Talk given to BCN sudoers on 2013-11-05. Introduction to the ansible configuration management tool. Great to automate reproducible installations and setup.

1. ansible
bcn sudoers
20131105
Wednesday, November 6, 13

2. In Science Fiction...
“An ansible is a fictional machine capable of
instantaneous or superluminal communication. “
http://en.wikipedia.org/wiki/Ansible
Wednesday, November 6, 13

3. In Science Fiction...
“An ansible is a fictional machine capable of
instantaneous or superluminal communication. “
http://en.wikipedia.org/wiki/Ansible
Wednesday, November 6, 13

4. In Science Fiction...
“An ansible is a fictional machine capable of
instantaneous or superluminal communication. “
http://en.wikipedia.org/wiki/Ansible
Wednesday, November 6, 13

5. In Science Fiction...
“An ansible is a fictional machine capable of
instantaneous or superluminal communication. “
http://en.wikipedia.org/wiki/Ansible
Wednesday, November 6, 13

6. In Open Source...
https://en.wikipedia.org/wiki/File:Dublin_Philharmonic_Orchestra_performing_Tchaikovsky%27s_Symphony_No_4_in_Charlotte,_North_Carolina.jpg
Wednesday, November 6, 13

7. In Open Source...
IT orchestration engine created by Michael DeHaan
Configuration Management
Software Deployment
Ad-Hoc Command Execution
Wednesday, November 6, 13

8. KISS
Wednesday, November 6, 13

9. KISS
✓No client setup
http://www.theregister.co.uk/2007/05/08/dell_box_multipack/
Wednesday, November 6, 13

10. KISS
✓No client setup
✓SSH-based
http://www.cs.umd.edu/faq/ssh.html
Wednesday, November 6, 13

11. KISS
✓No client setup
✓SSH-based
✓sudo-aware
http://xkcd.com/149/
Wednesday, November 6, 13

12. Business Model
AnsibleWorks
Commercial Support
Non-free add-ons
Wednesday, November 6, 13

13. Installation
Native Packages
Source tarball
pip install ansible
git clone https://github.com/ansible/ansible.git
➡Not on Mac Homebrew!
Wednesday, November 6, 13

14. Hands-on Install
Wednesday, November 6, 13

15. Host Setup
Have proper SSH keys
Use ssh-agent
Check .ssh/config
Wednesday, November 6, 13

16. Host Inventory
# production
host01
host02:port
host[03:50]
...
[webservers]
host[03:20]
[database]
host02
Wednesday, November 6, 13

17. Variables
# production
host01
host02:port
host[03:50]
...
[webservers]
host[03:20]
[webservers:vars]
database_server=host02
[database]
host02
Wednesday, November 6, 13

18. Execute a command
$ ansible -vvvv -i production remotehost -m setup
Wednesday, November 6, 13

19. Modules
Idempotent
ansible-doc
Wednesday, November 6, 13

20. The Play
A set of rules
Declarative syntax
YAML
Idempotent
Wednesday, November 6, 13

21. lineinfile
- name: disable reverse dns lookup in sshd
action: lineinfile
dest=/etc/ssh/sshd_config
state=present regexp="^UseDNS "
line="UseDNS no"
insertafter=EOF
Wednesday, November 6, 13

22. Register results
- name: disable reverse dns lookup in sshd
action: lineinfile
dest=/etc/ssh/sshd_config
state=present regexp="^UseDNS "
line="UseDNS no"
insertafter=EOF
register: sshd_config
Wednesday, November 6, 13

23. Backrefs
- name: apt-sources deb
lineinfile: dest=/etc/apt/sources.list
backrefs=yes regexp='^(deb .* ${dist} main)$'
line='1 contrib non-free'
register: apt_get_update
Wednesday, November 6, 13

24. Shell
- name: apt-sources deb
lineinfile: dest=/etc/apt/sources.list
backrefs=yes regexp='^(deb .* ${dist} main)$'
line='1 contrib non-free'
register: apt_get_update
- name: update apt-get cache
shell: /usr/bin/apt-get update
when: apt_get_update.changed
Wednesday, November 6, 13

25. Iterate
- name: install essential packages
action: apt name={{ item }} state=latest
with_items:
- etckeeper
- sudo
- iptables-persistent
- fail2ban
Wednesday, November 6, 13

26. Conditional execution
- name: disable reverse dns lookup in sshd
action: lineinfile
dest=/etc/ssh/sshd_config
state=present regexp="^UseDNS "
line="UseDNS no"
insertafter=EOF
register: sshd_config
- name: restart sshd
when: sshd_config.changed
action: service name=ssh state=restarted
Wednesday, November 6, 13

27. Use templates
- name: install default iptables rules
action: template src=$item dest=/etc/iptables/rules.v4
first_available_file:
- templates/host/${ansible_hostname}/iptables-rules-v4.j2
- templates/iptables-rules-v4.j2
register: new_iptables
Wednesday, November 6, 13

28. Enter the Playbook
Wednesday, November 6, 13

29. Playbook Structure
Vars
Hosts
Tasks
Handlers
Wednesday, November 6, 13

30. Playbook Tree
production # inventory file for production servers
stage # inventory file for stage environment
group_vars/
group1 # here we assign variables to particular groups
group2 # ""
host_vars/
hostname1 # if systems need specific variables, put them here
hostname2 # ""
site.yml # master playbook
webservers.yml # playbook for webserver tier
dbservers.yml # playbook for dbserver tier
roles/
common/ # this hierarchy represents a "role"
tasks/ #
main.yml # <-- tasks file can include smaller files if warranted
handlers/ #
main.yml # <-- handlers file
templates/ # <-- files for use with the template resource
ntp.conf.j2 # <------- templates end in .j2
files/ #
bar.txt # <-- files for use with the copy resource
foo.sh # <-- script files for use with the script resource
vars/ #
main.yml # <-- variables associated with this role
webtier/ # same kind of structure as "common" was above, done for the webtier role
monitoring/ # ""
fooapp/ # ""
http://www.ansibleworks.com/docs/playbooks_best_practices.html
Wednesday, November 6, 13

31. Launch Playbook
$ ansible-play -vvvv -i production playbook.yml
Wednesday, November 6, 13

32. One-shot SSH is expensive
Wednesday, November 6, 13

33. 



Wednesday, November 6, 13

34. 




Wednesday, November 6, 13

35. 



 

Wednesday, November 6, 13

36. Fireball Mode
Persistent server
Requires python-keyczar and python-zmq
Wednesday, November 6, 13

37. Fireball Mode
Transient ZMQ queue + TCP listener
Unique, random key
Wednesday, November 6, 13

38. Fireball Mode
Wednesday, November 6, 13

39. Fireball Mode
---
- hosts: debian
user: root
# Uncomment next block to use fireball mode
# gather_facts: false
# connection: ssh
# tasks:
# - action: fireball
# - hosts: debian
# connection: fireball
# End comment block for fireball mode
vars:
...
Wednesday, November 6, 13

40. Fireball Mode
---
- hosts: debian
user: root
# Uncomment next block to use fireball mode
# gather_facts: false
# connection: ssh
# tasks:
# - action: fireball
# - hosts: debian
# connection: fireball
# End comment block for fireball mode
vars:
...
DEPRECATED
Wednesday, November 6, 13

41. Accelerated Mode
Supercedes Fireball
Uses single TCP port
Does not depend on ZMQ
Wednesday, November 6, 13

42. Accelerated Mode
---
- hosts: all
accelerate: true
# default port is 5099
accelerate_port: 10000
Wednesday, November 6, 13

43. Local Mode
Wednesday, November 6, 13

44. Non-free
AWX
Callback mode
Wednesday, November 6, 13

45. ¿Preguntas?
Wednesday, November 6, 13

46. ¡Gracias!
@codehead
javier a.t. rodriguez.org.mx
scribd.com/javierrgz
Wednesday, November 6, 13