Ansible

ansible
bcn sudoers 20131105
Wednesday, November 6, 13
In Science Fiction...
An ansible is a ctional machine capable of instantaneous or superluminal communication.
http://en.wikipedia.org/wiki/Ansible
In Open Source...
https://en.wikipedia.org/wiki/File:Dublin_Philharmonic_Orchestra_performing_Tchaikovsky%27s_Symphony_No_4_in_Charlotte,_North_Carolina.jpg
In Open Source...
IT orchestration engine created by Michael DeHaan Conguration Management Software Deployment Ad-Hoc Command Execution
KISS
KISS
!No client setup
http://www.theregister.co.uk/2007/05/08/dell_box_multipack/
KISS
!No client setup !SSH-based
http://www.cs.umd.edu/faq/ssh.html
KISS
!No client setup !SSH-based !sudo-aware
http://xkcd.com/149/
Business Model
AnsibleWorks Commercial Support Non-free add-ons
Installation
Native Packages Source tarball pip install ansible git clone https://github.com/ansible/ansible.git
!Not on Mac Homebrew!
Hands-on Install
Host Setup
Have proper SSH keys Use ssh-agent Check .ssh/cong
Host Inventory
# production host01 host02:port host[03:50] ... [webservers] host[03:20] [database] host02
Variables
# production host01 host02:port host[03:50] ... [webservers] host[03:20] [webservers:vars] database_server=host02 [database] host02
Execute a command
$ ansible -vvvv -i production remotehost -m setup
Modules
Idempotent ansible-doc
The Play
A set of rules Declarative syntax YAML Idempotent
lineinfile
- name: disable reverse dns lookup in sshd action: lineinfile dest=/etc/ssh/sshd_config state=present regexp="ÛseDNS " line="UseDNS no" insertafter=EOF
Register results
- name: disable reverse dns lookup in sshd action: lineinfile dest=/etc/ssh/sshd_config state=present regexp="ÛseDNS " line="UseDNS no" insertafter=EOF register: sshd_config
Backrefs
- name: apt-sources deb lineinfile: dest=/etc/apt/sources.list backrefs=yes regexp='^(deb .* ${dist} main)$' line='\1 contrib non-free' register: apt_get_update
Shell
- name: apt-sources deb lineinfile: dest=/etc/apt/sources.list backrefs=yes regexp='^(deb .* ${dist} main)$' line='\1 contrib non-free' register: apt_get_update - name: update apt-get cache shell: /usr/bin/apt-get update when: apt_get_update.changed
Iterate
- name: install essential packages action: apt name={{ item }} state=latest with_items: - etckeeper - sudo - iptables-persistent - fail2ban
Conditional execution
- name: disable reverse dns lookup in sshd action: lineinfile dest=/etc/ssh/sshd_config state=present regexp="ÛseDNS " line="UseDNS no" insertafter=EOF register: sshd_config - name: restart sshd when: sshd_config.changed action: service name=ssh state=restarted
Use templates
- name: install default iptables rules action: template src=$item dest=/etc/iptables/rules.v4 first_available_file: - templates/host/${ansible_hostname}/iptables-rules-v4.j2 - templates/iptables-rules-v4.j2 register: new_iptables
Enter the Playbook

Playbook Structure
Vars Hosts Tasks Handlers
Playbook Tree
production stage group_vars/ group1 group2 host_vars/ hostname1 hostname2 site.yml webservers.yml dbservers.yml roles/ common/ tasks/ main.yml handlers/ main.yml templates/ ntp.conf.j2 files/ bar.txt foo.sh vars/ main.yml webtier/ monitoring/ fooapp/ # inventory file for production servers # inventory file for stage environment # here we assign variables to particular groups # "" # # # # # if systems need specific variables, put them here "" master playbook playbook for webserver tier playbook for dbserver tier
# this hierarchy represents a "role" # # <-- tasks file can include smaller files if warranted # # <-- handlers file # <-- files for use with the template resource # <------- templates end in .j2 # # <-- files for use with the copy resource # <-- script files for use with the script resource # # <-- variables associated with this role # same kind of structure as "common" was above, done for the webtier role # "" # ""
http://www.ansibleworks.com/docs/playbooks_best_practices.html
Launch Playbook
$ ansible-play -vvvv -i production playbook.yml
One-shot SSH is expensive
" " "
!
" " "
!
" " "
" "
!
Fireball Mode
Persistent server Requires python-keyczar and python-zmq
Fireball Mode
Transient ZMQ queue + TCP listener Unique, random key
Fireball Mode
Fireball Mode
--- hosts: debian user: root # Uncomment next block to use fireball mode # gather_facts: false # connection: ssh # tasks: # - action: fireball # - hosts: debian # connection: fireball # End comment block for fireball mode vars: ...
Fireball Mode
--- hosts: debian user: root # Uncomment next block to use fireball mode # gather_facts: false # connection: ssh # tasks: # - action: fireball # - hosts: debian # connection: fireball # End comment block for fireball mode vars: ...
E R P E D
T A C
D E
Accelerated Mode
Supercedes Fireball Uses single TCP port Does not depend on ZMQ
Accelerated Mode
--- hosts: all accelerate: true # default port is 5099 accelerate_port: 10000
Local Mode
Non-free
AWX Callback mode
Preguntas?
Gracias!
@codehead javier a.t. rodriguez.org.mx scribd.com/javierrgz

Ansible

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Ansible

Încărcat de

Drepturi de autor:

Formate disponibile

ansible

bcn sudoers 20131105

AnsibleWorks Commercial Support Non-free add-ons

!Not on Mac Homebrew!

Have proper SSH keys Use ssh-agent Check .ssh/cong

Enter the Playbook

One-shot SSH is expensive

" " "

" " "

" " "

Persistent server Requires python-keyczar and python-zmq

Transient ZMQ queue + TCP listener Unique, random key

AWX Callback mode

S-ar putea să vă placă și