ansible

ansible bcn sudoers 20131105

In Science Fiction... “An ansible is a fictional machine capable capable of instantaneous or superluminal communication. “ http://en.wikipedia.org/wi http://en.wikip edia.org/wiki/Ansible ki/Ansible

In Science Fiction... “An ansible is a fictional machine capable capable of instantaneous or superluminal communication. “ http://en.wikipedia.org/wi http://en.wikip edia.org/wiki/Ansible ki/Ansible

In Science Fiction... “An ansible is a fictional machine capable capable of instantaneous or superluminal communication. “ http://en.wikipedia.org/wi http://en.wikip edia.org/wiki/Ansible ki/Ansible

In Science Fiction... “An ansible is a fictional machine capable capable of instantaneous or superluminal communication. “ http://en.wikipedia.org/wi http://en.wikip edia.org/wiki/Ansible ki/Ansible

In Open Source...

In Open Source...

IT orchestration engine created by Michael DeHaan Configuration Management Software Deployment  Ad-Hoc Command Command Execution Execution

KISS

KISS !No

client setup

KISS !No

client setup

!SSH-based

KISS !No

client setup

!SSH-based !sudo-aware

Business Model

 AnsibleWorks  AnsibleW orks Commercial Support Non-free add-ons

Installation Native Packages Source tarball pip install ansible git clone

!Not

on Mac Homebrew!

Hands-on Install

Host Setup

Have proper SSH keys Use ssh-agent Check .ssh/config

Host Inventory # production host01 host02:port host[03:50] ... [webservers] host[03:20] [database] host02

Variables # production host01 host02:port host[03:50] ... [webservers] host[03:20] [webservers:vars] database_server=host02 [database] host02

Execute a command $ ansible -vvvv -i production

-m setup

Modules

Idempotent ansible-doc

The Play

 A set of rules Declarative syntax  YAML  Y AML Idempotent

lineinfile - name: disable reverse dns lookup in sshd action: lineinfile dest=/etc/ssh/sshd_config state=present regexp="^UseDNS " line="UseDNS no" insertafter=EOF

Regi egist ster er resul esults ts - name: disable reverse dns lookup in sshd action: lineinfile dest=/etc/ssh/sshd_config state=present regexp="^UseDNS " line="UseDNS no" insertafter=EOF register: sshd_config

Backrefs - name: apt-sources deb lineinfile: dest=/etc/apt/sources.list backrefs=yes regexp='^(deb .* ${dist} main)$' line='\1 contrib non-free' register: apt_get_update

Shell - name: apt-sources deb lineinfile: dest=/etc/apt/sources.list backrefs=yes regexp='^(deb .* ${dist} main)$' line='\1 contrib non-free' register: apt_get_update - name: update apt-get cache shell: /usr/bin/apt-get update when: apt_get_update.changed

Iterate  

- name: install essential packages action: apt name={{ item }} state=latest with_items: - etckeeper - sudo - iptables-persistent - fail2ban

Conditional execution - name: disable reverse dns lookup in sshd action: lineinfile dest=/etc/ssh/sshd_config state=present regexp="^UseDNS " line="UseDNS no" insertafter=EOF register: sshd_config - name: restart sshd when: sshd_config.changed action: service name=ssh state=restarted

Use templates  

- name: install default iptables rules action: template src=$item dest=/etc/iptables/rules.v4 first_available_file: - templates/host/${ansible_hostname}/ipt templates/host/${ansible_hostname}/iptables-rules-v4.j2 ables-rules-v4.j2 - templates/iptables-rules-v4.j2 register: new_iptables

Enter the Playbook

Playbook Structure

 Vars  V ars Hosts  Tasks  T asks Handlers

Playbook Tree production stage group_vars/ group1 group2 host_vars/ hostname1 hostname2 site.yml webservers.yml dbservers.yml roles/ common/ tasks/ main.yml handlers/ main.yml templates/ ntp.conf.j2 files/ bar.txt foo.sh vars/ main.yml webtier/ monitoring/ fooapp/

# inventory file for production servers # inventory file for stage environment # here we assign variables to partic particular ular groups # "" # # # # #

if systems need specific variables, put them here "" master playbook playbook for webserver tier playbook for dbserver tier

# this hierarchy represents a "role" # # <-- tasks file can include smaller files if warranted # # <-- handlers file # <-- files for use with the template resource # <------- templates end in .j2 # # <-- files for use with the copy resource # <-- script files for use with the script resource # # <-- variables associated with this role # same kind of structure as "common" was above, done for the webtier role # "" # ""

Launch Playbook $ ansible-play -vvvv -i production playbook.yml

One-shot SSH is expensive

" "

"

!

" "

"

!

"

"

"

" "

!

Fireball Fir eball Mode

Persistent server Requires python-keyczar and python-zmq

Fireball Fir eball Mode

 Transient  T ransient ZMQ ZMQ queue + TCP TCP listener Unique, random key

Fireball Fir eball Mode

Fireball Fir eball Mode --- hosts: debian user: root # Uncomment next block to use fireball mode # gather_facts: false # connection: ssh # tasks: # - action: fireball # - hosts: debian # connection: fireball # End comment block for fireball mode   vars: ...

Fireball Fir eball Mode --- hosts: debian user: root # Uncomment next block to use fireball mode # gather_facts: false # connection: ssh # tasks: # - action: fireball # - hosts: debian # connection: fireball # End comment block for fireball mode   vars: ...

Acce cceler lerated ated Mode Mode

Supercedes Fireball Uses single TCP port Does not depend on ZMQ

Acce cceler lerated ated Mode Mode --- hosts: all accelerate: true # default port is 5099 accelerate_port: 10000

Local Mode

Non-free

 AWX  Callback mode

¿Preguntas?

¡Gracias! @codehead scribd.com/javierrgz