Ansible adalah alat otomisasi IT yang bisa digunakan untuk melakukan konfigurasi sistem, instalasi perangkat lunak, dan operasi IT yang lebih rumit seperti cont inous deployments atau zero downtime rolling updates. Ansible's goal: simplicity and maximum easy of use, strong focus on security and reliability, minimum of moving parts, usage of OpenSSH for transport (accelerat ed socket mode and pull mode), easy language for human Simplicity is relevant to all size of environment and design for busy users of a ll types - whether this means developers, sysadmins, release engineers, IT manag ers, and everywhere in between. Ansible: agentless, decentralized, relies on your existing OS credential, can ea sily connect to Kerberos LDAP, and other centralized authentication management s ystems Installation Control Machine: Use OS package manager, requirement: Python2.6 or Python2.7 (Re d Hat, Debian, CentOS, OS X, any of the BSDs, and so on.) Managed Node: Python2.4(with python-simplejson) or later Remote Connection Information Ansible 1.3 or later will use native OpenSSH communication when possible: Contro lPersist(except for EL6 will use paramiko), Kerberos, options in ~/.ssh/config s uch as Jump Host setup. For device that doesn't support SFTP, switch to SCP in a nsible.cfg. Password can be provided using --ask-pass or --ask-sudo-pass. Run co ntrol machine near managed nodes. Ansible also have options to manage things loc ally, as well as manage chroot, lxc, and jail containers. A mode called 'ansible -pull' can also invert the system and have systems â phone homeâ via scheduled git checko uts to pull configuration directives from a central repository. Basic Command Ansible hosts file: /etc/ansible/hosts (ansible inventory file, use SSH public k ey auth for those nodes) Set host_key_checking = False if needed $ ansible all -m ping -u user [--sudo|--sudo-user] Inventory Ansible inventory file which define managed nodes: /etc/ansible/hosts Patterns Patterns in Ansible are how we decide which hosts to manage, what hosts to commu nicate with, in terms of Playbooks it actually means what hosts to apply a parti cular configuration or IT process to. $ ansible
-m -a Ad-hoc Command An ad-hoc command is something that you might type in to do something really qui ck, but donâ t want to save for later. Parallelism and Shell Commands -f number of forks --sudo/-s run command through sudo --ask-sudo-pass/-K ask sudo password --sudo-user/-U sudo to different user shell: shell module File Transfer copy: copy module ansible atlanta -m copy -a "src=/etc/hosts dest=/tmp/hosts" file: file module ansible webservers -m file -a "dest=/srv/foo/b.txt mode=600 owner=mdehaan group=
mdehaan" ansible webservers -m file -a "dest=/path/to/c mode=755 owner=mdehaan group=mdeh aan state=directory" ansible webservers -m file -a "dest=/path/to/c state=absent" Managing Packages yum: yum module ansible webservers ansible webservers ansible webservers ansible webservers
-m -m -m -m
yum yum yum yum
-a -a -a -a
"name=acme state=present" "name=acme-1.5 state=present" "name=acme state=latest" "name=acme state=absent"
Users and Groups user: user and group module ansible all -m user -a "name=foo password=" ansible all -m user -a "name=foo state=absent" Deploy from Source Control git: git module ansible webservers -m git -a "repo=git://foo.examp "repo=git://foo.example.org/repo.git le.org/repo.git dest=/srv/myap p version=HEAD" Managing Service service: service module ansible webservers -m service -a "name=httpd state=started" ansible webservers -m service -a "name=httpd state=restarted" ansible webservers -m service -a "name=httpd state=stopped" Time Limited Background Operations ansible all -B 3600 -P 0 -a "/usr/bin/long_running "/usr/bin/long_running_operation _operation --do-stuff" async_status: module to check job status later ansible web1.example.com -m async_status -a "jid=488359678239.2844" polling ansible all -B 1800 -P 60 -a "/usr/bin/long_runnin "/usr/bin/long_running_operation g_operation --do-stuff" Gathering Facts Facts are described in the playbooks section and represent discovered variables about a system. These can be used to implement conditional execution of tasks bu t also just to get ad-hoc information about your system. ansible all -m setup The Ansible Configuration File Ansible Playbooks Playbooks: ansible configuration, deployment, and orchestration language Basic: Hosts and Users --- hosts: mx1-test remote_user: root vars: ansible_python_interpreter: ansible_python_interpr eter: /usr/local/bin/python tasks: - name: install python raw: env ASSUME_ALWAYS_YES=YES /usr/sbin/pkg install python - name: update portsnap command: /usr/sbin/portsnap fetch extract
- name: install postfix portinstall: pkg=postfix state=present notify: - enable postfix - start postfix - name: configure postfix template: src=/ dest=/usr/local/etc/postfix notify: - restart postfix - name: ensure apache is running (and enable it at boot) service: name=httpd state=started enabled=yes handlers: - name: enable postfix command: "{{ item }}" with_items: - /usr/sbin/sysrc postfix_enable=YES - /usr/sbin/sysrc sendmail_enable=NO - /usr/sbin/sysrc sendmail_submit_enable=NO - /usr/sbin/sysrc sendmail_outbond_enable=NO - /usr/sbin/sysrc sendmail_msp_queue_enable=NO - name: start postfix service: name=postfix state=running - name: restart postfix service: name=postfix state=restarted
--- hosts: ntp-servers user: ansible sudo: yes tasks: - name: enable ntpdate action: command sysrc ntpdate_enable=yes - name: enable ntpdate server action: command sysrc ntpdate_hosts=pool.ntp.org - name: enable ntpd action: command sysrc ntpd_enable=yes - name: copy ntp.server.conf to servers action: copy src=/home/ansible/freebsd/etc/ntp.server.conf dest=/etc/ntp.conf owner=root group=wheel mode=0644 notify: - restart ntpd - include: tasks/pf-compile.yml handlers: - include: handlers/restarts.yml --#build pf.conf from template - name: configure firewall template: src=/home/ansible/freebsd/etc/pf.conf.j2 dest=/etc/pf.conf owner=0 group=0 mode=0444 validate='/sbin/pfctl -nf %s' notify: - reload pf
