SlideShare a Scribd company logo

ansible_rhel.pdf

S
ssuser6d347b

Facts are variables that provide information about managed nodes, such as operating system, IP address, and hostname, and are gathered using the setup module. Facts allow playbooks to dynamically handle different operating systems or configurations by basing logic on facts rather than static variables. Fact data can be accessed in templates and used to conditionally run tasks based on facts about remote systems.

Spiritual
1 of 127
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
HOW TO USE THIS DECK This slide deck is meant to accompany the Ansible RHEL workshop, both sections if needed. Note that this deck is optional - the workshop content explains each and every Ansible idea in detail already. HOW TO IMPROVE THIS DECK The workshop is a collaborative effort. Help us to improve it! You can leave comments, and the BU will make sure to work on this. Tag for example Roland (Wolters) or Sean (Cavanaugh) to ensure that they pick it up. Speaking about the BU: the fact that this deck is now owned by an organization and not individuals anymore hopefully ensures for the future that the deck stays up2date over time as the workshop develops. THANKS HUGE THANK YOU to the following people - without them, this deck would not have been possible. Thanks to: Kevin “GoKEV” Holmes Phil Avery Russell Pavlicek Matt St Onge Will Tome Götz Rieger Benjamin Blasco Thanks for providing input, helping proofread, error check, and improving this deck continuously.
Ansible Linux Automation Workshop Introduction to Ansible for Red Hat Enterprise Linux Automation for System Administrators and Operators
3 ● Timing ● Breaks ● Takeaways Housekeeping
4 ● Introduction to Ansible Automation ● How it works ● Understanding modules, tasks & playbooks ● How to execute Ansible commands ● Using variables & templates ● Tower - where it fits in ● Basic usage of Tower ● Learn major Tower features: RBAC, workflows and so on What you will learn
5 Introduction Topics Covered: ● What is the Ansible Automation Platform? ● What can it do?
Automation happens when one person meets a problem they never want to solve again
Teams are automating... Lines Of Business Network Security Operations Developers Infrastructure
Ansible used in silo DIY scripting automation Open source config management tool Proprietary vendor supplied automation Ad-hoc Automation is happening in silos Network Infrastructure Security Developers Is organic automation enough?
Why Ansible? Simple Powerful Agentless App deployment Configuration management Workflow orchestration Network automation Orchestrate the app lifecycle Human readable automation No special coding skills needed Tasks executed in order Usable by every team Get productive quickly Agentless architecture Uses OpenSSH & WinRM No agents to exploit or update Get started immediately More efficient & more secure
What can I do using Ansible? Automate the deployment and management of your entire IT footprint. Orchestration Do this... Firewalls Configuration Management Application Deployment Provisioning Continuous Delivery Security and Compliance On these... Load Balancers Applications Containers Clouds Servers Infrastructure Storage And more... Network Devices
When automation crosses teams, you need an automation platform Lines Of Business Network Security Operations Developers Infrastructure
Red Hat Ansible Automation Platform Lines of business Network Operations Security Infrastructure Developers Ansible Tower: Operate & control at scale Ansible Engine: Universal language of automation Fueled by an open source community Engage Scale Create Ansible Hosted Services: Engage users with an automation focused experience
Cloud Virt & Container Windows Network Security Monitoring Ansible automates technologies you use Time to automate is measured in minutes AWS Azure Digital Ocean Google OpenStack Rackspace +more Docker VMware RHV OpenStack OpenShift +more ACLs Files Packages IIS Regedits Shares Services Configs Users Domains +more A10 Arista Aruba Cumulus Bigswitch Cisco Dell Extreme F5 Lenovo MikroTik Juniper OpenSwitch +more Checkpoint Cisco CyberArk F5 Fortinet Juniper IBM Palo Alto Snort +more Dynatrace Datadog LogicMonitor New Relic Sensu +more Devops Jira GitHub Vagrant Jenkins Slack +more Storage Netapp Red Hat Storage Infinidat +more Operating Systems RHEL Linux Windows +more
3 ROI on Ansible Tower 146% < MONTHS Payback on Ansible Tower Financial summary: SOURCE: "The Total Economic Impact™ Of Red Hat Ansible Tower, a June 2018 commissioned study conducted by Forrester Consulting on behalf of Red Hat." redhat.com/en/engage/total-economic-impact-ansible-tower-20180710 Reduction in recovery time following a security incident 94% 84% Savings by deploying workloads to generic systems appliances using Ansible Tower 67% Reduction in man hours required for customer deliveries Red Hat Ansible Tower by the numbers:
15 Section 1 Ansible Engine
16 Exercise 1.1 Topics Covered: ● Understanding the Ansible Infrastructure ● Check the prerequisites
ANSIBLE AUTOMATION ENGINE CMDB USERS INVENTORY HOSTS NETWORK DEVICES PLUGINS CLI MODULES ANSIBLE PLAYBOOK PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD
ANSIBLE AUTOMATION ENGINE CMDB USERS INVENTORY HOSTS NETWORK DEVICES PLUGINS CLI MODULES ANSIBLE PLAYBOOK PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD PLAYBOOKS ARE WRITTEN IN YAML Tasks are executed sequentially Invoke Ansible modules
--- - name: install and start apache hosts: web become: yes tasks: - name: httpd package is present yum: name: httpd state: latest - name: latest index.html file is present template: src: files/index.html dest: /var/www/html/ - name: httpd is started service: name: httpd state: started
ANSIBLE AUTOMATION ENGINE CMDB USERS INVENTORY HOSTS NETWORK DEVICES PLUGINS CLI ANSIBLE PLAYBOOK PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD MODULES ARE “TOOLS IN THE TOOLKIT” Python, Powershell, or any language Extend Ansible simplicity to the entire stack MODULES - name: latest index.html file is present template: src: files/index.html dest: /var/www/html/
ANSIBLE AUTOMATION ENGINE CMDB USERS INVENTORY HOSTS NETWORK DEVICES CLI ANSIBLE PLAYBOOK PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD PLUGINS ARE “GEARS IN THE ENGINE” Code that plugs into the core engine Adaptability for various uses & platforms MODULES PLUGINS {{ some_variable | to_nice_yaml }}
ANSIBLE AUTOMATION ENGINE CMDB USERS HOSTS NETWORK DEVICES CLI ANSIBLE PLAYBOOK PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD MODULES PLUGINS INVENTORY INVENTORY List of systems in your infrastructure that automation is executed against [web] webserver1.example.com webserver2.example.com [db] dbserver1.example.com [switches] leaf01.internal.com leaf02.internal.com [firewalls] checkpoint01.internal.com [lb] f5-01.internal.com
ANSIBLE AUTOMATION ENGINE USERS HOSTS NETWORK DEVICES CLI ANSIBLE PLAYBOOK MODULES PLUGINS INVENTORY PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD CLOUD Red Hat Openstack, Red Hat Satellite, VMware, AWS EC2, Rackspace, Google Compute Engine, Azure CMDB
ANSIBLE AUTOMATION ENGINE USERS HOSTS NETWORK DEVICES CLI ANSIBLE PLAYBOOK MODULES PLUGINS INVENTORY CMDB ServiceNow, Cobbler, BMC, Custom cmdb PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD CMDB
ANSIBLE AUTOMATION ENGINE USERS CLI ANSIBLE PLAYBOOK MODULES PLUGINS INVENTORY PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD CMDB HOSTS NETWORK DEVICES AUTOMATE EVERYTHING Red Hat Enterprise Linux, Cisco routers, Arista switches, Juniper routers, Windows hosts, Check Point firewalls, NetApp storage, F5 load balancers and more
LINUX AUTOMATION ansible.com/get-started AUTOMATE EVERYTHING LINUX Red Hat Enterprise Linux, BSD, Debian, Ubuntu and many more! ONLY REQUIREMENTS: Python 2 (2.6 or later) or Python 3 (3.5 or later) 150+ Linux Modules
How Ansible Automation works NETWORKING DEVICES LINUX/WINDOWS HOSTS Module code is copied to the managed node, executed, then removed Module code is executed locally on the control node
28 ● Follow the steps to access environment ● Use the IP provided to you, the script only has example IP ● Which editor do you use on command line? If you don’t know, we have a short intro Verify Access
Lab Time Complete exercise 1.1 now in your lab environment
30 Exercise 1.2 Topics Covered: ● Ansible inventories ● Main Ansible config file ● Modules and ad-hoc commands
31 ● Ansible works against multiple systems in an inventory ● Inventory is usually file based ● Can have multiple groups ● Can have variables for each group or even host Inventory
# Static inventory example: [myservers] 10.42.0.2 10.42.0.6 10.42.0.7 10.42.0.8 10.42.0.100 host.example.com Understanding Inventory - Basic
[app1srv] appserver01 ansible_host=10.42.0.2 appserver02 ansible_host=10.42.0.3 [web] node-[1:30] ansible_host=10.42.0.[31:60] [web:vars] apache_listen_port=8080 apache_root_path=/var/www/mywebdocs/ [all:vars] ansible_user=kev ansible_ssh_private_key_file=/home/kev/.ssh/id_rsa Understanding Inventory - Basic
[app1srv] appserver01 ansible_host=10.42.0.2 appserver02 ansible_host=10.42.0.3 [web] node-[1:30] ansible_host=10.42.0.[31:60] [web:vars] apache_listen_port=8080 apache_root_path=/var/www/mywebdocs/ [all:vars] ansible_user=ender ansible_ssh_private_key_file=/home/ender/.ssh/id_rsa Understanding Inventory - Variables
[nashville] bnaapp01 bnaapp02 [atlanta] atlapp03 atlapp04 [south:children] atlanta nashville hsvapp05 Understanding Inventory - Groups
36 ● Basic configuration for Ansible ● Can be in multiple locations, with different precedence ● Here: .ansible.cfg in the home directory ● Configures where to find the inventory Configuration File
Configuration files will be searched for in the following order: 37 ➔ ANSIBLE_CONFIG (environment variable if set) ➔ ansible.cfg (in the current directory) ➔ ~/.ansible.cfg (in the home directory) ➔ /etc/ansible/ansible.cfg (installed as Ansible default) The Ansible Configuration
38 ● Single Ansible command to perform a task quickly directly on command line ● Most basic operation that can be performed ● Here: an example Ansible ping - not to be confused with ICMP $ ansible all -m ping First Ad-Hoc Command: ping
ping Groups can be nested # Check connections (submarine ping, not ICMP) [user@ansible] $ ansible all -m ping web1 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } 39 Ad-Hoc Commands
