ansible

Wat het doet

Zo schrijf je het

ansible PATTERN -m MODULE [-a ARGS] [-i INVENTORY]
ansible-playbook [-i INVENTORY] PLAYBOOK.yml [--check] [--diff]

Belangrijkste delen

Tools

ansible

Run one module on hosts (ad hoc).

ansible-playbook

Run a playbook.

ansible-inventory --graph

Show the inventory.

ansible-doc MODULE

Module docs and examples.

ansible-galaxy collection|role install

Install collections and roles.

ansible-vault create|edit|encrypt|view

Encrypt secret files.

ansible-config dump --only-changed

Show your config changes.

ansible-lint

Check playbooks for bad practice.

ansible-navigator

Run playbooks in execution environments (containers).

Meest gebruikt

Niets past bij dit filter.

$ als gewone gebruiker# als root (of met sudo)

1. 1Install and write an inventory

   #dnf install -y ansible-core
   $cat inventory.ini
   [web]
   web1.lab.local
   web2.lab.local
   [db]
   db1.lab.local ansible_user=admin
   [lab:children]
   web
   db

2. 2Test the connection and run ad hoc commands

   $ansible all -i inventory.ini -m ping
   $ansible web -i inventory.ini -b -m dnf -a "name=nginx state=present"
   $ansible all -i inventory.ini -m command -a "uptime"

3. 3A playbook for web servers

   $cat web.yml
   - name: Web servers
     hosts: web
     become: true
     tasks:
       - name: Install nginx
         ansible.builtin.dnf: { name: nginx, state: present }
       - name: Site config
         ansible.builtin.template: { src: site.conf.j2, dest: /etc/nginx/conf.d/site.conf, mode: "0644" }
         notify: Reload nginx
       - name: Open HTTP and HTTPS
         ansible.posix.firewalld: { service: "{{ item }}", permanent: true, immediate: true, state: enabled }
         loop: [http, https]
       - name: Start nginx
         ansible.builtin.service: { name: nginx, state: started, enabled: true }
     handlers:
       - name: Reload nginx
         ansible.builtin.service: { name: nginx, state: reloaded }

4. 4Dry run first, then apply

   $ansible-playbook -i inventory.ini web.yml --check --diff
   $ansible-playbook -i inventory.ini web.yml

5. 5Run on one host and some tags only

   $ansible-playbook -i inventory.ini site.yml -l web1.lab.local -t nginx

6. 6Keep secrets in a vault

   $ansible-vault create group_vars/db/vault.yml
   $ansible-vault view group_vars/db/vault.yml
   $ansible-playbook -i inventory.ini db.yml --vault-password-file ~/.vault_pass

7. 7Harden SSH on all servers

   $cat ssh-hardening.yml
   - hosts: all
     become: true
     tasks:
       - ansible.builtin.lineinfile:
           path: /etc/ssh/sshd_config.d/50-hardening.conf
           create: true
           line: "{{ item }}"
           mode: "0600"
         loop: ["PermitRootLogin no", "PasswordAuthentication no", "MaxAuthTries 3"]
         notify: Restart sshd
     handlers:
       - name: Restart sshd
         ansible.builtin.service: { name: sshd, state: restarted }

8. 8Collect facts

   $ansible web1.lab.local -i inventory.ini -m setup -a "filter=ansible_distribution*"

9. 9Install collections and roles

   $cat requirements.yml
   collections:
     - name: ansible.posix
     - name: community.general
   $ansible-galaxy collection install -r requirements.yml

10. 10Patch all servers one by one

    $cat patch.yml
    - hosts: web
      become: true
      serial: 1
      tasks:
        - ansible.builtin.dnf: { name: "*", state: latest, security: true }
        - ansible.builtin.reboot:

11. 11Find the docs of a module

    $ansible-doc ansible.builtin.user | less

Niets past bij dit filter.

Bestanden

ansible.cfg

Settings (searched in ./, ~/.ansible.cfg, /etc/ansible/).

inventory.ini / inventory.yml

Hosts and groups.

group_vars/ host_vars/

Variables per group / host.

roles/

Roles (tasks, handlers, templates, defaults).

Exitcodes