--#restart assorted services - name: restart ntpd service: name=ntpd state=restarted - name: reload pf action: shell /sbin/pfctl -f /etc/pf.conf #{{ ansible_managed }} #$Id: pf.conf.j2,v 1.2 2014/01/16 16:10:54 mwlucas Exp $ ext_if="{{ ansible_default_ipv4.device }}" include "/etc/pf.mgmt.conf" include "/etc/pf.ournets.conf" set block-policy return set loginterface $ext_if set skip on lo0 scrub in all block in all pass in on $ext_if proto icmp all pass in on $ext_if proto icmp6 all #this host may initiate anything pass out on $ext_if from any to any #mgmt networks can talk to this host on any service pass in on $ext_if from to any #Allowed services, in port order {% if inventory_hostname in groups['dns'] %} #DNS access pass in on $ext_if proto {tcp, udp} from any to any port 53 {% endif %} {% if inventory_hostname in groups['tftpd'] %} #allow tftp from the world pass in on $ext_if proto udp from any to any port 69 {% endif %} {% if inventory_hostname in groups['ntp-servers'] %} #allow time from our networks pass in on $ext_if proto udp from to any port 123 {% endif %} #end of services I allow access from my management networks, allow ICMP, default block, all the r outine packet filter stuff. The next interesting bit is the allowed services. I check for the hostâ s presence in a group, and if itâ s thereâ I add a rule to permit the ss that protocol needs. One detail that gave me trouble made me use inventory_hostname rather than ansib
le_fqdn or ansible_hostname to check group membership. I manage systems in sever al domains, and many of them have one name in our management systems and another in DNS. I put machines in Ansible by their fully qualified domain name. Using a nsible_fqdn to get a hostname returns the hostname given in reverse DNS. invento ry_hostname returns the hostname as it appears in the hosts file. If ansible_fqd n doesnât match the hostname in the hosts file, the group comparison fails. Using in ventory_hostname gave me one consistent set of hostnames for comparisons. So now I can easily deploy a secure NTP configuration to my servers. When I have to deploy some other service that requires updating the packet filter, I can in clude the same task file. And the handlers are now similarly reusable. MX Playbooks common: dumpon mailgraph newsyslog nfsclient ntpd ntpdate rsyncd sendmail snmpd snmptrapd sshd syslogd mx1: bacula_fd hostname ipfilter ipnat network pf pflog postfix routing handlers -
disable sendmail enable apache24 enable bacula_fd enable mailgraph enable newsyslog enable ntpd enable ntpdate enable nfsclient enable postfix enable rsync enable snmp enable snmptrapd enable syslogd
Command Examples: cd ansible/openstack/ man ansible mkdir ansible
mkdir -p ansible/files mv ansible/files ansible/openstack mv ansible/openstack/hosts.openstack ansible/openstack/hosts sudo cp /etc/ansible/{hosts,hosts.old} sudo vi /etc/ansible/group_vars/mx sudo vi /etc/ansible/group_vars/mx sudo vi /etc/ansible/group_vars/mx sudo vi /etc/ansible/group_vars/mx sudo vi /etc/ansible/group_vars/mx sudo vi /etc/ansible/group_vars/mx sudo vi /etc/ansible/group_vars/mx sudo vi /etc/ansible/group_vars/mx sudo vi /etc/ansible/group_vars/mx sudo vi /etc/ansible/group_vars/mx sudo vi /etc/ansible/hosts vi ansible/files/hosts.openstack vi ansible/openstack/eth1.11 vi /etc/ansible/hosts sudo vi /etc/ansible/ansible.cfg sudo vi /etc/ansible/hosts sudo vi /etc/ansible/hosts sudo vi /etc/ansible/hosts.old sudo yum install ansible ansible mx -m copy -a "src=/etc/hosts dest=/tmp/hosts" -u root ansible openstack -m copy -a "src=/home/pras/ansible/files/hosts.openstack dest= /etc/hosts mode=0644 owner=root group=root" --ask-sudo-pass ansible openstack -m copy -a "src=/home/pras/ansible/files/hosts.openstack dest= /etc/hosts mode=0644 owner=root group=root" -s --ask-sudo-pass ansible openstack -m copy -a "src=/home/pras/ansible/files/hosts.openstack dest= /etc/hosts mode=644 owner=root group=root" -K ansible 167.205.23.38 -m copy -a "src=/home/pras/ansible/openstack/eth2.11 dest= /etc/sysconfig/network-scripts/ifcfg-eth2 mode=0644 owner=root group=root" -s -K ansible 167.205.23.39 -m copy -a "src=/home/pras/ansible/openstack/eth2.21 dest= /etc/sysconfig/network-scripts/ifcfg-eth2 mode=0644 owner=root group=root" -s -K ansible 167.205.23.40 -m copy -a "src=/home/pras/ansible/openstack/eth2.31 dest= /etc/sysconfig/network-scripts/ifcfg-eth2 mode=0644 owner=root group=root" -s -K ansible 167.205.23.38 -m copy -a "src=/home/pras/ansible/openstack/mariadb_opens tack.cnf dest=/etc/my.cnf.d/mariadb_openstack.cnf mode=0644 owner=root group=roo t" -s -K ansible 167.205.23.38 -m copy -a "src=/home/pras/ansible/openstack/ntp.conf.mast er dest=/etc/ntp.conf mode=0644 owner=root group=root" -s -K ansible 167.205.23.39,167.205.23.40 -m copy -a "src=/home/pras/ansible/openstack /ntp.conf.slaves dest=/etc/ntp.conf mode=0644 owner=root group=root" -s -K ansible 167.205.23.39 -m copy -a "src=/home/pras/ansible/openstack/ntp.conf.slav es dest=/etc/ntp.conf mode=0644 owner=root group=root" -s -K ansible 167.205.23.40 -m copy -a "src=/home/pras/ansible/openstack/ntp.conf.slav es dest=/etc/ntp.conf mode=0644 owner=root group=root" -s -K sudo mkdir -p /etc/ansible/group_vars ansible 167.205.23.38 -m firewalld -a "port=5672 permanent=true state=enabled" s -K ansible 167.205.23.38 -m firewalld -a "port=5672/tcp permanent=true state=enable d" -s -K ansible 167.205.23.38 -m firewalld -a "service=mariadb-server permanent=true sta te=enabled" -s -K ansible 167.205.23.38 -m firewalld -a "service=maria permanent=true state=enable d" -s -K ansible 167.205.23.38 -m firewalld -a "service=mysql permanent=true state=enable d" -s -K ansible 167.205.23.38 -m firewalld -a "service=ntpd permanent=true state=enabled " -s -K
ansible 167.205.23.38 -m firewalld -a "service=ntpd permanent=true state=enabled " -s -K ansible 167.205.23.38 -m firewalld -a "service=ntp permanent=true state=enabled" -s -K ansible 167.205.23.38 -m firewalld -a "service=ntp permanent=true state=enabled" -s -K ansible 167.205.23.38 -m firewalld -a "service=rabbitmq-server permanent=true st ate=enabled" -s -K ansible 167.205.23.38 -m firewalld -a "service=rabbitmq-server permanent=true st ate=enabled" -s -K ansible openstack -m ping ansible all -m ping -u pras ansible all -m ping -u pras ansible all -m ping -u [ras ansible all -m ping -u root ansible all -m ping -u root ansible all -m ping -u root ansible all -m ping -u root ansible all -m ping -u root ansible all -m ping -u root ansible all -m ping -u root ansible all -m ping -u root ansible all -m ping -u root ansible all -m ping -u root ansible all -m ping -u root ansible openstack -m ping -u root ansible all -m raw -a 'env ASSUME_ALWAYS_YES=YES pkg install python' -u root ansible 167.205.23.38 -m raw -a "firewall-cmd --add-service=ntp --permanent" -s -K ansible all -m raw -a 'pkg install python' ansible all -m raw -a 'pkg install python' ansible all -m raw -a 'pkg install python' -u root ansible all -m raw -a 'rehash' -u root ansible openstack -m raw -a "yum install http://dl.fedoraproject.org/pub/epel/7/ x86_64/e/epel-release-7-5.noarch.rpm" -s -K ansible openstack -m raw -a "yum -y install ftp://ftp.itb.ac.id/pub/Fedora/epel/ 7/x86_64/e/epel-release-7-5.noarch.rpm" -s -K ansible openstack -m raw -a "yum -y install http://rdo.fedorapeople.org/openstac k-kilo/rdo-release-kilo.rpm" -s -K ansible 167.205.23.38 -m service -a "name=firewalld state=reloaded" -s -K ansible 167.205.23.38 -m service -a "name=firewalld state=reloaded" -s -K ansible openstack -m service -a "name=firewalld state=reloaded" -s -K ansible 167.205.23.38 -m service -a "name=firewalld state=restarted" -s -K ansible 167.205.23.38 -m service -a "name=firewalld state=restarted" -s -K ansible 167.205.23.38 -m service -a "name=firewalld state=restarted" -s -K ansible 167.205.23.38 -m service -a "name=firewalld state=restarted" -s -K ansible 167.205.23.38 -m service -a "name=firewalld state=running" -s -K ansible 167.205.23.38 -m service -a "name=mariadb state=running enabled=yes" -s -K ansible 167.205.23.38 -m service -a "name=mariadb state=running" -s -K ansible openstack -m service -a "name=network state=restarted" -s -K ansible openstack -m service -a "name=ntpd state=restarted" -s -K ansible openstack -m service -a "name=ntpd state=restarted" -s -K ansible openstack -m service -a "name=ntpd state=restarted" -s -K ansible mx -m service -a "name=ntpd state=restarted" -u root ansible openstack -m service -a "name=ntpd state=running enabled=yes" -s -K ansible openstack -m service -a "name=ntpd state=started" -s -K ansible openstack -m service -a "name=ntp state=present" -s -K ansible openstack -m service -a "name=ntp state=started" -s -K ansible openstack -m service -a "name=ntp state=start" -s -K
ansible 167.205.23.38 -m service -a "name=rabbitmq-server state=running enabled= yes" -s -K ansible 167.205.23.38 -m service -a "service=firewalld state=reloaded" -s -K ansible 167.205.23.38 -m service -a "service=firewalld state=reloaded" -s -K ansible mx -m shell -a "echo $TERM" -u root ansible 167.205.23.38 -m yum -a "name=mariadb,mariadb-server,MySQL-python state= present" -s -K ansible openstack -m yum -a "name=mariadb,mariadb-server,MySQL-python state=pres ent" -s -K ansible openstack -m yum -a "name=ntp state=present" -s -K ansible openstack -m yum -a "name=openstack-selinux state=present" -s -K ansible openstack -m yum -a "name=openstack-selinux state=present" -s -K ansible 167.205.23.38 -m yum -a "name=rabbitmq-server state=present" -s -K ansible openstack -m yum -a "name=* state=latest" -s -K ansible openstack -m yum -a "name=* state=latest" -s -K # Ebook: Ansible Configuration Management, Daniel Hall ## Machine Servers where we execute ansible commands: controller machine Servers which we configure using ansible: managed machine ## Inventory file example: cat ./hosts: [kvm] vm1 ansible_ssh_user=pras ansible_ssh_host=167.205.1.44 vm2 ansible_ssh_host=167.205.1.45 vms1 ansible_ssh_host=167.205.51.131 VMS1 ansible_ssh_host=167.205.51.135 vms4 ansible_ssh_host=167.205.51.136 ansible_ssh_private_key_file=/home/pras/.ssh/id_rsa [ai3] vm1 vm2 [labtek5] VMS1 vms1 vms4 ## Ping module to check connectivity, if no ssh-key configured, use --ask-pass/k to ask ssh password example: ansible -i ./hosts ai3 -m ping vm1 | SUCCESS => { "changed": false, "ping": "pong" } vm2 | SUCCESS => { "changed": false, "ping": "pong" } ## Setup module to get "facts" about managed machines, use --become/-b and --ask -become-pass/-K (--become-method=[ sudo | su | pbrun | pfexec | runas | doas | d zdo ], default sudo) to use sudo example: ansible -i ./hosts ai3 -bK -m setup
SUDO password: vm2 | SUCCESS => { "ansible_facts": { "ansible_all_ipv4_addresses": [ "167.205.1.45", "192.168.122.1" ], ... }, "changed": false } vm1 | SUCCESS => { "ansible_facts": { "ansible_all_ipv4_addresses": [ "167.205.1.44", "192.168.122.1" ], ... }, "changed": false } ## File module for manipulating file in Linux/UNIX example: check file status ansible -i ./hosts vm1 -m file -a "path=/etc/fstab" vm1 | SUCCESS => { "changed": false, "gid": 0, "group": "root", "mode": "0644", "owner": "root", "path": "/etc/fstab", "size": 962, "state": "file", "uid": 0 } example: create test directory ansible -i ./hosts vm1 -bK -m file -a "path=/tmp/test state=directory mode=0700 owner=root" SUDO password: vm1 | SUCCESS => { "changed": true, "gid": 0, "group": "root", "mode": "0700", "owner": "root", "path": "/tmp/test", "size": 4096, "state": "directory", "uid": 0 } example: remove file /tmp/testing in managed machine(s) ansible -i ./hosts vm1 -m file -a 'path=/tmp/testing state=absent' vm1 | SUCCESS => { "changed": true, "path": "/tmp/testing",
"state": "absent" } ## Copy module which accept similar argument as file module and used to copy fil es/directories from controller machine to managed machine(s) example: copy controller /etc/fstab to managed /tmp/fstab ansible -i ./hosts vm1 -bK -m copy -a "src=/etc/fstab dest=/tmp/fstab mode=0700 owner=root" SUDO password: vm1 | SUCCESS => { "changed": true, "checksum": "34d76332c6cee1b7bacaa1c8d84b3bb9e3366b50", "dest": "/tmp/fstab", "gid": 0, "group": "root", "md5sum": "ec8055831664f653d5cf53ce1b1e6ad7", "mode": "0700", "owner": "root", "size": 913, "src": "/home/pras/.ansible/tmp/ansible-tmp-1466496898.81-140941064107821/so urce", "state": "file", "uid": 0 } ## Command module to execute arbitrary command on managed machine(s), doesn't ru n command within shell so you cannot perform redirection, use pipes, expand shel l variables or background command, use creates or removes arguments to help this module notice any changes, often it is better to use another module in place of command module example: remove /tmp/testing from managed machine ansible -i ./hosts vm1 -m command -a 'rm /tmp/testing removes=/tmp/testing' vm1 | success | rc=0 >> skipped, since /tmp/testing does not exist example: create file /tmp/testing in managed machine ansible -i ./hosts vm1 -m command -a 'touch /tmp/testing creates=/tmp/testing' vm1 | success | rc=0 >> ## Shell module to execute commands in shell so you can use redirection, pipes, or job backgrounding, support creates argument but not removes example: ansible machinename -m shell -a '/opt/fancyapp/bin/installer.sh > /var/log/fancy appinstall.log creates=/var/log/fancyappinstall.log' ## Ansible-doc to get information about ansible module example: get short description from all module ansible-doc -l a10_server Manage A10 Networks AX/SoftAX/Thunder/vThunde r devices a10_service_group Manage A10 Networks devices' service groups a10_virtual_server Manage A10 Networks devices' virtual servers acl Sets and retrieves file ACL information. add_host add a host (and alternatively a group) to the ansible-playbook in-memory inventory ... example: get information from file module ansible-doc file > FILE
