Ansible

Configuration management

Links

• Homepage
• Adding iptables Rules With Ansible
• Going Deeper into Ansible Playbooks
• An Ansible Tutorial
• How to Install and Configure latest version of Ansible on Ubuntu Linux
• Getting started with Ansible
• Tips and tricks
• AWX
• Ansible Galaxy
• Timeouts
• Ansible sample scripts
• module for postfix
• Ansible collections

Tools

• Molecule for testing roles
• ansible-lint
• ansible-console
• ansible-inventory

Docs

• Ansible Howto
• Ansible builtin modules
• All plugins
• Conditionals
• Parallel!

Ansible style guides

• Style guide
• Ansible good practices

• Ansible variables

Lineinfile

• Lineinfile module

Popular modules

• ansible.builtin.file
• ansible.builtin.apt
• ansible.builtin.lineinfile

Inventories

• [1]
• Dynamic Inventory
• Creating custom dynamic inventories
• Set up ansible inventories

Alternatives

• Puppet
• Saltstack

Quickstart

On server as root create key:

ssh-keygen

(go for defaults) and then get content of ~/.ssh/id_rsa.pub in your copypastebuffer

On 'clients' edit /etc/ssh/sshd_config to

PermitRootLogin without-password

and restart sshd

Edit/create ~root/.ssh/authorized_keys and add:

from="ip.of.ansible.server" <paste public key here>

Scripts/playbooks

Maintain useraccounts

 ---

 - name: remove users
  user: name=exuser state=absent force=yes groups=''
  with_dict: accounts
  tags:
    - delusers

 - name: sync group
  group:
    name: sync
    gid: 999
    state: "present"

 - name: fix homedir rights
  lineinfile: dest=/etc/login.defs regexp=^UMASK line="UMASK 007"

 - name: useraccounts
  user:
    name: "{{ item.key }}"
    comment: "{{ item.value.name }}"
    uid: "{{ item.value.uid }}"
    state: "present"
    shell: "/bin/bash"
    groups: sudo
  with_dict: accounts
  tags:
    - accounts

 - name: userpasswords
  user:
    name: "{{ item.key }}"
    password: "{{ lookup('csvfile',item.key + ' file=/etc/shadow delimiter=: col=1' ) }}"
  with_dict: accounts

#ssh keys
 - name: userkeys
  authorized_key: user={{ item.key }} key="{{ lookup('file','/home/' + item.key + '/.ssh/authorized_keys' ) }}" exclusive=yes
  with_dict: accounts
  tags:
    - keys

 - name: nofoobar
  user: name=foobar state=absent remove=yes
  tags:
    - foobar
 

comment out a line

- name: remove java line from rclocal
  lineinfile:
    dest: /etc/rc.local
    regexp: '^(java.*)$'
    line: '# \1'
    backrefs: yes

HOWTO

Add user to group

name: add user to bargroup
 user:
   name: foo
   groups: bargroup
   append: yes

Cronjobs and ssh passphrases

See Use Your SSH Agent in a Crontab ( keychain)

FAQ

Notify multiple handlers

notify:
  - Call Handler1
  - Call Handler2

Print hostname in debug msg

debug:
  msg: "Something to report in Template:Inventory hostname"

Connect to a different port

Try

--extra-vars="ansible_port=2345"

Error messages

Parse errors

ERROR! conflicting action statements: debug, msg

indentation

[WARNING]: Unable to parse <some hostname> as an inventory source

Append a comma

ansible-playbook myplay.yml -i myhostname,

Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this.

Please add this host's fingerprint to your known_hosts file to manage this host.

Try

ANSIBLE_HOST_KEY_CHECKING=False playbook ...

Or just ssh to the host and accept key

Platform linux on host backup01 is using the discovered Python interpreter at /usr/bin/python3

one hack is adding to ~/.ansible.cfg:

[defaults]
interpreter_python=auto_silent  

Or fix on that system:

update-alternatives --install /usr/bin/python python /usr/bin/python3 1

The error was: 'item' is undefined"

wrong indentation for with_items

Failed to connect to the host via ssh: Permission denied (publickey,password)

To connect without public key in authorized keys try

--ask-pass

roles for multiple distributions

 include_vars with "distro-Template:Ansible distro name.yml"

Escape single quote

'foo bar '

Syntax Error while loading YAML. did not find expected key

Check indentation

Newlines in output

instead of all those '\n':

In ansible.cfg:

stdout_callback = yaml

Ad-hoc commands

http://docs.ansible.com/ansible/latest/intro_adhoc.html

check python code

ansible-test sanity --test pep8 mycode.py

Command/shell output on single line

ANSIBLE_STDOUT_CALLBACK=oneline ansible-playbook foo.yml

Storing passwords

http://docs.ansible.com/ansible/2.4/vault.html

Show all host variables

ansible -m setup <hostname>

Show all OS/versions

ansible all -m setup -a "filter=ansible_distribution*"

Syntax highlighting for ansible

• https://github.com/chase/vim-ansible-yaml

Drop the files in ~/vim/bundle and in .vimrc:

call pathogen#infect()
call pathogen#helptags()

Or maybe better:

• https://github.com/pearofducks/ansible-vim

Retry

--limit @/home/ansible/ssh.retry

Error messages

ERROR! this task 'import_playbook' has extra params

meh

 

/usr/bin/chattr: Clearing extent flag not supported

Probably trying to make a backup of a symlink

Missing sudo password

set NOPASSWD in sudo config

Escape curly braces

{{ '{' }}

Check file for string

 tasks:
   - name: grep line
     shell: "grep -q swap /etc/fstab"
     failed_when: false
     register: grepped

   - name: show grep
     debug:
       msg: "exists"
     when: grepped.rc == 0
      
     

Error messages

msg: The PyMySQL (Python 2.7 and Python 3.X) or MySQL-python (Python 2.X) module is required

Means you need to install for example python2-PyMySQL on that host

Ansible-lint messages

Commands should not change things if nothing needs doing

Ignore, or use

changed_when: false

Shells that use pipes should set the pipefail option

shell: |
  set -o pipefail
  some command

Tips & tricks

Includes only when on host group

  - block:
    - include: foo.yml 
    - include: bar.yml
  when: "'foobar' in group_names"

Show info/facts of a host

ansible somehost -m setup
ansible somehost -m ansible.builtin.setup

Show distribution and version

 - name: show some host info
   debug:
     msg: Dist Template:Ansible distribution Template:Ansible distribution version