40 Some basics to keep you from getting stuck --help (Display some basic and extensive options) [user@ansible ~]$ ansible --help- Usage: ansible <host-pattern> [options] Define and run a single task 'playbook' against a set of hosts Options: -a MODULE_ARGS, --args=MODULE_ARGS module arguments --ask-vault-pass ask for vault password -B SECONDS, --background=SECONDS <<<snippet, output removed for brevity>>> The Ansible Command
Here are some common options you might use: 41 -m MODULE_NAME, --module-name=MODULE_NAME Module name to execute the ad-hoc command -a MODULE_ARGS, --args=MODULE_ARGS Module arguments for the ad-hoc command -b, --become Run ad-hoc command with elevated rights such as sudo, the default method -e EXTRA_VARS, --extra-vars=EXTRA_VARS Set additional variables as key=value or YAML/JSON Ad-Hoc Commands
Here are some common options you might use: Groups can be nested # Check connections to all (submarine ping, not ICMP) [user@ansible] $ ansible all -m ping # Run a command on all the hosts in the web group [user@ansible] $ ansible web -m command -a "uptime" # Collect and display known facts for server “web1” [user@ansible] $ ansible web1 -m setup 42 Ad-Hoc Commands
Lab Time Complete exercise 1.2 now in your lab environment
44 Exercise 1.3 Topics Covered: ● Playbooks basics ● Running a playbook
--- - name: install and start apache hosts: web become: yes tasks: - name: httpd package is present yum: name: httpd state: latest - name: latest index.html file is present template: src: files/index.html dest: /var/www/html/ - name: httpd is started service: name: httpd state: started An Ansible Playbook A play
--- - name: install and start apache hosts: web become: yes tasks: - name: httpd package is present yum: name: httpd state: latest - name: latest index.html file is present template: src: files/index.html dest: /var/www/html/ - name: httpd is started service: name: httpd state: started An Ansible Playbook A task
--- - name: install and start apache hosts: web become: yes tasks: - name: httpd package is present yum: name: httpd state: latest - name: latest index.html file is present template: src: files/index.html dest: /var/www/html/ - name: httpd is started service: name: httpd state: started An Ansible Playbook module
48 A task executed as expected, no change was made. A task executed as expected, making a change A task failed to execute successfully The most important colors of Ansible Running an Ansible Playbook:
49 [user@ansible] $ ansible-playbook apache.yml PLAY [webservers] *************************************************************************** TASK [Gathering Facts] ********************************************************************** ok: [web2] ok: [web1] ok: [web3] TASK [Ensure httpd package is present] ****************************************************** changed: [web2] changed: [web1] changed: [web3] TASK [Ensure latest index.html file is present] ********************************************* changed: [web2] changed: [web1] changed: [web3] TASK [Restart httpd] ************************************************************************ changed: [web2] changed: [web1] changed: [web3] PLAY RECAP ********************************************************************************** web2 : ok=1 changed=3 unreachable=0 failed=0 web1 : ok=1 changed=3 unreachable=0 failed=0 web3 : ok=1 changed=3 unreachable=0 failed=0 Running an Ansible Playbook
Lab Time Complete exercise 1.3 now in your lab environment
51 Exercise 1.4 Topics Covered: ● Working with variables ● What are facts?
--- - name: variable playbook test hosts: localhost vars: var_one: awesome var_two: ansible is var_three: "{{ var_two }} {{ var_one }}" tasks: - name: print out var_three debug: msg: "{{var_three}}" An Ansible Playbook Variable Example
--- - name: variable playbook test hosts: localhost vars: var_one: awesome var_two: ansible is var_three: "{{ var_two }} {{ var_one }}" tasks: - name: print out var_three debug: msg: "{{var_three}}" An Ansible Playbook Variable Example ansible is awesome
54 ● Just like variables, really... ● ...but: coming from the host itself! ● Check them out with the setup module Facts "ansible_facts": { "ansible_default_ipv4": { "address": "10.41.17.37", "macaddress": "00:69:08:3b:a9:16", "interface": "eth0", ...
Gather facts on target machine 55 $ ansible localhost -m setup localhost | SUCCESS => { "ansible_facts": { "ansible_all_ipv4_addresses": [ "192.168.122.1", "172.21.208.111" ], "ansible_all_ipv6_addresses": [ "fe80::8f31:b68d:f487:2775" ],
56 vars: mynewip: 10.7.62.39- "ansible_facts": { "ansible_default_ipv4": { "address": "10.41.17.37", "macaddress": "00:69:08:3b:a9:16", "interface": "eth0", ... DEVICE="{{ ansible_default_ipv4.interface }}" ONBOOT=yes HWADDR={{ ansible_default_ipv4.macaddress }} TYPE=Ethernet BOOTPROTO=static IPADDR={{ mynewip }} This is a template file for ifcfg-eth0, using a mix of discovered facts and variables to write the static file. A variable, defined in our playbook Ansible Variables and Facts
Ansible can work with metadata from various sources as variables. Different sources will be overridden in an order of precedence. 57 1. extra vars (Highest - will override anything else) 2. task vars (overridden only for the task) 3. block vars (overridden only for tasks in block) 4. role and include vars 5. play vars_files 6. play vars_prompt 7. play vars 8. set_facts 9. registered vars 10. host facts 11. playbook host_vars 12. playbook group_vars 13. inventory host_vars 14. inventory group_vars 15. inventory vars 16. role defaults (Lowest - will be overridden by anything else listed here) Variable Precedence
58 [user@ansible ~]$ tree /somedir /somedir ├── group_vars │ └── app1srv │ └── db │ └── web ├── inventory └── host_vars └─ app01 └─ app02 └─ app03 Ansible Inventory - Managing Variables In Files
[user@ansible ~]$ cat /somedir/group_vars/web apache_listen_port: 8080 apache_root_path: /var/www/mywebdocs/ 59 [user@ansible ~]$ cat /somedir/host_vars/app01 owner_name: Chris P. Bacon owner_contact: 'cbacon@mydomain.tld' server_purpose: Application X [user@ansible ~]$ tree /somedir /somedir ├── group_vars- │ └── app1srv │ └── db │ └── web ├── inventory- └── host_vars- └─ app01 └─ app02 └─ app03 [user@ansible ~]$ cat /somedir/inventory [web] node-[1:30] ansible_host=10.42.0.[31:60] [appxsrv] app01 app02 app03 Ansible Inventory - Managing Variables In Files
Lab Time Complete exercise 1.4 now in your lab environment
61 Exercise 1.5 Topics Covered: ● Conditionals ● Handlers ● Loops
Conditionals via VARS vars: my_mood: happy tasks: - name: conditional task, based on my_mood var debug: msg: "Come talk to me. I am {{ my_mood }}!" when: my_mood == "happy"
Conditionals with variables vars: my_mood: happy tasks: - name: conditional task, based on my_mood var debug: msg: "Come talk to me. I am {{ my_mood }}!" when: my_mood == "happy" debug: msg: "Feel free to interact. I am {{ my_mood }}" when: my_mood != "grumpy" Alternatively
Conditionals with facts tasks: - name: Install apache apt: name: apache2 state: latest when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu' - name: Install httpd yum: name: httpd state: latest when: ansible_distribution == 'RedHat'
Using the previous task state - name: Ensure httpd package is present yum: name: httpd state: latest register: http_results - name: Restart httpd service: name: httpd state: restart when: httpd_results.changed This is NOT a handler task, but has similar function
Handler Tasks tasks: - name: Ensure httpd package is present yum: name: httpd state: latest notify: restart_httpd handlers: - name: restart_httpd service: name: httpd state: restart A handler task is run when a referring task result shows a change
tasks: - name: Ensure httpd package is present yum: name: httpd state: latest notify: restart_httpd - name: Standardized index.html file copy: content: "This is my index.html file for {{ ansible_host }}" dest: /var/www/html/index.html notify: restart_httpd Handler Tasks TASK [Ensure httpd package is present] ****************************************************** ok: [web2] ok: [web1] TASK [Standardized index.html file] ********************************************************* changed: [web2] changed: [web1] NOTIFIED: [restart_httpd] ******************************************************************* changed: [web2] changed: [web1] If either task notifies a changed result, the handler will be notified ONCE. unchanged changed handler runs once
tasks: - name: Ensure httpd package is present yum: name: httpd state: latest notify: restart_httpd - name: Standardized index.html file copy: content: "This is my index.html file for {{ ansible_host }}" dest: /var/www/html/index.html notify: restart_httpd Handler Tasks TASK [Ensure httpd package is present] ****************************************************** changed: [web2] changed: [web1] TASK [Standardized index.html file] ********************************************************* changed: [web2] changed: [web1] NOTIFIED: [restart_httpd] ******************************************************************* changed: [web2] changed: [web1] If both of these tasks notifies of a changed result, the handler will be notified ONCE. changed handler runs once changed
tasks: - name: Ensure httpd package is present yum: name: httpd state: latest notify: restart_httpd - name: Standardized index.html file copy: content: "This is my index.html file for {{ ansible_host }}" dest: /var/www/html/index.html notify: restart_httpd Handler Tasks If neither task notifies a changed result, the handler does not run. TASK [Ensure httpd package is present] ****************************************************** ok: [web2] ok: [web1] TASK [Standardized index.html file] ********************************************************* ok: [web2] ok: [web1] PLAY RECAP ********************************************************************************** web2 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 web1 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 unchanged unchanged
--- - name: Ensure users hosts: node1 become: yes tasks: - name: Ensure user is present user: name: dev_user state: present - name: Ensure user is present user: name: qa_user state: present - name: Ensure user is present user: name: prod_user state: present Variables & Loops Great opportunity to use a loop
--- - name: Ensure users hosts: node1 become: yes tasks: - name: Ensure users are present user: name: “{{item}}” state: present loop: - dev_user - qa_user - prod_user Variables & Loops Using loops to simplify tasks
Lab Time Complete exercise 1.5 now in your lab environment
73 Exercise 1.6 Topics Covered: ● Templates
