Introduction to ansible

ansible
bcn sudoers
20131105
Wednesday, November 6, 13

In Science Fiction...
“An ansible is a ﬁctional machine capable of
instantaneous or superluminal communication. “
http://en.wikipedia.org/wiki/Ansible

In Open Source...
https://en.wikipedia.org/wiki/File:Dublin_Philharmonic_Orchestra_performing_Tchaikovsky%27s_Symphony_No_4_in_Charlotte,_North_Carolina.jpg

In Open Source...
IT orchestration engine created by Michael DeHaan
Conﬁguration Management
Software Deployment
Ad-Hoc Command Execution

KISS

KISS
✓No client setup
http://www.theregister.co.uk/2007/05/08/dell_box_multipack/

KISS
✓No client setup
✓SSH-based
http://www.cs.umd.edu/faq/ssh.html

KISS
✓No client setup
✓SSH-based
✓sudo-aware
http://xkcd.com/149/

Business Model
AnsibleWorks
Commercial Support
Non-free add-ons

Installation
Native Packages
Source tarball
pip install ansible
git clone https://github.com/ansible/ansible.git
➡Not on Mac Homebrew!

Hands-on Install

Host Setup
Have proper SSH keys
Use ssh-agent
Check .ssh/conﬁg

Host Inventory
# production
host01
host02:port
host[03:50]
...
[webservers]
host[03:20]
[database]
host02

Variables
# production
host01
host02:port
host[03:50]
...
[webservers]
host[03:20]
[webservers:vars]
database_server=host02
[database]
host02

Execute a command
$ ansible -vvvv -i production remotehost -m setup

Modules
Idempotent
ansible-doc

The Play
A set of rules
Declarative syntax
YAML
Idempotent

lineinfile
- name: disable reverse dns lookup in sshd
action: lineinfile
dest=/etc/ssh/sshd_config
state=present regexp="^UseDNS "
line="UseDNS no"
insertafter=EOF

Register results
action: lineinfile
line="UseDNS no"
insertafter=EOF
register: sshd_config

Backrefs
- name: apt-sources deb
lineinfile: dest=/etc/apt/sources.list
backrefs=yes regexp='^(deb .* ${dist} main)$'
line='1 contrib non-free'
register: apt_get_update

Shell
- name: apt-sources deb
lineinfile: dest=/etc/apt/sources.list
backrefs=yes regexp='^(deb .* ${dist} main)$'
line='1 contrib non-free'
register: apt_get_update
- name: update apt-get cache
shell: /usr/bin/apt-get update
when: apt_get_update.changed

Iterate
- name: install essential packages
action: apt name={{ item }} state=latest
with_items:
- etckeeper
- sudo
- iptables-persistent
- fail2ban

Conditional execution
action: lineinfile
line="UseDNS no"
insertafter=EOF
register: sshd_config
- name: restart sshd
when: sshd_config.changed
action: service name=ssh state=restarted

Use templates
- name: install default iptables rules
action: template src=$item dest=/etc/iptables/rules.v4
first_available_file:
- templates/host/${ansible_hostname}/iptables-rules-v4.j2
- templates/iptables-rules-v4.j2
register: new_iptables

Enter the Playbook

Playbook Structure
Vars
Hosts
Tasks
Handlers

Playbook Tree
production # inventory file for production servers
stage # inventory file for stage environment
group_vars/
group1 # here we assign variables to particular groups
group2 # ""
host_vars/
hostname1 # if systems need specific variables, put them here
hostname2 # ""
site.yml # master playbook
webservers.yml # playbook for webserver tier
dbservers.yml # playbook for dbserver tier
roles/
common/ # this hierarchy represents a "role"
tasks/ #
main.yml # <-- tasks file can include smaller files if warranted
handlers/ #
main.yml # <-- handlers file
templates/ # <-- files for use with the template resource
ntp.conf.j2 # <------- templates end in .j2
files/ #
bar.txt # <-- files for use with the copy resource
foo.sh # <-- script files for use with the script resource
vars/ #
main.yml # <-- variables associated with this role
webtier/ # same kind of structure as "common" was above, done for the webtier role
monitoring/ # ""
fooapp/ # ""
http://www.ansibleworks.com/docs/playbooks_best_practices.html

Launch Playbook
$ ansible-play -vvvv -i production playbook.yml

One-shot SSH is expensive
















 


Fireball Mode
Persistent server
Requires python-keyczar and python-zmq

Fireball Mode
Transient ZMQ queue + TCP listener
Unique, random key

Fireball Mode

Fireball Mode
---
- hosts: debian
user: root
# Uncomment next block to use fireball mode
# gather_facts: false
# connection: ssh
# tasks:
# - action: fireball
# - hosts: debian
# connection: fireball
# End comment block for fireball mode
vars:
...

Fireball Mode
---
- hosts: debian
user: root
# Uncomment next block to use fireball mode
# gather_facts: false
# connection: ssh
# tasks:
# - action: fireball
# - hosts: debian
# connection: fireball
# End comment block for fireball mode
vars:
...
DEPRECATED

Accelerated Mode
Supercedes Fireball
Uses single TCP port
Does not depend on ZMQ

Accelerated Mode
---
- hosts: all
accelerate: true
# default port is 5099
accelerate_port: 10000

Local Mode

Non-free
AWX
Callback mode

¿Preguntas?

¡Gracias!
@codehead
javier a.t. rodriguez.org.mx
scribd.com/javierrgz

Introduction to ansible

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (19)

Semelhante a Introduction to ansible

Semelhante a Introduction to ansible (20)

Mais de Javier Arturo Rodríguez

Mais de Javier Arturo Rodríguez (9)

Último

Último (20)

Introduction to ansible