Skip to content
Snippets Groups Projects
Commit 1e0883aa authored by Vincent Mazenod's avatar Vincent Mazenod
Browse files

ansible

parent ec46cdbc
No related branches found
No related tags found
No related merge requests found
Pipeline #3446 passed
Stage: build
Stage: deploy
Hide whitespace changes
Inline Side-by-side
content/slides/cri/md/ansible.md
+ 187
− 78
View file @ 1e0883aa
......@@ -434,19 +434,19 @@ conditions jinja, à la python:
* not, is, empty, in ...
## task
## ignore_errors
* permet de continuer l'exécution du playbook
* même en cas de retour d'erreur d'une commande
```yaml
- name: get mysqladmin
- name: get mysqladmin status
shell: mysqladmin status
ignore_errors: True
```
## task
## failed_when
* permet de forcer à stopper l'exécution du playbook
* sur une condition
......@@ -457,6 +457,8 @@ conditions jinja, à la python:
failed_when: "'FAILED' in command_result.stderr"
```
[<i class="fa fa-book" aria-hidden="true"></i> fail - Fail with custom message](https://docs.ansible.com/ansible/latest/modules/fail_module.html)
* parfois ignorer l'erreur ne suffit pas pour continuer
* il faut ajouter `failed_when`
......@@ -482,7 +484,7 @@ conditions jinja, à la python:
- name: redirige la sortie de somescript.sh dans somelog.txt
shell: somescript.sh >> somelog.txt
args:
chdir: somedir/
chdir: somedir/ifcon
creates: somelog.txt
```
......@@ -514,6 +516,8 @@ dans une liste
## register (<i class="fa fa-gift" aria-hidden="true"></i>)
[<i class="fa fa-book" aria-hidden="true"></i> Return Values](https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html)
```json
"msg": {
"changed": true,
......@@ -534,57 +538,52 @@ dans une liste
}
```
## register (<i class="fa fa-gift" aria-hidden="true"></i>)
afficher l'output
```yaml
- name: afficher la sortie de la commande
debug:
msg: pam_status.stdout
```
## register (<i class="fa fa-gift" aria-hidden="true"></i>)
itérer sur une liste
```yaml
- name:
shell: mysqladmin status
register: mysql_status
ignore_errors: True
- name: afficher la sortie de chaque commande
debug:
msg: "{{ services_status.results[item].stdout }}"
loop: "{{ range(0, 3)|list }}"
```
ou
```yaml
- name:
shell: mysqladmin status
register: mysql_status
when: False
- name: afficher la sortie de chaque commande
debug:
msg: "{{ item.stdout }}"
loop: "{{ services_status.results }}"
```
* If a task fails or is skipped, **the variable still is registered with a failure or skipped status**
## [<i class="fa fa-book" aria-hidden="true"></i> set_fact](https://docs.ansible.com/ansible/latest/modules/set_fact_module.html)
## register (<i class="fa fa-gift" aria-hidden="true"></i>)
```yaml
criprod:
pvecriprod1:
api_users:
- proxmoxapi
- vimazeno
- name: register foo
shell: echo "foo"
register: txt
```
```yaml
- name: provisionner l'environnement du noeud (pour y accéder plus facilement dans les roles)
set_fact:
_pve: "{ 'cluster': '{{ lookup('env','PVE_CLUSTER') }}', 'node': '{{ lookup('env','PVE_NODE') }}', 'host': '{{ lookup('env','PVE_HOST') }}'}"
- name: provisionner les utilisateurs d'api pve uniquement du noeud (pour y accéder plus facilement dans les roles)
set_fact:
api_users: "{ 'api_users': {{ hostvars[inventory_hostname][_pve.cluster][_pve.node]['api_users'] }}}"
- name: fusionner l'environnement du noeud (pour y accéder plus facilement dans les roles)
set_fact:
pve: "{{ _pve | combine(api_users) }}"
- name: register bar
shell: echo "bar"
register: txt
when: False
```
[<i class="fa fa-gitlab" aria-hidden="true"></i> réorganiser les variables dans une pre_task](https://gitlab.isima.fr/cri/stack/blob/master/ansible/pre-tasks/set-pve-vars.yml)
If a task fails or is skipped, **the variable still is registered with a failure or skipped status**
## modules
......@@ -610,52 +609,43 @@ criprod:
* [<i class="fa fa-book" aria-hidden="true"></i> ...](https://docs.ansible.com/ansible/latest/modules/modules_by_category.html)
## tags
tags au niveau tâches
```yaml
- name: s'assurer que le fichier user.cfg existe
file:
dest: /etc/pve/user.cfg
state: touch
tags: [pve-users]
```
tags au niveau roles à l'inclusion dans le playbook
## handlers
```yaml
roles:
handlers:
- name: restart apache
service:
name: apache2
state: restarted
listen: "restart apache"
- role: debug
tags: debug
tasks:
- name: enable some apache modules
apache2_module:
state: present
name: "{{ item }}"
notify: restart apache
```
`always` tag spécial exécuté à tous les coups
## pre / post tasks
## playbook
```yaml
pre_tasks:
- name: update sources
apt:
update_cache: yes
tags: [base]
```shell
$ ansible-playbook my-playbook.yml --list-tags
```
...
