A presentation given for J-Labs academy, describing basic Ansible concepts and best practices, adapted to out production environment.

1. Ansible not only for Dummies
@lukaszproszek
Akadamia J-Labs
Kraków, 2016-03-15

2. about:
Senior DevOps Engineer
@ Lumesse
Python enthusiast
Ansible evangelist

3. ANSIBLE

4. All you need is:
SSH connection to the remote host

5. YAML

6. YAML example
---
acronym: TARDIS
full_name: Time And Relative Dimension In Space
other_names:
- the ship
- the blue box
- the police box
occupants:
- name: The Doctor
role: Timelord
hearts: 2
- name: Amelia Pond
role: Companion

7. Basic building blocks

8. Ansible: Basic building blocks.
* inventory
* variables
* modules
* templates
* tasks (handlers, pre-, post-tasks)
* roles
* plays
* playbooks

9. Inventory

10. host1.fqdn
host1 ansible_ssh_host=10.0.0.1
10.0.1.99

11. Inventory groups:
[group1]
host1
host2
[group2]
host1
host3

12. We must go deeper!
[group3:children]
group1
group2

13. Final inventory would look like that:
host[1-4].fqdn
[group1]
host[1-3]
[group2]
host2
[ubergroup:children]
group1
group2

14. Dynamic inventory (Amazon, VMware, Proxmox, ...)
An executable that returns JSON. Must take two
mutually exclusive invocation arguments
--list
{"group_1": {
"hosts": [h1,h2],
"vars": {"k":"v"} }
}
--host HOSTNAME
empty OR {"k1": "v1", "k2": "v2"}
http://docs.ansible.com/ansible/developing_inventory.html

15. Variables

16. variables:
HOST: host_vars/host1.fqdn.yml
GROUP: group_vars/group/vars.yml
* scalars
* lists
* dictionaries

17. Modules

18. modules (plugins):
* action
* callback
* connection
* filter
* lookup
* vars

19. 497

20. 289

21. callback plugins

22. * after every atomic action
* can be used to send e-mails,
hipchat messages, etc

23. connection plugins:
provide connection mechanism
vars plugins:
provide host_vars and group_vars

24. Most probably you will not touch them... ever.

25. filter plugins

26. jinja2 filter definitions.
You will write them to simplify your playbooks.
{{ my_var|upper }}
{{ registered_var|changed }}
{{ other_var|lower|rot13 }}

27. lookup plugins

28. return content based on arguments
e.g. lookup('dns','google.com')
will return google's IP address

29. templates

30. Templating engine is Jinja2.
Allows for easy content customization.
A template has access to:
host and group variables,
facts and registered playbook variables.
Simple flow control:
loops, conditionals, includes, ...

31. {{ ansible_default_ipv4.address }}
{{ ansible_hostname }}
{{ ansible.fqdn }]
{{ inventory_hostname }}
{{ inventory_hostname.short }}

32. USAGE

33. tasks

34. a task is basically a module invocation
e.g.
---
- name: ensure nginx is installed
apt:
name: nginx
state: latest
# ansible-doc module_name

35. Roles

36. a role is a set of tasks
e.g.
---
- apt_key:
id: BBEBDCB318AD50EC6865090613B00F1FD2C19886
keyserver: keyserver.ubuntu.com
- apt_repository:
repo: deb http://repository.spotify.com testing non-free
- apt:
update_cache: yes
- apt:
name: spotify-client
cache_valid_time: 2600

37. Plays

38. ---
- hosts:
- all,!localhost
pre_tasks:
- apt:
update_cache: yes
roles:
- monitoring/nrpe-agent
become: yes
serial: 10
user: ansible
strategy: free
become_user: root

39. Playbooks

40. - hosts:
- all
roles:
- init
- monitoring
- hosts:
- webservers
roles:
- { role: nginx, vserver: management }
- { role: nginx, vserver: client_portal }

41. Bonus:
Ad-Hoc commands

42. Let's install Python!
ansible
all
-m raw
-a "apt-get -qqy install python"

43. Best Practices

44. http://docs.ansible.com/playbooks_best_practices.html
production # inventory file for prod
stage # inventory file for stage
group_vars/
group1 # here we assign variables
# to particular groups
host_vars/
hostname1 # host specific variables
site.yml # master playbook
webservers.yml # playbook for webserver tier
roles/
common/ # roles
monitoring/ #

45. Forget That!
Doesn't scale

46. Keep your roles separate from your inventory
roles/ # roles repository
environments/ # environment repository
production/
prod1
prod2
staging/
stage1
stage2

47. A directory is also a file,
production/ # inventory DIRECTORY
webservers
cache
monitoring
wtf
omg

48. Keep your group and host vars
alongside the inventory
environments/
production/
prod1/
inventory
group_vars/
host_vars/

49. specify the environment during runtime
ansible-playbook -i
environments/production/prod1/inventory
(or make an alias for that)
This way you will not run a playbook
on a wrong environment

50. Don't keep playbooks in the main directory.
Use a tree structure:
plays/
monitoring/
set_up_wtf_mon.yml
deploy/
application1.yml
security/
add_ssh_user.yml

51. Add an environment variable
pointing to the roles' root dir.
export ANSIBLE_ROLES_PATH=
~/git/orchestration/roles
That way your playbooks will
always see roles that they use.

52. change the default dictionary
update policy.
Default: overwrite
"better":
hash_behaviour=merge

53. Useful tip

54. vars precendence:
» role/defaults
» group_vars
» host_vars
» role/vars
» {role: foo, var: bar}
» playbook vars
» --extra-vars="var=bar"
» vars/
» role dependencies
» facts
» register variables
https://github.com/cookrn/ansible_variable_precedence

55. Vault

56. $ANSIBLE_VAULT;1.1;AES256
3661303264353231353730343131383033333938
3036356336366431386637383062396535613434
3438353366366236383731343632353338336466
636435360a323134366335623162303836363365
3031303530383331326363633235613834396462
6665653836623339636332333931313831663166
6534643137313030640a64653365353136633636
3266613837626434636637353635633931306363
6130

57. group_vars/all/database.yml
db:
server: dbserver1
sid: prod
port: 1521
ansible-vault edit
group_vars/all/vault.yml
db:
root:
password: 8.apud

58. New in 2.0
"Over the Hills and Far Away"

59. Task Blocks

60. - block:
- debug: msg="normal operation"
- command: /bin/false
rescue:
- debug: msg="caught an error, rescuing!"
always:
- debug: msg="this will always run"

61. dynamic includes

62. New Execution Strategy Plugins

63. » linear: classic strategy, a task
is run on every host,
then move to new task
» free: run all tasks on all hosts
as quickly as possible,
but still in-order

64. Added `meta: refresh_inventory`
to force rereading the inventory in a play.

65. New Modules

66. » deploy_helper
» dpkg_selections
» iptables
» maven_artifact
» os_*
» vmware_*
» ...
https://raw.githubusercontent.com/
ansible/ansible/stable-2.0/CHANGELOG.md

67. It's a GOOD tool.
A good tool for
CONFIGURATION MANAGEMENT.
Do not try to rewrite your ant/maven jobs using it.

68. QUESTIONS?

69. THE
END

70. Don't be afraid of writing
your own jinja filters.
It's really simple.

71. export
ANSIBLE_FILTER_PLUGINS=
~/git/orchestration/
plugins/filter_plugins

72. # rot13.py
def enc_rot13( s ):
return s.encode('rot13')
class FilterModule( object ):
def filters( self ):
return {
'rot13' : enc_rot13
}

73. Ansible is
easily extensible.
Write your own modules!

74. Arguments are passed as a file.
with open(sys.argv[1]) as f:
args=f.read()

75. split that into a list
args = args.split()

76. intelligently split
that string into a list
args = shlex.split( args )

77. Key, value pairs would be nice
args = [
x.split( '=', 1 )
for z in args ]
args = {
k: v
for k, v in args }

78. Modules return nothing.
They print json to stdout.
print json.dumps({
'changed': True,
'foo': 'bar'
})
ONLY dictionaries!

80. Modules can suplement
default facts
known about the node
just add the 'ansible_facts' key
to json

81. {
"changed": True,
"ansible_facts" : {
"hack_time": {
"ready": True
}
}
}

82. Now that we know how it is done...

83. Forget That!
too cumbersome...

84. from ansible.module_utils.basic import *
module = AnsibleModule(
argument_spec= {
supports_check_mode: False,
state: {
default:'present',
choices: [
'present',
'absent'
]
},
foo: bar
}
)

85. # exit helpers
module.exit_json(
changed=True,
akadamia='jlabs'
)
module.fail_json(
msg="it's a trap"
)

86. Our first module
from ansible.module_utils.basic
import *
module = AnsibleModule(
argument_spec={} )
def main():
module.exit_json(
changed=False,
akadamia='jlabs'
)
main()

87. ansible/hacking/test-module -m akadamia
***********************************
RAW OUTPUT
{"changed": false, "akadamia": "jlabs"}
PARSED OUTPUT
{
"changed": false,
"akadamia": "jlabs"
}

88. but modules DO NOT have to be Python
#!/bin/bash
# sudo rm -rf /
echo '{ "changed": false, "akadamia": "jlabs" }'

89. ansible/hacking/test-module -m akadamia2
***********************************
RAW OUTPUT
{ "changed": false, "akadamia": "jlabs" }
***********************************
PARSED OUTPUT
{
"changed": false,
"akadamia": "jlabs"
}