- name: Ensure apache is installed and started hosts: web become: yes vars: http_port: 80 http_docroot: /var/www/mysite.com tasks: - name: Verify correct config file is present template: src: templates/httpd.conf.j2 dest: /etc/httpd/conf/httpd.conf Variables & Templates Using a system fact or declared variable to write a file
- name: Ensure apache is installed and started hosts: web become: yes vars: http_port: 80 http_docroot: /var/www/mysite.com tasks: - name: Verify correct config file is present template: src: templates/httpd.conf.j2 dest: /etc/httpd/conf/httpd.conf Variables & Templates Using a system fact or declared variable to write a file ## Excerpt from httpd.conf.j2 # Change this to Listen on specific IP addresses as shown below to # prevent Apache from glomming onto all bound IP addresses. # # Listen 80 ## original line Listen {{ http_port }} # DocumentRoot: The directory out of which you will serve your # documents. # DocumentRoot "/var/www/html" DocumentRoot {{ http_docroot }}
Lab Time Complete exercise 1.6 now in your lab environment
77 Exercise 1.7 Topics Covered: ● What are roles? ● How they look like ● Galaxy
78 ● Roles: Think Ansible packages ● Roles provide Ansible with a way to load tasks, handlers, and variables from separate files. ● Roles group content, allowing easy sharing of code with others ● Roles make larger projects more manageable ● Roles can be developed in parallel by different administrators Better start using roles now! Roles
79 user/ ├── defaults │ └── main.yml ├── handlers │ └── main.yml ├── meta │ └── main.yml ├── README.md ├── tasks │ └── main.yml ├── templates ├── tests │ ├── inventory │ └── test.yml └── vars └── main.yml ● Defaults: default variables with lowest precedence (e.g. port) ● Handlers: contains all handlers ● Meta: role metadata including dependencies to other roles ● Tasks: plays or tasks Tip: It’s common to include tasks in main.yml with “when” (e.g. OS == xyz) ● Templates: templates to deploy ● Tests: place for playbook tests ● Vars: variables (e.g. override port) Role structure
Sharing Content 80 Ansible Galaxy Roles, and more Community
Lab Time Complete exercise 1.7 now in your lab environment
82 Exercise 1.8 Topics Covered: ● A bonus lab - try it on your own, and when time permits
Lab Time Complete exercise 1.8 now in your lab environment
84 Section 2 Ansible Tower
85 Exercise 2.1 Topics Covered: ● Introduction to Tower
Ansible Tower is a UI and RESTful API allowing you to scale IT automation, manage complex deployments and speed productivity. • Role-based access control • Deploy entire applications with push-button deployment access • All automations are centrally logged • Powerful workflows match your IT processes What is Ansible Tower?
RBAC Allow restricting playbook access to authorized users. One team can use playbooks in check mode (read-only) while others have full administrative abilities. Push button An intuitive user interface experience makes it easy for novice users to execute playbooks you allow them access to. RESTful API With an API first mentality every feature and function of Tower can be API driven. Allow seamless integration with other tools like ServiceNow and Infoblox. Workflows Ansible Tower’s multi-playbook workflows chain any number of playbooks, regardless of whether they use different inventories, run as different users, run at once or utilize different credentials. Enterprise integrations Integrate with enterprise authentication like TACACS+, RADIUS, Azure AD. Setup token authentication with OAuth 2. Setup notifications with PagerDuty, Slack and Twilio. Centralized logging All automation activity is securely logged. Who ran it, how they customized it, what it did, where it happened - all securely stored and viewable later, or exported through Ansible Tower’s API. Red Hat Ansible Tower
USE CASES USERS CLOUD AWS, GOOGLE CLOUD, AZURE, IBM CLOUD … INFRASTRUCTURE LINUX, OPENSHIFT, WINDOWS, VMWARE, OPERATORS, CONTAINERS … NETWORK ARISTA, CISCO, JUNIPER INFOBLOX F5 … SECURITY CHECKPOINT, QRADAR, SNORT CYBERARK, SPLUNK, FORTINET … SERVICES DATABASES, LOGGING, SOURCE CONTROL MANAGEMENT… TRANSPORT SSH, WINRM, NETWORK_CLI, HTTPAPI AUTOMATE YOUR ENTERPRISE ADMINS ANSIBLE CLI & CI SYSTEMS ANSIBLE PLAYBOOKS …. ANSIBLE TOWER SIMPLE USER INTERFACE ROLE-BASED ACCESS CONTROL CONFIGURATION MANAGEMENT APP DEPLOYMENT CONTINUOUS DELIVERY SECURITY & COMPLIANCE ORCHESTRATION PROVISIONING KNOWLEDGE & VISIBILITY SCHEDULED & CENTRALIZED JOBS TOWER API ANSIBLE ENGINE OPEN SOURCE MODULE LIBRARY PYTHON CODEBASE PLUGINS APP DEVELOPMENT PYTHON VENV, NPM, YUM, APT, PIP... CLOUD.REDHAT.COM AUTOMATION HUB AUTOMATION ANAL YTICS Ansible Automation Platform CERTIFIED COLLECTIONS PARTNER COLLECTIONS PERFORMANCE DASHBOARD ORGANIZATIONAL STATS
Lab Time Complete exercise 2.1 now in your lab environment
90 Exercise 2.2 Topics Covered: ● Inventories ● Credentials
Inventory is a collection of hosts (nodes) with associated data and groupings that Ansible Tower can connect to and manage. ● Hosts (nodes) ● Groups ● Inventory-specific data (variables) ● Static or dynamic sources Inventory
Credentials are utilized by Ansible Tower for authentication with various external resources: ● Connecting to remote machines to run jobs ● Syncing with inventory sources ● Importing project content from version control systems ● Connecting to and managing network devices Centralized management of various credentials allows end users to leverage a secret without ever exposing that secret to them. Credentials
Lab Time Complete exercise 2.2 now in your lab environment
94 Exercise 2.3 Topics Covered: ● Projects ● Job Templates
Project A project is a logical collection of Ansible Playbooks, represented in Ansible Tower. You can manage Ansible Playbooks and playbook directories by placing them in a source code management system supported by Ansible Tower, including Git, Subversion, and Mercurial.
Everything in Ansible Tower revolves around the concept of a Job Template. Job Templates allow Ansible Playbooks to be controlled, delegated and scaled for an organization. Job templates also encourage the reuse of Ansible Playbook content and collaboration between teams. A Job Template requires: ● An Inventory to run the job against ● A Credential to login to devices. ● A Project which contains Ansible Playbooks Job Templates
Job Templates can be found and created by clicking the Templates button under the RESOURCES section on the left menu. Expanding on Job Templates
Job Templates can be launched by clicking the rocketship button for the corresponding Job Template Executing an existing Job Template
New Job Templates can be created by clicking the plus button Creating a new Job Template (1/2)
This New Job Template window is where the inventory, project and credential are assigned. The red asterisk * means the field is required . Creating a new Job Template (2/2)
Lab Time Complete exercise 2.3 now in your lab environment
102 Exercise 2.4 Topics Covered: ● Surveys
Tower surveys allow you to configure how a job runs via a series of questions, making it simple to customize your jobs in a user-friendly way. An Ansible Tower survey is a simple question-and-answer form that allows users to customize their job runs. Combine that with Tower's role-based access control, and you can build simple, easy self-service for your users. Surveys
Once a Job Template is saved, the Add Survey Button will appear Click the button to open the Add Survey window. Creating a Survey (1/2)
The Add Survey window allows the Job Template to prompt users for one or more questions. The answers provided become variables for use in the Ansible Playbook. Creating a Survey (2/2)
The Add Survey window allows the Job Template to prompt users for one or more questions. The answers provided become variables for use in the Ansible Playbook. Creating a Survey (2/2)
When launching a job, the user will now be prompted with the Survey. The user can be required to fill out the Survey before the Job Template will execute. Using a Survey
Lab Time Complete exercise 2.4 now in your lab environment
109 Exercise 2.5 Topics Covered: ● Role based access control
Role-Based Access Controls (RBAC) are built into Ansible Tower and allow administrators to delegate access to inventories, organizations, and more. These controls allow Ansible Tower to help you increase security and streamline management of your Ansible automation. Role Based Access Control (RBAC)
● An organization is a logical collection of users, teams, projects, inventories and more. All entities belong to an organization. ● A user is an account to access Ansible Tower and its services given the permissions granted to it. ● Teams provide a means to implement role-based access control schemes and delegate responsibilities across organizations. User Management
Clicking on the Organizations button in the left menu will open up the Organizations window Viewing Organizations
Clicking on the Teams button in the left menu will open up the Teams window Viewing Teams
Clicking on the Users button in the left menu will open up the Users window Viewing Users
Lab Time Complete exercise 2.5 now in your lab environment
116 Exercise 2.6 Topics Covered: ● Workflows
Workflows can be found alongside Job Templates by clicking the Templates button under the RESOURCES section on the left menu. Workflows
To add a new Workflow click on the green + button This time select the Workflow Template Adding a new Workflow Template
Fill out the required parameters and click SAVE. As soon as the Workflow Template is saved the WORKFLOW VISUALIZER will open. Creating the Workflow
The workflow visualizer will start as a blank canvas. Workflow Visualizer
Visualizing a Workflow Workflows can branch out, or converge in. Green indicates this Job Template will only be run if the previous Job Template is successful Red indicates this Job Template will only be run if the previous Job Template fails Blue indicates this Job Template will always run
Lab Time Complete exercise 2.6 now in your lab environment
123 Exercise 2.7 Topics Covered: ● Wrap-up
Lab Time Complete exercise 2.7 now in your lab environment
GET STARTED JOIN THE COMMUNITY WORKSHOPS & TRAINING SHARE YOUR STORY ansible.com/get-started ansible.com/tower-trial ansible.com/workshops Red Hat Training ansible.com/community Follow us @Ansible Friend us on Facebook Next Steps
ansible_rhel.pdf
linkedin.com/company/red-hat youtube.com/AnsibleAutomation facebook.com/ansibleautomation twitter.com/ansible github.com/ansible 127 Thank you

More Related Content

PDF
「作りこまない IoT 」を実現するためのクラウドネイティブな IoT システム構築 ― Cloud Native Days Tokyo 2018 (Op...
SORACOM,INC
 
PDF
ο Θησαυρος της Βαγιας
think Family vacation
 
PPTX
Παρουσίαση Διπλωματικής Μεταπτυχιακού.new
Dimitris Papaioannou
 
PDF
NodeJS and ExpressJS.pdf
ArthyR3
 
PPTX
Αδολφος Χιτλερ
2ο Δημοτικό Σχολείο Ξάνθης
 
PPTX
Το γλωσσικο ζητημα
2ο Δημοτικό Σχολείο Ξάνθης
 
PPTX
Leading Workshops With Cross-Functional Teams—Kate Kaplan & Cait Vlastakis Smith
caitvsmith
 
PDF
STACK ( LIFO STRUCTURE) - Data Structure
Yaksh Jethva
 
「作りこまない IoT 」を実現するためのクラウドネイティブな IoT システム構築 ― Cloud Native Days Tokyo 2018 (Op...
SORACOM,INC
 
ο Θησαυρος της Βαγιας
think Family vacation
 
Παρουσίαση Διπλωματικής Μεταπτυχιακού.new
Dimitris Papaioannou
 
NodeJS and ExpressJS.pdf
ArthyR3
 
Αδολφος Χιτλερ
2ο Δημοτικό Σχολείο Ξάνθης
 
Το γλωσσικο ζητημα
2ο Δημοτικό Σχολείο Ξάνθης
 
Leading Workshops With Cross-Functional Teams—Kate Kaplan & Cait Vlastakis Smith
caitvsmith
 
STACK ( LIFO STRUCTURE) - Data Structure
Yaksh Jethva
 

Similar to ansible_rhel.pdf (20)

PPTX
Intro to-ansible-sep7-meetup
Ramesh Godishela
 
PDF
Ansible - Hands on Training
Mehmet Ali Aydın
 
PDF
Ansible Tutorial.pdf
NigussMehari4
 
PDF
Devops with Python by Yaniv Cohen DevopShift
Yaniv cohen
 
PPTX
DevOps for database
Osama Mustafa
 
PDF
Ansible
Rahul Bajaj
 
PPTX
Ansible Devops North East - slides
InfinityPP
 
PPTX
UNIT-I Introduction to Ansible.pptx
Pandiya Rajan
 
PDF
Ansible intro
Marcelo Quintiliano da Silva
 
PDF
Ansible automation sa technical deck q2 fy19
dvillaco
 
PDF
Ansible is the simplest way to automate. MoldCamp, 2015
Alex S
 
PDF
06 network automationwithansible
Khairul Zebua
 
PDF
Ansible, MongoDB Ops Manager and AWS v1.1
Michael Lynn
 
PDF
Hands On Introduction To Ansible Configuration Management With Ansible Comple...
SlideTeam
 
PDF
MongoDB Management & Ansible
MongoDB
 
PDF
Red hat ansible automation technical deck
Juraj Hantak
 
PDF
Ansible a tool for dev ops
René Ribaud
 
PPTX
Ansible Hands On
Gianluca Farinelli
 
PDF
Managing Postgres with Ansible
Gulcin Yildirim Jelinek
 
PDF
Openbar 5 - Leuven - Automating everything with Ansible - Piros
Openbar
 
Intro to-ansible-sep7-meetup
Ramesh Godishela
 
Ansible - Hands on Training
Mehmet Ali Aydın
 
Ansible Tutorial.pdf
NigussMehari4
 
Devops with Python by Yaniv Cohen DevopShift
Yaniv cohen
 
DevOps for database
Osama Mustafa
 
Ansible
Rahul Bajaj
 
Ansible Devops North East - slides
InfinityPP
 
UNIT-I Introduction to Ansible.pptx
Pandiya Rajan
 
Ansible intro
Marcelo Quintiliano da Silva
 
Ansible automation sa technical deck q2 fy19
dvillaco
 
Ansible is the simplest way to automate. MoldCamp, 2015
Alex S
 
06 network automationwithansible
Khairul Zebua
 
Ansible, MongoDB Ops Manager and AWS v1.1
Michael Lynn
 
Hands On Introduction To Ansible Configuration Management With Ansible Comple...
SlideTeam
 