liste tous les tags disponibles dans le playbook
post_tasks:
```shell
$ ansible-playbook my-playbook.yml --tags debug
...
```
n'exécute que les tâches du playbook ayant un tag `debug`
```shell
$ ansible-playbook my-playbook.yml --skip-tags debug
```
exécute toutes les tâches du playbook sauf celles ayant un tag `debug`
## playbook
## dry run
```shell
$ ansible-playbook my-playbook.yml --check --diff
......@@ -670,7 +660,7 @@ simule les tâches à effectuer sans les effectuer (dry-run)
indique ce qui change
## playbook
## verbosity
```shell
$ ansible-playbook my-playbook.yml -vvv
......@@ -681,7 +671,7 @@ $ ansible-playbook my-playbook.yml -vvv
pour la verbosité
## playbook
## limit
```shell
$ ansible-playbook my-playbook.yml --limit=py.isima.fr
......@@ -689,6 +679,10 @@ $ ansible-playbook my-playbook.yml --limit=py.isima.fr
exécute toutes les tâches du playbook sur py.isima.fr uniquement
<i class="fa fa-hand-o-down" aria-hidden="true"></i>
[<i class="fa fa-book" aria-hidden="true"></i> ansible-playbook](https://docs.ansible.com/ansible/latest/ansible-playbook.html)
## roles
......@@ -711,29 +705,52 @@ exécute toutes les tâches du playbook sur py.isima.fr uniquement
```
## layout
[<i class="fa fa-book" aria-hidden="true"></i> Directory Layout](https://docs.ansible.com/ansible/latest/user_guide/playbooks_best_practices.html#directory-layout)
[<i class="fa fa-book" aria-hidden="true"></i> Alternative Directory Layout](https://docs.ansible.com/ansible/latest/user_guide/playbooks_best_practices.html#alternative-directory-layout)
[<i class="fa fa-gitlab" aria-hidden="true"></i> cri/ansible-role-boilerplate](https://gitlab.isima.fr/cri/ansible-role-boilerplate)
## roles
[<i class="fa fa-book" aria-hidden="true"></i> debops](https://docs.debops.org/en/master/)
* [<i class="fa fa-gitlab" aria-hidden="true"></i> cri/ansible-role-vault](https://gitlab.isima.fr/cri/ansible-role-vault)
* [<i class="fa fa-gitlab" aria-hidden="true"></i> cri/ansible-role-gitlab](https://gitlab.isima.fr/cri/ansible-role-gitlab)
* [<i class="fa fa-gitlab" aria-hidden="true"></i> cri/ansible-role-ispconfig](https://gitlab.isima.fr/cri/ansible-role-ispconfig/)
* [<i class="fa fa-book" aria-hidden="true"></i> debops](https://docs.debops.org/en/master/)
* [<i class="fa fa-github" aria-hidden="true"></i> bau-sec/ansible-openvpn-hardened](https://github.com/bau-sec/ansible-openvpn-hardened)
* [<i class="fa fa-github" aria-hidden="true"></i> ...](https://github.com/)
### skeleton
```shell
$ git clone git@gitlab.isima.fr:cri/ansible-role-boilerplate.git
$ ansible-galaxy init --role-skeleton ansible-role-boilerplate gitlab
```
ansible-galaxy init --role-skeleton /path/to/stack/ansible/roles/skeletons/role-with-vagrant gitlab
```
[<i class="fa fa-gitlab" aria-hidden="true"></i>ansible/roles/skeletons/role-with-vagrant](https://gitlab.isima.fr/cri/stack/tree/master/ansible/roles/skeletons/role-with-vagrant)
* dev
## remote roles
```shell
$ ./bin/setup
$ source ./.venv/bin/activate
$ vagrant up
```
* utilisation dans un playbook
`requirements.yml`
```yaml
- name: vault-server
src: git+ssh://git@gitlab.isima.fr/cri/ansible-playbook-vault.git
path: ./ansible/roles/remotes
- name: vault
src: git+ssh://git@gitlab.isima.fr/cri/ansible-role-vault.git
path: ./roles/remotes
```
```
......@@ -741,6 +758,74 @@ $ ansible-galaxy install -f -r requirements.yml