Sets attributes of files, symlinks, and directories, or removes files/symlinks /directories. Many other modules support the same options as the [file] module including [copy], [template], and [assemble]. Options (= is mandatory): - follow This flag indicates that filesystem links, if they exist, should be foll owed. (Choices: yes, no) [Default: no] - force force the creation of the symlinks in two cases: the source file does no t exist (but will appear later); the destination exists and is a file (so, we ne ed to unlink the "path" file and create symlink to the "src" file in place of it). (Choic es: yes, no) [Default: no] - group name of the group that should own the file/directory, as would be fed to `chown' [Default: None] ... ## Ansible playbooks is a method to use ansible scripting ability to full extend , playbooks in ansible are expressed in YAML and using standard YAML parser, the command to execute playbook is ansible-playbook example: execute playbook example-play.yml ansible-playbook example-play.yml ## Ansible playbooks are made up of one or more plays, a play is consists of thr ee sections: the target section, the variable section, and the task section example: a simple example of play --- hosts: localhost user: root vars: motd_warning: 'WARNING: Use by ACME Employees ONLY' tasks: - name: setup a MOTD copy: dest=/etc/motd content={{ motd_warning }} ### the target section defines hosts on which the play will be run and how it wi ll run, set ssh username, other ssh-related settings example: a simple target section - hosts: webservers user: root sudo: [ yes | no ] user: sudo_user: connection: [ local | ssh | paramiko ] gather_facts: [ true | false ] ### the variable section defines variables which will be made available to the p lay while running, you can also make ansible prompt for variables if they weren' t supplied, variables in this section can be overidden by machine facts, but the y override facts in inventory, you can use placeholders like {{ variablename }}, ${variablename}, or $variablename, for complex variables use dotted notation e. g. {{ httpd.maxclients }}, {{ ansible_eth0.ipv4.address }}, variables in this se ction do not survive between different plays in the same playbook, however, fact s gathered by setup module or set by set_fact do, so for second play you can set gather_facts to false example: a simple variable section vars: apache_version: 2.6
motd_warning: 'WARNING: Use by ACME Employees ONLY' testserver: yes example: load variables from external yaml file vars_files: /conf/country-AU.yml /conf/datacenter-SYD.yml /conf/cluster-mysql.yml example: external variables yaml file --ntp: 'ntp1.au.example.com' TZ: 'Australia/Sydney' example: ansible variable prompt for sensitive variables or which required human interaction (e.g. SSL passphrase) vars_prompt: - name: 'https_passphrase' prompt: 'Key Passphrase' private: yes ### the task section lists all the modules in the order that you want them to be run by ansible, there are several ways to represent each module configuration, try to stick with one so the code will be easier to maintain example: simple task section with three style shown tasks: - name: install apache action: yum name=httpd state=installed - name: configure apache copy: src=files/httpd.conf dest=/etc/httpd/conf/httpd.conf - name: restart apache service: name: httpd state: restarted ### the handlers section lists all modules which only run when they called by mo dules in task section, just add notify key with value the name of handler example: handlers section for isc-dhcp service --- hosts: dhcp tasks: - name: update to latest DHCP action: yum name=dhcp state=latest notify: restart dhcp - name: copy the DHCP config action: copy src=dhcp/dhcpd.conf dest=/etc/dhcp/dhcpd.conf notify: restart dhcp - name: start DHCP at boot action: service name=dhcpd state=started enabled=yes handlers: - name: restart dhcp action: service name=dhcpd state=restarted example: call multiple handlers from a single task --- hosts: qroud tasks: - name: checkout Qroud action: git [email protected]:smarthall/Qroud.git dest=/opt/apps/Qroud for ce=no notify: - migrate db - generate static - restart httpd
handlers: - name: migrate db action: command chdir=/opt/apps/Qroud ./manage.py migrate â all - name: generate static action: command chdir=/opt/apps/Qroud ./manage.py collectstatic -c â noinput - name: restart httpd action: service name=httpd state=restarted ## Playbook modules consist of modules which cannot run in command line because they depends on facts gathered from setup modules and other modules which can ru n in command line but are able to provide enhanced functionalities when used in a playbook ### the template module requires facts from ansible and allows you to design an outline of a configuration file then have ansible insert values in the right pla ces using jinja2 and also use complex structures such as conditional, loops, and macros example: jinja2 template for BIND configuration # {{ ansible_managed }} options { listen-on port 53 { 127.0.0.1; {% for ip in ansible_all_ipv4_addresses %} {{ ip }}; {% endfor %} }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; {# Variables for zone config #} {% if 'authorativenames' in group_names %} {% set zone_type = 'master' %} {% set zone_dir = 'data' %} {% else %} {% set zone_type = 'slave' %} {% set zone_dir = 'slaves' %} {% endif %} zone "internal.example.com" IN { type {{ zone_type }}; file "{{ zone_dir }}/internal.example.com"; {% if 'authorativenames' not in group_names %} masters { 192.168.2.2; }; {% endif %} }; example: using template module on playbook --- name: Setup BIND host: allnames tasks: - name: configure BIND template: src=templates/named.conf.j2 dest=/etc/named.conf
owner=root group=named mode=0640 ### the set_fact module allows you to build your own facts on the machine inside an ansible play, you should use this to avoid putting complex logic into templa tes example: configure mysql server to have an innodb buffer size approximately hal f of the total ram available --- name: Configure MySQL hosts: mysqlservers tasks: - name: install MySql yum: name=mysql-server state=installed - name: Calculate InnoDB buffer pool size set_fact: innodb_buffer_pool_size_mb="{{ ansible_memtotal_mb / 2 }}" - name: Configure MySQL template: src=templates/my.cnf.j2 dest=/etc/my.cnf owner=root group=root mod e=0644 notify: restart mysql - name: Start MySQL service: name=mysqld state=started enabled=yes handlers: - name: restart mysql service: name=mysqld state=restarted example: template file for configure mysql server # {{ ansible_managed }} [mysqld] datadir=/var/lib/mysql socket=/var/lib/mysql/mysql.sock # Disabling symbolic-links is recommended to prevent assorted security risks symbolic-links=0 # Settings user and group are ignored when systemd is used. # If you need to run mysqld under a different user or group, # customize your systemd unit file for mysqld according to the # instructions in http://fedoraproject.org/wiki/Systemd # Configure the buffer pool innodb_buffer_pool_size = {{ innodb_buffer_pool_size_mb|default(128) }}M [mysqld_safe] log-error=/var/log/mysqld.log pid-file=/var/run/mysqld/mysqld.pid ### the pause module stop execution of playbook for a certain period of time, yo u should not use it for waiting for networked daemons to start up, you should us e wait_for module example: using the pause module first in the user interactive mode and then in t he timed mode --- hosts: localhost tasks: - name: wait on user input pause: prompt="Warning! Detected slight issue. ENTER to continue CTRL-C a to quit." - name: timed wait pause: seconds=30 ### the wait_for module is used to poll a particular tcp port and not continue u ntil that port accepts a remote connection example: use wait_for to recognize tomcat is ready to accept connection --- hosts: webapps
tasks: - name: Install Tomcat yum: name=tomcat7 state=installed - name: Start Tomcat service: name=tomcat7 state=started - name: Wait for Tomcat to start wait_for: port=8080 state=started ### the assemble module combines several files in managed machine and saves them to another file on the managed machine example: this play will send a bunch of ssh public keys and assemble it in root user's home directory --- hosts: all tasks: - name: Make a Directory in /opt file: path=/opt/sshkeys state=directory owner=root group=root mode=0700 - name: Copy SSH keys over copy: src=keys/{{ item }}.pub dest=/opt/sshkeys/{{ item }}.pub owner=root gr oup=root mode=0600 with_items: - dan - kate - mal - name: Make the root users SSH config directory file: path=/root/.ssh state=directory owner=root group=root mode=0700 - name: Build the authorized_keys file assemble: src=/opt/sshkeys dest=/root/.ssh/authorized_keys owner=root group= root mode=0700 ### the add_host module lets you dynamically add new machine inside a play, the module takes a hostname and groups argument ### the group_by module can create groups based on the facts about the machine, the group_by module accept one argument: key example: create group based on operating systems --- name: Create operating system group hosts: all tasks: - group_by: key=os_{{ ansible_distribution }} - name: Run on CentOS hosts only hosts: os_CentOS tasks: - name: Install Apache yum: name=httpd state=latest - name: Run on Ubuntu hosts only hosts: os_Ubuntu tasks: - name: Install Apache apt: pkg=apache2 state=latest ## Advanced playbooks using many techniques to give much more control over the e xecution of your playbook ## ansible can run operation in parallel, by default ansible will fork up to fiv e times so it will run an operation on five different machine at once, if you ha ve large number of machine or have lowered this maximum fork value, then you may want to launch things asynchronously, to run an operation in parallel, use the async and poll keywords, the async keyword triggers ansible to run the job in pa
rallel and its value will be the maximum time that ansible will wait for the com mand to complete, the value of poll indicates to ansible how often to poll to ch eck if the command has been completed example: play to run updatedb across entire cluster e following code: - hosts: all tasks: - name: Install mlocate yum: name=mlocate state=installed - name: Run updatedb command: /usr/bin/updatedb async: 300 poll: 10 ## you will want to use ansible's polling in the following situations: you have a long-running task that may hit the timeout, you need to run an operation acros s a large number of machines, you have an operation for which you don't need to wait to complete. there are also a few situations where you should not use async or poll: if your job acquires locks that prevent other things from running, you job only takes a short time to run ## looping: ansible allow you to repeat a module several times with different in put using with_items key, in addition, ansible can also use what are called look up plugins, these plugins allow you to tell ansible to fetch the data from somew here else example: secure config files tasks: - name: Secure config files file: path=/etc/{{ item }} mode=0600 owner=root group=root with_items: - my.cnf - shadow - fstab example: upload public keys in a directory and then assemble them in authorized_ keys file for the root user tasks: - name: Make key directory file: path=/root/.sshkeys ensure=directory mode=0700 owner=root group=root - name: Upload public keys copy: src={{ item }} dest=/root/.sshkeys mode=0600 owner=root group=root with_fileglob: - keys/*.pub - name: Assemble keys into authorized_keys file assemble: src=/root/.sshkeys dest=/root/.ssh/authorized_keys mode=0600 owner= root group=root ## repeating modules can be used in the following situations: repeating a module many times with similar settings, iterating over all the values of a fact that is a list, used to create many files for later use with the assemble module to combine into one large file, used with_fileglob to copy a directory of files usi ng the glob pattern matching ## conditional execution: some modules, such as the copy module, provide mechani sm to configure it to skip the module at certain condition, to skip a module you can use the when key example: choose between apt and yum for debian and redhat system --- name: Install VIM hosts: all tasks:
- name: Install VIM via yum yum: name=vim-enhanced state=installed when: ansible_os_family == "RedHat" - name: Install VIM via apt apt: name=vim state=installed when: ansible_os_family == "Debian" - name: Unexpected OS family debug: msg="OS Family {{ ansible_os_family }} is not supported" fail=yes when: not ansible_os_family == "RedHat" or ansible_os_family == "Debian" ## there are numerous uses of skipping actions; here are a few suggestions: work ing around differences in operating systems, prompting a user and only then perf orming actions that they request, improving performance by avoiding a module tha t you know won't change anything but may take a while to do so, refusing to alte r systems that have a particular file present, checking if custom written script s have already been run ## task delegation: if you need to perform an action on a different host than th e one ansible is operation on, you can use delegation using the delegate_to key example: a playbook that will use the get_url option to download the configurati on from a bunch of webservers --- name: Fetch configuration from all webservers hosts: webservers tasks: - name: Get config get_url: dest=configs/{{ ansible_hostname }} force=yes url=http://{{ ansib le_hostname }}/diagnostic/config delegate_to: localhost example: shortcut to delegate to the localhost using the local_action key --- name: Fetch configuration from all webservers hosts: webservers tasks: - name: Get config local_action: get_url dest=configs/{{ ansible_hostname }}.cfg url=http://{ { ansible_hostname }}/diagnostic/config ## delegation is not limited to the local machine. you can delegate to any host that is in the inventory. some other reasons why you might want to delegate are: removing a host from a load balancer before deployment, changing dns to direct traffic away from a server you are about to change, creating an iscsi volume on a storage device, using an external server to check that access outside the netw ork works ## extra variables: ### The hostvars variable allows you to retrieve variables about all the hosts t hat the current play has dealt with example: sets a variable called zone master to the server --- name: Setup DNS Servers hosts: allnameservers tasks: - name: Install BIND yum: name=named state=installed - name: Setup Slaves hosts: slavenamesservers tasks: - name: Get the masters IP set_fact: dns_master="{{ hostvars.ns1.ansible_default_ipv4.address }}"
- name: Configure BIND template: dest=/etc/named.conf src/templates/named.conf.j2 ### to find the address of a machine named in the variable the_machine you would use, {{ hostvars.[the_machine].default_ipv4.address }} ### The groups variable containes a list of all hosts in the inventory grouped b y inventory group example: play to configure database --- name: Configure the database hosts: dbservers user: root tasks: - name: Install mysql yum: name={{ item }} state=installed with_items: - mysql-server - MySQL-python - name: Start mysql service: name=mysqld state=started enabled=true - name: Create a user for all app servers with_items: groups.appservers mysql_user: name=kate password=test host={{ hostvars.[item].ansible_eth0.i pv4.address }} state=present example: play create a known_hosts files for all of your machines containing hos t keys of all other machines --hosts: all tasks: - name: Setup known hosts hosts: all tasks: - name: Create known_hosts template: src=templates/known_hosts.j2 dest=/etc/ssh/ssh_known_hosts owner=root group=root mode=0644 example: known_hosts.j2 template {% for host in groups['all'] %} {{ hostvars[host]['ansible_hostname'] }} {{ hostvars[host]['ansible_ssh_host_key _rsa_public'] }} {% endfor %} ### The group_names variable contains a list of strings with the names of all th e groups the current host is in, the variable is mostly useful for skipping a ta sk or in a template as a condition example: play to configure secure and less secure sshd - name: Setup SSH hosts: sshservers tasks: - name: For secure machines set_fact: sshconfig=files/ssh/sshd_config_secure when: "'secure' in group_names" - name: For non-secure machines set_fact: sshconfig=files/ssh/sshd_config_default when: "'secure' not in group_names" - name: Copy over the config copy: src={{ sshconfig }} dest=/tmp/sshd_config ### The inventory_hostname variable stores the hostname of the server as recorde d in the inventory, you should use this if you have chosen not to run the setup
module on the current host or if for various reasons the value detected by the s etup module is not correct, this is useful when you are doing the initial setup of the machine and changing the hostname ### The inventory_hostname_short variable is same as previous one, however, it o nly includes the characters up to the first dot ### The inventory_dir variable is the path name of the directory containing the inventory file ### The inventory_file variable is the same as previous one except it is also in clude the filename ## you can dereference variables in all module argument using {{ and }}, you can also find files using variables example: play to select different config file for NRPE based on architecture --- name: Configure NRPE for the right architecture hosts: ansibletest user: root tasks: - name: Copy in the correct NRPE config file copy: src=files/nrpe.{{ ansible_architecture }}.conf dest=/etc/nagios/nrpe .cfg example: check several config file and get the first file found using copy --- name: Install an Apache config file hosts: ansibletest user: root tasks: - name: Get the best match for the machine copy: dest=/etc/apache.conf src={{ item }} first_available_file: - files/apache/{{ ansible_os_family }}-{{ ansible_architecture }}.cfg - files/apache/default-{{ ansible_architecture }}.cfg - files/apache/default.cfg ## environment variables can be used in ansible to set remote access example: play to upload a remote file via S3 --- name: Upload a remote file via S3 hosts: ansibletest user: root tasks: - name: Setup EPEL command rpm -ivh http://download.fedoraproject.org/pub/epel/6/i386/epel-re lease-6-8.noarch.rpm creates=/etc/yum.repos.d/epel.repo - name: Install pip yum: name=python-pip state=installed - name: Install the AWS tools pip: name=awscli state=present - name: Upload the file shell: aws s3 put-object --bucket=my-test-bucket --key={{ ansible_hostname }}/fstab --body=/etc/fstab --region=eu-west-1 environment: AWS_ACCESS_KEY_ID: XXXXXXXXXXXXXXXXXXX AWS_SECRET_ACCESS_KEY: XXXXXXXXXXXXXXXXXXXXX ## some ansible modules such as get_url, yum, and apt will also use environment variables to set their proxy server, some of the other situations where you migh
t want to set environment variables are as follows: running application installe rs, adding extra items to the path when using the shell module, loading librarie s from a place not included in the system library search path, using an ld_prelo ad hack while running a module ## you can do external data lookup using ansible to fetch data from outside sour ces like environment variables from controller machine example: get http_proxy value from environment and send it through to the config ured machine --- name: Downloads a file using the same proxy as the controlling machine hosts: all tasks: - name: Download file get_url: dest=/var/tmp/file.tar.gz url=http://server/file.tar.gz environment: http_proxy: "{{ lookup('env', 'http_proxy') }}" example: dynamically register a webapp farm using with_sequence --- name: Registers the app server farm hosts: localhost connection: local vars: hostcount: 5 tasks: - name: Register the webapp farm local_action: add_host name={{ item }} groupname=webapp with_sequence: start=1 end={{ hostcount }} format=webapp%02x ## situations where lookup plugins are useful are as follows: copying a whole di rectory of apache config to a conf.d style directory, using environment variable s to adjust what the playbooks does, getting configuration from dns txt records, fetching the output of a command into a variable ## you can store the returned variable from ansible modules and use them later i n the playbook using the register key example: play to look at the mode in the /tmp directory and create new directory with the same mode --- name: Using register hosts: ansibletest user: root tasks: - name: Get /tmp info file: dest=/tmp state=directory register: tmp - name: Set mode on /var/tmp file: dest=/tmp/subtmp mode={{ tmp.mode }} state=directory ## register allows you to make your own facts about hosts from modules already a vailable to you. this can be useful in many different circumstances: getting a l ist of files in a remote directory and downloading them all with fetch, running a task when a previous task changes, before the handlers run, getting the conten ts of the remote host ssh key and building a known_hosts file ## you can debug playbooks using ansible verbose mode or a debug module, you can also use modules such as fetch and get_url for help ### The debug module takes two optional arguments, msg and fail, msg sets the me ssage that will be printed by the module and fail, if set to yes indicates a fai lure to ansible, which will stop playbook execution for that host
example: use debug module to list all the interfaces available on the machine --- name: Demonstrate the debug module hosts: ansibletest user: root vars: hostcount: 5 tasks: - name: Print interface debug: msg="{{ item }}" with_items: ansible_interfaces output: PLAY [Demonstrate the debug module] ********************************* GATHERING FACTS ***************************************************** ok: [ansibletest] TASK: [Print IP address] ******************************************** ok: [ansibletest] => (item=lo) => {"item": "lo", "msg": "lo"} ok: [ansibletest] => (item=eth0) => {"item": "eth0", "msg": "eth0"} PLAY RECAP ********************************************************** ansibletest : ok=2 changed=0 unreachable=0 failed=0 ### The verbose mode is other option for debugging, especially useful if you are using the register keyword, simply add --verbose to command-line ### The check mode instructs ansible to walk through the play without actually m aking any changes to remote systems, ansible also has diff mode which shows the changes that are made by the template module ### The pause module is used to pause the playbook while you examine the configu red machine as it runs ## Larger projects need special methods to prevent things from going out of cont rol, such as: separating playbooks into different files and including them from some other location, using roles to include multiple files that perform a simila r function, methods for increasing speed at which ansible configures your machin es ## you can use includes to split your plays into multiple section and then inclu de each section from other plays, there are four types of includes: variable inc ludes which allow you to put your variables in external yaml files, playbook inc ludes which is used to include plays from other files in a single play, task inc ludes which let you put common tasks in other files and include them wherever re quired, handler includes which let you put all your handlers in the one place ## task includes can be used when you have a lot of common tasks that will be re peated, task includes inherit facts from the play they are included from and you can also provide your own variables, task includes can have conditionals applie d on them, the file to include as a task includes contains a list of tasks example: task includes to create a bunch of users and set up their environment w ith their public keys --# Requires a user variable to specify user to setup - name: Create user account user: name={{ user }} state=present - name: Make user SSH config dir file: path=/home/{{ user }}/.ssh owner={{ user }} group={{ user }} mode=0600 s tate=directory - name: Copy in public key copy: src=keys/{{ user }}.pub dest=/home/{{ user }}/.ssh/authorized_keys mode= 0600 owner={{ user }} group={{ user }}
example: play which use task includes above --- hosts: ansibletest user: root tasks: - include: usersetup.yml user={{ item }} with_items: - mal - dan - kate ## handler includes look same as task includes and allow you to reuse same handl ers multiple times, ansible allows you to include other files in the handlers se ction example: a tipical handler include file after configuring email --- name: config sendmail command: make -C /etc/mail notify: reload sendmail - name: config aliases command: newaliases notify: reload sendmail - name: reload sendmail service: name=sendmail state=reloaded - name: restart sendmail service: name=sendmail state=restarted example: play which use handler include above --hosts: mailers tasks: - name: update sendmail yum: name=sendmail state=latest notify: restart sendmail - name: configure sendmail template: src=templates/sendmail.mc.j2 dest=/etc/mail/sendmail.mc notify: config sendmail handlers: - include: sendmailhandlers.yml ## playbook includes should be used when you want to include a whole set of task s designated for a set of machines, it allows you to include the whole plays, th is is handy when you want to run multiple different actions at once example: use multiple playbooks for site upgrade operation --- include "drfailover.yml" - include "upgradeapp.yml" - include "drfailback.yml" - name: Notify management hosts: local tasks: - local_action: mail to="[email protected]" msg='The application has bee n upgraded and is now live' - include "drupgrade.yml" ## roles allow you to group files together in a defined format, roles allows you to place your variables, files, tasks, templates, and handlers in a folder, the n easily include them, roles are commonly set up to be services provided by mach ines, but they can also be daemons, options, or simply characteristics ## things you may want to configure in a role are as follows: webservers, such a s nginx, apache; messages of the day customized for the security level of the ma
chine, database servers running postgresql or mysql ## to manage roles in ansible perform the following steps: 1. Create a folder named roles with your playbooks. 2. In the roles folder, make a folder for each role that you would like. 3. In the folder for each role, make folders named files, handlers, meta, tasks, templates, and finally vars. If you aren't going to use all these, you can leav e the ones you don't need off. Ansible will silently ignore any missing files or directories when using roles. 4. In your playbooks, add the keyword roles followed by a list of roles that you would like to apply to the hosts. 5. For example, if you had the common, apache, website1, and website2 roles, you r directory structure would look similar to the following example. The site.yml file is for reconfiguring the entire site, and the webservers1.yml and webserver s2.yml files are for configuring each web server farm. example: tree directory of roles +- inventory.ini +- roles | +- apache | | +- files | | +- handlers | | | +- main.yml | | +- meta | | +- tasks | | | +- main.yml | | +- templates | | | +- httpd.conf.j2 | | +- vars | | +- main.yml | +- common | | +- files | | | +- bashrc | | +- handlers | | +- meta | | +- tasks | | | +- main.yml | | +- templates | | | +- motd.j2 | | +- vars | | +- main.yml | +- website1 | | +- files | | +- handlers | | | +- main.yml | | +- meta | | +- tasks | | | +- main.yml | | +- templates | | | +- environment.yml.j2 | | | +- website1.conf.j2 | | +- vars | | +- main.yml | +- website1 | +- files | +- handlers | | +- main.yml | +- meta | +- tasks | | +- main.yml | +- templates
| | +- environment.yml.j2 | | +- website2.conf.j2 | +- vars | +- main.yml +- website1.yml +- website2.yml example: example content of website1.yml --- name: Setup servers for website1.example.com hosts: website1 roles: - common - apache - { role: website1, port: 80 } ## ansible will then try to load roles/common/tasks/main.yml as a task include, roles/common/handlers/main.yml as a handler include, and roles/common/vars/main. yml as a variable file include, if all of these files are missing, ansible will throw an error, however, if one of the files exists then the others, if missing, will be ignored, the following directories are used by a default install of ans ible ## other directories may be used by different modules: 1. tasks: the tasks folder should contain a main.yml file, which should include a list of the tasks for this role, any task includes that are contained in these roles will look for their files in this folder also, this allows you to split a large number of tasks into separate files, and use other features of task inclu des 2. files: the files folder is the default location for files in the roles that a re used by the copy or the script module 3. templates: the templates directory is the location where the template module will automatically look for the jinja2 templates included in the roles 4. handlers: the handlers folder should contain a main.yml file, which specifies the handlers for the roles, and any includes in that folder will also look for the files in the same location 5. vars: the vars folder should contain a main.yml file, which contains the var iables for this role 6. meta: the meta folder should contain a main.yml file, this file can contain s ettings for the role, and a list of its dependencies, this feature is available only in ansible 1.3 and above 7. defaults: you should use the default folder if you are expecting variables to be sent to this roles, and you want to make them optional, a main.yml file in t his folder is read, to get the initial values for variables that can be overridd en by variables, which are passed from the playbook calling the role, this featu re is only available in ansible 1.3 and above ## ansible 1.3 have two new features, the first feature is the metadata roles, t he allow you to specify that your role depends on the other roles, the second fe ature is variable defaults values, if you place a main.yml file in the default d irectory for the role, these variables will be read into the role, however they can be overridden by variables in the vars/main.yml example: a simple meta/main.yml --allow_duplicates: no dependencies: - apache example: a simple defaults/main.yml --port: 80
## there are several tricks to make ansible work faster on bigger scale, ansible tags are feature that allow you to select which parts of a playbook you need to run and which should be skipped, if you know you don't need certain actions to be run, you can select only run modules that have been tagged with a particular tag, if you don't specify tags on command-line the default action is to run ever y tasks example: install and setup webserver using tag --- name: Install and setup our webservers hosts: webservers tasks: - name: install latest software action: yum name=$item state=latest notify: restart apache tags: - patch with_items: - httpd - webalizer - name: Create subdirectories action: file dest=/var/www/html/$item state=directory mode=755 owner=apache group=apache tags: - deploy with_items: - pub - name: Copy in web files action: copy src=website/$item dest=/var/www/html/$item mode=755 owner=apach e group=apache tags: - deploy with_items: - index.html - logo.png - style.css - app.js - pub/index.html - name: Copy webserver config tags: - deploy - config action: copy src=website/httpd.conf dest=/etc/httpd/conf/httpd.conf mode=644 owner=root group=root notify: reload apache - name: set apache to start on startup action: service name=httpd state=started enabled=yes handlers: - name: reload apache service: name=httpd state=reloaded - name: restart apache service: name=httpd state=restarted example: run a playbook with tags $ ansible-playbook webservers.yml --tags deploy example: configure roles to execute with tags --- hosts: website1 roles: - common - { role: apache, tags: ["patch"] } - { role: website2, tags: ["deploy", "patch"] }
## ansible include pull mode which can drastically improve the scalability of yo ur playbooks, in this mode, you provide your configuration in a git repository w hich ansible downloads and uses to configure your machine, pull mode requires so me setup on the nodes you want configured example: setup play mode on a machine --- name: Ansible Pull Mode hosts: pullhosts tasks: - name: Setup EPEL action: command rpm -ivh http://download.fedoraproject.org/pub/epel/6/i386 /epel-release-6-8.noarch.rpm creates=/etc/yum.repos.d/epel.repo - name: Install Ansible + Dependencies yum: name={{ item }} state=latest enablerepo=epel with_items: - ansible - git-core - name: Make directory to put downloaded playbooks in file: state=directory path=/opt/ansiblepull - name: Setup cron cron: name="ansible-pull" user=root minute="*/5" state=present job="ansibl e-pull -U https://git.int.example.com.com/gitrepos/ansiblepull.git -D /opt/ansib lepull {{ inventory_hostname_short }}.yml" ## you should use ansible's pull mode in the following situations: your node mi ght not be available when configuring them, such as members of auto-scaling serv er farms; you have a large amount of machines to configure and even with large v alues of forks, it would take a long time to configure them all; you want machin es to update their configuration automatically when the repository changes; you want to run ansible on a machine that may not have network access yet, such as i n a kick start post install ## however, pull mode does have the following disadvantages that make it unsuita ble for certain circumstances: to connect to other machines and gather variables , or copy a file you need to have credentials on the managed nodes; you need to co-ordinate the running of the playbook across a server farm, for example, if yo u could only take three servers offline at a time; the servers are behind strict firewalls that don't allow incoming ssh connections from the nodes you use to c onfigure them for ansible