MongoDB Management & Ansible
MongoDB
 
Red hat ansible automation technical deck
Juraj Hantak
 
Ansible a tool for dev ops
René Ribaud
 
Ansible Hands On
Gianluca Farinelli
 
Managing Postgres with Ansible
Gulcin Yildirim Jelinek
 
Openbar 5 - Leuven - Automating everything with Ansible - Piros
Openbar
 
Ad

Recently uploaded (20)

PDF
Printable Lingala Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
PDF
Printable Macedonian Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
PPTX
Analyizing----Opinion---and---Truth.pptx
tornomarklloyd
 
PPTX
God Doesn't Forget You He will never abandon you
cristycababan
 
PDF
City in the Beyond Nosso Lar Text and Images Chico Xavier Heigorina Cunh...
frieden2143
 
PDF
Printable Malayalam Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
PPTX
Viral_A Study of Acts_Acts 9.19b-31_Slides.pptx
Stephen Palm
 
PPT
Grace of God, kids devotional djfnjdnmxm, ZC,SD v jsdkncjxmc xzcadzgvavc
jsamodal
 
PPTX
Tell it to the World. The things that will amaze them more.
RashidPabuaya
 
PPTX
389 Your troops shall be willing 390 This is the Day
Rick Peterson
 
PPTX
The Human Person as an Embodied Spirit.pptx
tornomarklloyd
 
PDF
Printable Maori Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
PDF
Printable Maldivian Divehi Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
PDF
Printable Norwegian Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
PDF
Heavenly Holy Spirit vs False Spirit: An Analysis of 1 Peter 1:12 by Matthews...
Matthews Bantsijang
 
PDF
BABYLON JERUSALEM COMPARATIVE ANALYSIS.pdf
majola2
 
PDF
Printable Nepali Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
PPTX
growing your marriage and let it rooted by the Word of God
IRVINGACACIO3
 
PDF
Chandogya_Upanishad_by_Swami_Swahananda.pdf
CantodaSereia
 
PDF
Printable Luxembourgish Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
Printable Lingala Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
Printable Macedonian Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
Analyizing----Opinion---and---Truth.pptx
tornomarklloyd
 
God Doesn't Forget You He will never abandon you
cristycababan
 
City in the Beyond Nosso Lar Text and Images Chico Xavier Heigorina Cunh...
frieden2143
 
Printable Malayalam Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
Viral_A Study of Acts_Acts 9.19b-31_Slides.pptx
Stephen Palm
 
Grace of God, kids devotional djfnjdnmxm, ZC,SD v jsdkncjxmc xzcadzgvavc
jsamodal
 
Tell it to the World. The things that will amaze them more.
RashidPabuaya
 
389 Your troops shall be willing 390 This is the Day
Rick Peterson
 
The Human Person as an Embodied Spirit.pptx
tornomarklloyd
 
Printable Maori Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
Printable Maldivian Divehi Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
Printable Norwegian Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
Heavenly Holy Spirit vs False Spirit: An Analysis of 1 Peter 1:12 by Matthews...
Matthews Bantsijang
 
BABYLON JERUSALEM COMPARATIVE ANALYSIS.pdf
majola2
 
Printable Nepali Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
growing your marriage and let it rooted by the Word of God
IRVINGACACIO3
 
Chandogya_Upanishad_by_Swami_Swahananda.pdf
CantodaSereia
 
Printable Luxembourgish Gospel Tract - Be Sure of Heaven.pdf
Filipino Tracts and Literature Society Inc.
 
Ad

ansible_rhel.pdf

  • 1. HOW TO USE THIS DECK This slide deck is meant to accompany the Ansible RHEL workshop, both sections if needed. Note that this deck is optional - the workshop content explains each and every Ansible idea in detail already. HOW TO IMPROVE THIS DECK The workshop is a collaborative effort. Help us to improve it! You can leave comments, and the BU will make sure to work on this. Tag for example Roland (Wolters) or Sean (Cavanaugh) to ensure that they pick it up. Speaking about the BU: the fact that this deck is now owned by an organization and not individuals anymore hopefully ensures for the future that the deck stays up2date over time as the workshop develops. THANKS HUGE THANK YOU to the following people - without them, this deck would not have been possible. Thanks to: Kevin “GoKEV” Holmes Phil Avery Russell Pavlicek Matt St Onge Will Tome Götz Rieger Benjamin Blasco Thanks for providing input, helping proofread, error check, and improving this deck continuously.
  • 2. Ansible Linux Automation Workshop Introduction to Ansible for Red Hat Enterprise Linux Automation for System Administrators and Operators
  • 3. 3 ● Timing ● Breaks ● Takeaways Housekeeping
  • 4. 4 ● Introduction to Ansible Automation ● How it works ● Understanding modules, tasks & playbooks ● How to execute Ansible commands ● Using variables & templates ● Tower - where it fits in ● Basic usage of Tower ● Learn major Tower features: RBAC, workflows and so on What you will learn
  • 5. 5 Introduction Topics Covered: ● What is the Ansible Automation Platform? ● What can it do?
  • 6. Automation happens when one person meets a problem they never want to solve again
  • 7. Teams are automating... Lines Of Business Network Security Operations Developers Infrastructure
  • 8. Ansible used in silo DIY scripting automation Open source config management tool Proprietary vendor supplied automation Ad-hoc Automation is happening in silos Network Infrastructure Security Developers Is organic automation enough?
  • 9. Why Ansible? Simple Powerful Agentless App deployment Configuration management Workflow orchestration Network automation Orchestrate the app lifecycle Human readable automation No special coding skills needed Tasks executed in order Usable by every team Get productive quickly Agentless architecture Uses OpenSSH & WinRM No agents to exploit or update Get started immediately More efficient & more secure
  • 10. What can I do using Ansible? Automate the deployment and management of your entire IT footprint. Orchestration Do this... Firewalls Configuration Management Application Deployment Provisioning Continuous Delivery Security and Compliance On these... Load Balancers Applications Containers Clouds Servers Infrastructure Storage And more... Network Devices
  • 11. When automation crosses teams, you need an automation platform Lines Of Business Network Security Operations Developers Infrastructure
  • 12. Red Hat Ansible Automation Platform Lines of business Network Operations Security Infrastructure Developers Ansible Tower: Operate & control at scale Ansible Engine: Universal language of automation Fueled by an open source community Engage Scale Create Ansible Hosted Services: Engage users with an automation focused experience
  • 13. Cloud Virt & Container Windows Network Security Monitoring Ansible automates technologies you use Time to automate is measured in minutes AWS Azure Digital Ocean Google OpenStack Rackspace +more Docker VMware RHV OpenStack OpenShift +more ACLs Files Packages IIS Regedits Shares Services Configs Users Domains +more A10 Arista Aruba Cumulus Bigswitch Cisco Dell Extreme F5 Lenovo MikroTik Juniper OpenSwitch +more Checkpoint Cisco CyberArk F5 Fortinet Juniper IBM Palo Alto Snort +more Dynatrace Datadog LogicMonitor New Relic Sensu +more Devops Jira GitHub Vagrant Jenkins Slack +more Storage Netapp Red Hat Storage Infinidat +more Operating Systems RHEL Linux Windows +more
  • 14. 3 ROI on Ansible Tower 146% < MONTHS Payback on Ansible Tower Financial summary: SOURCE: "The Total Economic Impact™ Of Red Hat Ansible Tower, a June 2018 commissioned study conducted by Forrester Consulting on behalf of Red Hat." redhat.com/en/engage/total-economic-impact-ansible-tower-20180710 Reduction in recovery time following a security incident 94% 84% Savings by deploying workloads to generic systems appliances using Ansible Tower 67% Reduction in man hours required for customer deliveries Red Hat Ansible Tower by the numbers:
  • 16. 16 Exercise 1.1 Topics Covered: ● Understanding the Ansible Infrastructure ● Check the prerequisites
  • 18. ANSIBLE AUTOMATION ENGINE CMDB USERS INVENTORY HOSTS NETWORK DEVICES PLUGINS CLI MODULES ANSIBLE PLAYBOOK PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD PLAYBOOKS ARE WRITTEN IN YAML Tasks are executed sequentially Invoke Ansible modules
  • 19. --- - name: install and start apache hosts: web become: yes tasks: - name: httpd package is present yum: name: httpd state: latest - name: latest index.html file is present template: src: files/index.html dest: /var/www/html/ - name: httpd is started service: name: httpd state: started
  • 20. ANSIBLE AUTOMATION ENGINE CMDB USERS INVENTORY HOSTS NETWORK DEVICES PLUGINS CLI ANSIBLE PLAYBOOK PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD MODULES ARE “TOOLS IN THE TOOLKIT” Python, Powershell, or any language Extend Ansible simplicity to the entire stack MODULES - name: latest index.html file is present template: src: files/index.html dest: /var/www/html/
  • 21. ANSIBLE AUTOMATION ENGINE CMDB USERS INVENTORY HOSTS NETWORK DEVICES CLI ANSIBLE PLAYBOOK PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD PLUGINS ARE “GEARS IN THE ENGINE” Code that plugs into the core engine Adaptability for various uses & platforms MODULES PLUGINS {{ some_variable | to_nice_yaml }}
  • 22. ANSIBLE AUTOMATION ENGINE CMDB USERS HOSTS NETWORK DEVICES CLI ANSIBLE PLAYBOOK PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD MODULES PLUGINS INVENTORY INVENTORY List of systems in your infrastructure that automation is executed against [web] webserver1.example.com webserver2.example.com [db] dbserver1.example.com [switches] leaf01.internal.com leaf02.internal.com [firewalls] checkpoint01.internal.com [lb] f5-01.internal.com
  • 23. ANSIBLE AUTOMATION ENGINE USERS HOSTS NETWORK DEVICES CLI ANSIBLE PLAYBOOK MODULES PLUGINS INVENTORY PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD CLOUD Red Hat Openstack, Red Hat Satellite, VMware, AWS EC2, Rackspace, Google Compute Engine, Azure CMDB
  • 24. ANSIBLE AUTOMATION ENGINE USERS HOSTS NETWORK DEVICES CLI ANSIBLE PLAYBOOK MODULES PLUGINS INVENTORY CMDB ServiceNow, Cobbler, BMC, Custom cmdb PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD CMDB
  • 25. ANSIBLE AUTOMATION ENGINE USERS CLI ANSIBLE PLAYBOOK MODULES PLUGINS INVENTORY PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD CMDB HOSTS NETWORK DEVICES AUTOMATE EVERYTHING Red Hat Enterprise Linux, Cisco routers, Arista switches, Juniper routers, Windows hosts, Check Point firewalls, NetApp storage, F5 load balancers and more
  • 26. LINUX AUTOMATION ansible.com/get-started AUTOMATE EVERYTHING LINUX Red Hat Enterprise Linux, BSD, Debian, Ubuntu and many more! ONLY REQUIREMENTS: Python 2 (2.6 or later) or Python 3 (3.5 or later) 150+ Linux Modules
  • 27. How Ansible Automation works NETWORKING DEVICES LINUX/WINDOWS HOSTS Module code is copied to the managed node, executed, then removed Module code is executed locally on the control node
  • 28. 28 ● Follow the steps to access environment ● Use the IP provided to you, the script only has example IP ● Which editor do you use on command line? If you don’t know, we have a short intro Verify Access
  • 29. Lab Time Complete exercise 1.1 now in your lab environment
  • 30. 30 Exercise 1.2 Topics Covered: ● Ansible inventories ● Main Ansible config file ● Modules and ad-hoc commands
  • 31. 31 ● Ansible works against multiple systems in an inventory ● Inventory is usually file based ● Can have multiple groups ● Can have variables for each group or even host Inventory
  • 32. # Static inventory example: [myservers] 10.42.0.2 10.42.0.6 10.42.0.7 10.42.0.8 10.42.0.100 host.example.com Understanding Inventory - Basic
  • 33. [app1srv] appserver01 ansible_host=10.42.0.2 appserver02 ansible_host=10.42.0.3 [web] node-[1:30] ansible_host=10.42.0.[31:60] [web:vars] apache_listen_port=8080 apache_root_path=/var/www/mywebdocs/ [all:vars] ansible_user=kev ansible_ssh_private_key_file=/home/kev/.ssh/id_rsa Understanding Inventory - Basic
  • 34. [app1srv] appserver01 ansible_host=10.42.0.2 appserver02 ansible_host=10.42.0.3 [web] node-[1:30] ansible_host=10.42.0.[31:60] [web:vars] apache_listen_port=8080 apache_root_path=/var/www/mywebdocs/ [all:vars] ansible_user=ender ansible_ssh_private_key_file=/home/ender/.ssh/id_rsa Understanding Inventory - Variables
  • 36. 36 ● Basic configuration for Ansible ● Can be in multiple locations, with different precedence ● Here: .ansible.cfg in the home directory ● Configures where to find the inventory Configuration File
  • 37. Configuration files will be searched for in the following order: 37 ➔ ANSIBLE_CONFIG (environment variable if set) ➔ ansible.cfg (in the current directory) ➔ ~/.ansible.cfg (in the home directory) ➔ /etc/ansible/ansible.cfg (installed as Ansible default) The Ansible Configuration
  • 38. 38 ● Single Ansible command to perform a task quickly directly on command line ● Most basic operation that can be performed ● Here: an example Ansible ping - not to be confused with ICMP $ ansible all -m ping First Ad-Hoc Command: ping
  • 39. ping Groups can be nested # Check connections (submarine ping, not ICMP) [user@ansible] $ ansible all -m ping web1 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } 39 Ad-Hoc Commands
  • 40. 40 Some basics to keep you from getting stuck --help (Display some basic and extensive options) [user@ansible ~]$ ansible --help- Usage: ansible <host-pattern> [options] Define and run a single task 'playbook' against a set of hosts Options: -a MODULE_ARGS, --args=MODULE_ARGS module arguments --ask-vault-pass ask for vault password -B SECONDS, --background=SECONDS <<<snippet, output removed for brevity>>> The Ansible Command