```
## tags
tags au niveau tâches
```yaml
- name: MySQL to listen on all interfaces, not just localhost
lineinfile:
dest: /etc/mysql/mariadb.conf.d/50-server.cnf
regexp: "^bind-address = 127.0.0.1"
line: "#bind-address = 127.0.0.1"
tags: [database]
```
tags au niveau roles à l'inclusion dans le playbook
```yaml
roles:
- role: debug
tags: debug
```
`always` tag spécial exécuté à tous les coups
## tags
```shell
$ ansible-playbook my-playbook.yml --list-tags
```
liste tous les tags disponibles dans le playbook
```shell
$ ansible-playbook my-playbook.yml --tags debug
```
n'exécute que les tâches du playbook ayant un tag `debug`
```shell
$ ansible-playbook my-playbook.yml --skip-tags debug
```
exécute toutes les tâches du playbook sauf celles ayant un tag `debug`
## [<i class="fa fa-book" aria-hidden="true"></i> callback](https://docs.ansible.com/ansible/latest/plugins/callback.html)
```shell
[20:59:19] Install unixODBC | default | CHANGED | 2162ms
[20:59:21] Install Vlogger, Webalizer, and AWstats | default | SUCCESS | 6727ms
[20:59:28] comment awstas croned jobs | default | CHANGED | 1410ms
[20:59:30] Debconf for roundcube-core | default | CHANGED | 1510ms
[20:59:31] Install roundcube and dependencies | default | SUCCESS | 10607ms
[20:59:42] remove the # in front of the first 2 alias line | default | CHANGED | 452ms
[20:59:42] add the line "AddType application/x-httpd-php .php" right after the "<Directory /var/lib/roundcube>" line | default | SUCCESS | 558ms
[20:59:43] change the default host to localhost | default | CHANGED | 587ms
[20:59:44] Install Vlogger, Webalizer, and AWstats | default | SUCCESS | 10966ms
[20:59:55] download jailkit | default | SUCCESS | 862ms
[20:59:55] untar jailkit | default | CHANGED | 1119ms
[20:59:57] untar jailkit | default | CHANGED | 176ms
[20:59:57] build jailkit deb | default | CHANGED | 2655ms
[20:59:59] Install jailkit .deb package | default | CHANGED | 2067ms
[21:00:02] remove jailkit stufff | default | CHANGED | 177ms
[21:00:02] install fail2ban | default | SUCCESS | 1584ms
```
## ansible.cfg
```ini
......@@ -760,8 +845,32 @@ become_user: root
become_method: sudo
```
[<i class="fa fa-book" aria-hidden="true"></i> callback](https://docs.ansible.com/ansible/latest/plugins/callback.html)
## [<i class="fa fa-book" aria-hidden="true"></i> set_fact](https://docs.ansible.com/ansible/latest/modules/set_fact_module.html) & pre_tasks
```yaml
criprod:
pvecriprod1:
api_users:
- proxmoxapi
- vimazeno
```
```yaml
- name: provisionner l'environnement du noeud (pour y accéder plus facilement dans les roles)
set_fact:
_pve: "{ 'cluster': '{{ lookup('env','PVE_CLUSTER') }}', 'node': '{{ lookup('env','PVE_NODE') }}', 'host': '{{ lookup('env','PVE_HOST') }}'}"
- name: provisionner les utilisateurs d'api pve uniquement du noeud (pour y accéder plus facilement dans les roles)
set_fact:
api_users: "{ 'api_users': {{ hostvars[inventory_hostname][_pve.cluster][_pve.node]['api_users'] }}}"
- name: fusionner l'environnement du noeud (pour y accéder plus facilement dans les roles)
set_fact:
pve: "{{ _pve | combine(api_users) }}"
```
[<i class="fa fa-gitlab" aria-hidden="true"></i> réorganiser les variables dans une pre_task](https://gitlab.isima.fr/cri/stack/blob/master/ansible/pre-tasks/set-pve-vars.yml)
## extend
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment