roles/local-users - roles/active-directory - roles/cloud-baseline - roles/sudoers - roles/iptables - roles/java-jdk-7 - roles/tomcat-7 - { role: roles/tomcat-native, when: native == 'true' } - roles/ansible - roles/app-dynamics - roles/opsview - roles/cleanup - roles/git tasks: - name: Reboot the Server command: '/sbin/reboot' - name: Wait for Server to come back wait_for: host='{{inventory_hostname}}' port='22’ sudo: no delegate_to: localhost - name: Wait for Services to start fully wait_for: port='{{item}}' delay='5' timeout='600' with_items: - '8009' #ajp - '8080' #tomcat
    62. 62. Where do I go from here? • Stop doing everything by hand! • If you find yourself logging in to more than one VM to do the same task... • If you have been meaning to get around to patching or updating a bunch of VMs... • If you know all of the prompts of the OS installer by heart... • If scp and vi are your favorite tools... • If you dread the next release of your application • If you wince every time your phone rings
    63. 63. Use Ansible • Get more sleep • Require less coffee
    64. 64. Recommended Reading • http://docs.ansible.com/ • https://github.com/ansible/ansible-examples • https://gist.github.com/marktheunissen/2979474 • http://jpmens.net/ • https://galaxy.ansible.com/ • http://docs.ansible.com/vsphere_guest_module.html

    ×