  • 41. Here are some common options you might use: 41 -m MODULE_NAME, --module-name=MODULE_NAME Module name to execute the ad-hoc command -a MODULE_ARGS, --args=MODULE_ARGS Module arguments for the ad-hoc command -b, --become Run ad-hoc command with elevated rights such as sudo, the default method -e EXTRA_VARS, --extra-vars=EXTRA_VARS Set additional variables as key=value or YAML/JSON Ad-Hoc Commands
  • 42. Here are some common options you might use: Groups can be nested # Check connections to all (submarine ping, not ICMP) [user@ansible] $ ansible all -m ping # Run a command on all the hosts in the web group [user@ansible] $ ansible web -m command -a "uptime" # Collect and display known facts for server “web1” [user@ansible] $ ansible web1 -m setup 42 Ad-Hoc Commands
  • 43. Lab Time Complete exercise 1.2 now in your lab environment
  • 44. 44 Exercise 1.3 Topics Covered: ● Playbooks basics ● Running a playbook
  • 45. --- - name: install and start apache hosts: web become: yes tasks: - name: httpd package is present yum: name: httpd state: latest - name: latest index.html file is present template: src: files/index.html dest: /var/www/html/ - name: httpd is started service: name: httpd state: started An Ansible Playbook A play
  • 46. --- - name: install and start apache hosts: web become: yes tasks: - name: httpd package is present yum: name: httpd state: latest - name: latest index.html file is present template: src: files/index.html dest: /var/www/html/ - name: httpd is started service: name: httpd state: started An Ansible Playbook A task
  • 47. --- - name: install and start apache hosts: web become: yes tasks: - name: httpd package is present yum: name: httpd state: latest - name: latest index.html file is present template: src: files/index.html dest: /var/www/html/ - name: httpd is started service: name: httpd state: started An Ansible Playbook module
  • 48. 48 A task executed as expected, no change was made. A task executed as expected, making a change A task failed to execute successfully The most important colors of Ansible Running an Ansible Playbook:
  • 49. 49 [user@ansible] $ ansible-playbook apache.yml PLAY [webservers] *************************************************************************** TASK [Gathering Facts] ********************************************************************** ok: [web2] ok: [web1] ok: [web3] TASK [Ensure httpd package is present] ****************************************************** changed: [web2] changed: [web1] changed: [web3] TASK [Ensure latest index.html file is present] ********************************************* changed: [web2] changed: [web1] changed: [web3] TASK [Restart httpd] ************************************************************************ changed: [web2] changed: [web1] changed: [web3] PLAY RECAP ********************************************************************************** web2 : ok=1 changed=3 unreachable=0 failed=0 web1 : ok=1 changed=3 unreachable=0 failed=0 web3 : ok=1 changed=3 unreachable=0 failed=0 Running an Ansible Playbook
  • 50. Lab Time Complete exercise 1.3 now in your lab environment
  • 51. 51 Exercise 1.4 Topics Covered: ● Working with variables ● What are facts?
  • 52. --- - name: variable playbook test hosts: localhost vars: var_one: awesome var_two: ansible is var_three: "{{ var_two }} {{ var_one }}" tasks: - name: print out var_three debug: msg: "{{var_three}}" An Ansible Playbook Variable Example
  • 53. --- - name: variable playbook test hosts: localhost vars: var_one: awesome var_two: ansible is var_three: "{{ var_two }} {{ var_one }}" tasks: - name: print out var_three debug: msg: "{{var_three}}" An Ansible Playbook Variable Example ansible is awesome
  • 54. 54 ● Just like variables, really... ● ...but: coming from the host itself! ● Check them out with the setup module Facts "ansible_facts": { "ansible_default_ipv4": { "address": "10.41.17.37", "macaddress": "00:69:08:3b:a9:16", "interface": "eth0", ...
  • 55. Gather facts on target machine 55 $ ansible localhost -m setup localhost | SUCCESS => { "ansible_facts": { "ansible_all_ipv4_addresses": [ "192.168.122.1", "172.21.208.111" ], "ansible_all_ipv6_addresses": [ "fe80::8f31:b68d:f487:2775" ],
  • 56. 56 vars: mynewip: 10.7.62.39- "ansible_facts": { "ansible_default_ipv4": { "address": "10.41.17.37", "macaddress": "00:69:08:3b:a9:16", "interface": "eth0", ... DEVICE="{{ ansible_default_ipv4.interface }}" ONBOOT=yes HWADDR={{ ansible_default_ipv4.macaddress }} TYPE=Ethernet BOOTPROTO=static IPADDR={{ mynewip }} This is a template file for ifcfg-eth0, using a mix of discovered facts and variables to write the static file. A variable, defined in our playbook Ansible Variables and Facts
  • 57. Ansible can work with metadata from various sources as variables. Different sources will be overridden in an order of precedence. 57 1. extra vars (Highest - will override anything else) 2. task vars (overridden only for the task) 3. block vars (overridden only for tasks in block) 4. role and include vars 5. play vars_files 6. play vars_prompt 7. play vars 8. set_facts 9. registered vars 10. host facts 11. playbook host_vars 12. playbook group_vars 13. inventory host_vars 14. inventory group_vars 15. inventory vars 16. role defaults (Lowest - will be overridden by anything else listed here) Variable Precedence
  • 58. 58 [user@ansible ~]$ tree /somedir /somedir ├── group_vars │ └── app1srv │ └── db │ └── web ├── inventory └── host_vars └─ app01 └─ app02 └─ app03 Ansible Inventory - Managing Variables In Files
  • 59. [user@ansible ~]$ cat /somedir/group_vars/web apache_listen_port: 8080 apache_root_path: /var/www/mywebdocs/ 59 [user@ansible ~]$ cat /somedir/host_vars/app01 owner_name: Chris P. Bacon owner_contact: 'cbacon@mydomain.tld' server_purpose: Application X [user@ansible ~]$ tree /somedir /somedir ├── group_vars- │ └── app1srv │ └── db │ └── web ├── inventory- └── host_vars- └─ app01 └─ app02 └─ app03 [user@ansible ~]$ cat /somedir/inventory [web] node-[1:30] ansible_host=10.42.0.[31:60] [appxsrv] app01 app02 app03 Ansible Inventory - Managing Variables In Files
  • 60. Lab Time Complete exercise 1.4 now in your lab environment
  • 61. 61 Exercise 1.5 Topics Covered: ● Conditionals ● Handlers ● Loops
  • 62. Conditionals via VARS vars: my_mood: happy tasks: - name: conditional task, based on my_mood var debug: msg: "Come talk to me. I am {{ my_mood }}!" when: my_mood == "happy"
  • 63. Conditionals with variables vars: my_mood: happy tasks: - name: conditional task, based on my_mood var debug: msg: "Come talk to me. I am {{ my_mood }}!" when: my_mood == "happy" debug: msg: "Feel free to interact. I am {{ my_mood }}" when: my_mood != "grumpy" Alternatively
  • 64. Conditionals with facts tasks: - name: Install apache apt: name: apache2 state: latest when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu' - name: Install httpd yum: name: httpd state: latest when: ansible_distribution == 'RedHat'
  • 65. Using the previous task state - name: Ensure httpd package is present yum: name: httpd state: latest register: http_results - name: Restart httpd service: name: httpd state: restart when: httpd_results.changed This is NOT a handler task, but has similar function
  • 66. Handler Tasks tasks: - name: Ensure httpd package is present yum: name: httpd state: latest notify: restart_httpd handlers: - name: restart_httpd service: name: httpd state: restart A handler task is run when a referring task result shows a change
  • 67. tasks: - name: Ensure httpd package is present yum: name: httpd state: latest notify: restart_httpd - name: Standardized index.html file copy: content: "This is my index.html file for {{ ansible_host }}" dest: /var/www/html/index.html notify: restart_httpd Handler Tasks TASK [Ensure httpd package is present] ****************************************************** ok: [web2] ok: [web1] TASK [Standardized index.html file] ********************************************************* changed: [web2] changed: [web1] NOTIFIED: [restart_httpd] ******************************************************************* changed: [web2] changed: [web1] If either task notifies a changed result, the handler will be notified ONCE. unchanged changed handler runs once
  • 68. tasks: - name: Ensure httpd package is present yum: name: httpd state: latest notify: restart_httpd - name: Standardized index.html file copy: content: "This is my index.html file for {{ ansible_host }}" dest: /var/www/html/index.html notify: restart_httpd Handler Tasks TASK [Ensure httpd package is present] ****************************************************** changed: [web2] changed: [web1] TASK [Standardized index.html file] ********************************************************* changed: [web2] changed: [web1] NOTIFIED: [restart_httpd] ******************************************************************* changed: [web2] changed: [web1] If both of these tasks notifies of a changed result, the handler will be notified ONCE. changed handler runs once changed
  • 69. tasks: - name: Ensure httpd package is present yum: name: httpd state: latest notify: restart_httpd - name: Standardized index.html file copy: content: "This is my index.html file for {{ ansible_host }}" dest: /var/www/html/index.html notify: restart_httpd Handler Tasks If neither task notifies a changed result, the handler does not run. TASK [Ensure httpd package is present] ****************************************************** ok: [web2] ok: [web1] TASK [Standardized index.html file] ********************************************************* ok: [web2] ok: [web1] PLAY RECAP ********************************************************************************** web2 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 web1 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 unchanged unchanged
  • 70. --- - name: Ensure users hosts: node1 become: yes tasks: - name: Ensure user is present user: name: dev_user state: present - name: Ensure user is present user: name: qa_user state: present - name: Ensure user is present user: name: prod_user state: present Variables & Loops Great opportunity to use a loop
  • 71. --- - name: Ensure users hosts: node1 become: yes tasks: - name: Ensure users are present user: name: “{{item}}” state: present loop: - dev_user - qa_user - prod_user Variables & Loops Using loops to simplify tasks
  • 72. Lab Time Complete exercise 1.5 now in your lab environment
  • 74. - name: Ensure apache is installed and started hosts: web become: yes vars: http_port: 80 http_docroot: /var/www/mysite.com tasks: - name: Verify correct config file is present template: src: templates/httpd.conf.j2 dest: /etc/httpd/conf/httpd.conf Variables & Templates Using a system fact or declared variable to write a file
  • 75. - name: Ensure apache is installed and started hosts: web become: yes vars: http_port: 80 http_docroot: /var/www/mysite.com tasks: - name: Verify correct config file is present template: src: templates/httpd.conf.j2 dest: /etc/httpd/conf/httpd.conf Variables & Templates Using a system fact or declared variable to write a file ## Excerpt from httpd.conf.j2 # Change this to Listen on specific IP addresses as shown below to # prevent Apache from glomming onto all bound IP addresses. # # Listen 80 ## original line Listen {{ http_port }} # DocumentRoot: The directory out of which you will serve your # documents. # DocumentRoot "/var/www/html" DocumentRoot {{ http_docroot }}
  • 76. Lab Time Complete exercise 1.6 now in your lab environment
  • 77. 77 Exercise 1.7 Topics Covered: ● What are roles? ● How they look like ● Galaxy
  • 78. 78 ● Roles: Think Ansible packages ● Roles provide Ansible with a way to load tasks, handlers, and variables from separate files. ● Roles group content, allowing easy sharing of code with others ● Roles make larger projects more manageable ● Roles can be developed in parallel by different administrators Better start using roles now! Roles
  • 79. 79 user/ ├── defaults │ └── main.yml ├── handlers │ └── main.yml ├── meta │ └── main.yml ├── README.md ├── tasks │ └── main.yml ├── templates ├── tests │ ├── inventory │ └── test.yml └── vars └── main.yml ● Defaults: default variables with lowest precedence (e.g. port) ● Handlers: contains all handlers ● Meta: role metadata including dependencies to other roles ● Tasks: plays or tasks Tip: It’s common to include tasks in main.yml with “when” (e.g. OS == xyz) ● Templates: templates to deploy ● Tests: place for playbook tests ● Vars: variables (e.g. override port) Role structure
  • 81. Lab Time Complete exercise 1.7 now in your lab environment
  • 82. 82 Exercise 1.8 Topics Covered: ● A bonus lab - try it on your own, and when time permits
  • 83. Lab Time Complete exercise 1.8 now in your lab environment
  • 85. 85 Exercise 2.1 Topics Covered: ● Introduction to Tower
  • 86. Ansible Tower is a UI and RESTful API allowing you to scale IT automation, manage complex deployments and speed productivity. • Role-based access control • Deploy entire applications with push-button deployment access • All automations are centrally logged • Powerful workflows match your IT processes What is Ansible Tower?
  • 87. RBAC Allow restricting playbook access to authorized users. One team can use playbooks in check mode (read-only) while others have full administrative abilities. Push button An intuitive user interface experience makes it easy for novice users to execute playbooks you allow them access to. RESTful API With an API first mentality every feature and function of Tower can be API driven. Allow seamless integration with other tools like ServiceNow and Infoblox. Workflows Ansible Tower’s multi-playbook workflows chain any number of playbooks, regardless of whether they use different inventories, run as different users, run at once or utilize different credentials. Enterprise integrations Integrate with enterprise authentication like TACACS+, RADIUS, Azure AD. Setup token authentication with OAuth 2. Setup notifications with PagerDuty, Slack and Twilio. Centralized logging All automation activity is securely logged. Who ran it, how they customized it, what it did, where it happened - all securely stored and viewable later, or exported through Ansible Tower’s API. Red Hat Ansible Tower
  • 88. USE CASES USERS CLOUD AWS, GOOGLE CLOUD, AZURE, IBM CLOUD … INFRASTRUCTURE LINUX, OPENSHIFT, WINDOWS, VMWARE, OPERATORS, CONTAINERS … NETWORK ARISTA, CISCO, JUNIPER INFOBLOX F5 … SECURITY CHECKPOINT, QRADAR, SNORT CYBERARK, SPLUNK, FORTINET … SERVICES DATABASES, LOGGING, SOURCE CONTROL MANAGEMENT… TRANSPORT SSH, WINRM, NETWORK_CLI, HTTPAPI AUTOMATE YOUR ENTERPRISE ADMINS ANSIBLE CLI & CI SYSTEMS ANSIBLE PLAYBOOKS …. ANSIBLE TOWER SIMPLE USER INTERFACE ROLE-BASED ACCESS CONTROL CONFIGURATION MANAGEMENT APP DEPLOYMENT CONTINUOUS DELIVERY SECURITY & COMPLIANCE ORCHESTRATION PROVISIONING KNOWLEDGE & VISIBILITY SCHEDULED & CENTRALIZED JOBS TOWER API ANSIBLE ENGINE OPEN SOURCE MODULE LIBRARY PYTHON CODEBASE PLUGINS APP DEVELOPMENT PYTHON VENV, NPM, YUM, APT, PIP... CLOUD.REDHAT.COM AUTOMATION HUB AUTOMATION ANAL YTICS Ansible Automation Platform CERTIFIED COLLECTIONS PARTNER COLLECTIONS PERFORMANCE DASHBOARD ORGANIZATIONAL STATS
  • 89. Lab Time Complete exercise 2.1 now in your lab environment
  • 90. 90 Exercise 2.2 Topics Covered: ● Inventories ● Credentials
  • 91. Inventory is a collection of hosts (nodes) with associated data and groupings that Ansible Tower can connect to and manage. ● Hosts (nodes) ● Groups ● Inventory-specific data (variables) ● Static or dynamic sources Inventory
  • 92. Credentials are utilized by Ansible Tower for authentication with various external resources: ● Connecting to remote machines to run jobs ● Syncing with inventory sources ● Importing project content from version control systems ● Connecting to and managing network devices Centralized management of various credentials allows end users to leverage a secret without ever exposing that secret to them. Credentials
  • 93. Lab Time Complete exercise 2.2 now in your lab environment
  • 94. 94 Exercise 2.3 Topics Covered: ● Projects ● Job Templates
  • 95. Project A project is a logical collection of Ansible Playbooks, represented in Ansible Tower. You can manage Ansible Playbooks and playbook directories by placing them in a source code management system supported by Ansible Tower, including Git, Subversion, and Mercurial.
  • 96. Everything in Ansible Tower revolves around the concept of a Job Template. Job Templates allow Ansible Playbooks to be controlled, delegated and scaled for an organization. Job templates also encourage the reuse of Ansible Playbook content and collaboration between teams. A Job Template requires: ● An Inventory to run the job against ● A Credential to login to devices. ● A Project which contains Ansible Playbooks Job Templates
  • 97. Job Templates can be found and created by clicking the Templates button under the RESOURCES section on the left menu. Expanding on Job Templates
  • 98. Job Templates can be launched by clicking the rocketship button for the corresponding Job Template Executing an existing Job Template
  • 99. New Job Templates can be created by clicking the plus button Creating a new Job Template (1/2)
  • 100. This New Job Template window is where the inventory, project and credential are assigned. The red asterisk * means the field is required . Creating a new Job Template (2/2)
  • 101. Lab Time Complete exercise 2.3 now in your lab environment
  • 103. Tower surveys allow you to configure how a job runs via a series of questions, making it simple to customize your jobs in a user-friendly way. An Ansible Tower survey is a simple question-and-answer form that allows users to customize their job runs. Combine that with Tower's role-based access control, and you can build simple, easy self-service for your users. Surveys
  • 104. Once a Job Template is saved, the Add Survey Button will appear Click the button to open the Add Survey window. Creating a Survey (1/2)
  • 105. The Add Survey window allows the Job Template to prompt users for one or more questions. The answers provided become variables for use in the Ansible Playbook. Creating a Survey (2/2)
  • 106. The Add Survey window allows the Job Template to prompt users for one or more questions. The answers provided become variables for use in the Ansible Playbook. Creating a Survey (2/2)
  • 107. When launching a job, the user will now be prompted with the Survey. The user can be required to fill out the Survey before the Job Template will execute. Using a Survey
  • 108. Lab Time Complete exercise 2.4 now in your lab environment
  • 109. 109 Exercise 2.5 Topics Covered: ● Role based access control
  • 110. Role-Based Access Controls (RBAC) are built into Ansible Tower and allow administrators to delegate access to inventories, organizations, and more. These controls allow Ansible Tower to help you increase security and streamline management of your Ansible automation. Role Based Access Control (RBAC)
  • 111. ● An organization is a logical collection of users, teams, projects, inventories and more. All entities belong to an organization. ● A user is an account to access Ansible Tower and its services given the permissions granted to it. ● Teams provide a means to implement role-based access control schemes and delegate responsibilities across organizations. User Management
  • 112. Clicking on the Organizations button in the left menu will open up the Organizations window Viewing Organizations
  • 113. Clicking on the Teams button in the left menu will open up the Teams window Viewing Teams
  • 114. Clicking on the Users button in the left menu will open up the Users window Viewing Users
  • 115. Lab Time Complete exercise 2.5 now in your lab environment
  • 117. Workflows can be found alongside Job Templates by clicking the Templates button under the RESOURCES section on the left menu. Workflows
  • 118. To add a new Workflow click on the green + button This time select the Workflow Template Adding a new Workflow Template
  • 119. Fill out the required parameters and click SAVE. As soon as the Workflow Template is saved the WORKFLOW VISUALIZER will open. Creating the Workflow
  • 120. The workflow visualizer will start as a blank canvas. Workflow Visualizer
  • 121. Visualizing a Workflow Workflows can branch out, or converge in. Green indicates this Job Template will only be run if the previous Job Template is successful Red indicates this Job Template will only be run if the previous Job Template fails Blue indicates this Job Template will always run
  • 122. Lab Time Complete exercise 2.6 now in your lab environment
  • 124. Lab Time Complete exercise 2.7 now in your lab environment
  • 125. GET STARTED JOIN THE COMMUNITY WORKSHOPS & TRAINING SHARE YOUR STORY ansible.com/get-started ansible.com/tower-trial ansible.com/workshops Red Hat Training ansible.com/community Follow us @Ansible Friend us on Facebook Next Steps