Sunday, December 1, 2019

Ansible Cheat Sheet

Ansible Cheat Sheet


SSH Setup


Copy your Ansible Master's public key to the managed node
ssh-keygen  ## generate public key
ssh-copy-id  # copy key, provide password to node

configure Hosts file
/etc/ansible/hosts
[production]
prod1.prod.local
prod2.prod.local

[dev]
devweb1.dev.local
devweb2.dev.local


REMOTE CMD (Ad Hoc)


Ping specific node
ansible -i hosts nycweb01.prod.local -m ping

Ping with wildcard
ansible -i hosts "nycweb*" -m ping

Ping all nodes with SSH user 'root'
ansible -i hosts all -m ping -u root

run a command
ansible -i hosts dev -a 'uname -a'

check Yum packages
ansible -i hosts dev -m yum 

check if Docker rpm is installed
ansible -i hosts web01.nyc.local -m shell -a "rpm -qa | grep docker"

Get facts about a box
ansible -i hosts web01.nyc.local -m setup -a 'filter=facter_*'

run command with sudo
ansible -i hosts target-host -m shell -a "cat /etc/sudoers" --sudo 

limit command to a certain group or server: add --limit *.nyc






SERVER DIAGNOSTICS


Test Connection
ansible -i hosts all -m ping -u root


Diagnostics



manage nodes via "/etc/ansible/hosts" file

Debug (debug output for playbook)
- debug: var=result verbosity=2  



PACKAGES AND INSTALLATION


install multiple packages
yum: name="{{ item }}" state=present
with_items:
  - http 
  - htop
  - myapp




JOBS AND PROCESS CONTROL

run Ansible ad hoc with 10 parallel forks
ansible -i hosts testnode1 -a "uname -a" -f 10

show human readable output
add this line to ansible.cfg
stdout_callback=yaml




CONDITIONALS

y file to n




VARIABLES


include global variables for all Roles

sample playbook
splunk/
   setup_splunk_playbook.yaml
   roles/base
           /tasks/main.yaml
           /tasks/install.yaml
         search_head
           /tasks/configure.yaml
         indexer
           /tasks/configure.yaml
         some_other_role
           /tasks/some_task.yaml
   hosts
   config.yaml
Place your vars into config.yaml
cat splunk/config.yaml
--- 
# global Splunk variables
splunk_version: 7.0.0
in your playbook, include the Roles
cat setup_splunk_playbook.yaml
- hosts: "search_heads"  
  become_user: root
  become: true
  gather_facts: true

  roles:
    - base
    - search_head
in your Role, include the Global Vars inside a Task
cat roles/base/tasks/main.yaml
---
# install Splunk Base

- name: include vars
  include_vars: "{{ playbook_dir }}/config.yaml"

- include: install.yaml
vars are accessible in tasks now,
cat roles/base/tasks/install.yaml
- name: echo version
  debug: splunk version is {{ splunk_version }}

Loop through a Dict variable inside a playbook

cluster:
  members:
    splunk01: 10.123.1.0
    splunk02: 10.123.1.1
    splunk03: 10.123.1.2

in the playbook,
- debug: msg="{{ cluster.members.values() | map('regex_replace', '(.*)', 'https://\\1:8089') | join(',') }}"

>> https://10.123,1.0:8089, https://10.123.1.1:8089, etc etc


Use Inventory file variables inside a playbook

cat hosts
[apache]
nycweb01

playbook
debug: msg="IP: {{ hostvars[groups['apache'][0]]['ansible_default_ipv4']['address'] }}"
debug: msg="Hostname: {{ hostvars[groups['apache'][0]]['inventory_hostname'] }}"


register a List/Array to be used for later,
- name: parse all hostnames in group WebServer  and get their IPs, place them in a list
  command: echo {{ hostvars[item]['ansible_ssh_host'] }}"
  with_items: "{{ groups['webserver'] }}"
  register: ip_list

- name: show the IPs
  debug: msg={{ ip_list.results | map(attribute='item') | list }}"


export an Environment variable
- name: yum install
  yum: name=somepkg state=present
  environment: 
    SOME_VAR: abc


Variables inside Inventory Hosts file

cat hosts
[web]
nycweb01.company.local
[web:vars]
role="super duper web server"

now get the "role" variable inside the playbook,
- hosts: web
  gather_facts: true
  tasks:
    - name: print Role var
      debug: msg={{ role }}

// super duper web server
 



MODULES

service: name=httpd state=[started, stopped, restarted, reloaded] enabled=[yes,no]
user: name=joe state=[present,absent] uid=1001 groups=wheel shell=/bin/bash
group: name=splunk gid=6600 state=[present,absent] system=[yes/no]
yum: name=apache state=[present, latest, absent, removed]  
file: path=/etc/file state=[file, link, directory, hard, touch, absent] group=x owner=x recurse=yes





GALAXY


install Role (Module)
ansible-galaxy install geerlingguy.nginx




PLAYBOOKS

run playbook with sudo
ansible-playbook -v config-users.yaml --sudo --sudo-user=joe --ask-sudo-pass


use different Hosts file
ansible-playbook -v -i /path/to/hosts


run playbook but only a specific task (tag)
ansible-playbook playbooks/restore_bitbucket.yaml -i hosts --tags rsync

or to skip: (--skip-tags tag1, tag2)


store output of a command as a variable
shell: cat /etc/network | grep eth0
register: address
debug: msg="address is {{ address.stdout }}"


configure multiple items with one task

- name: more complex items to add several users
  user:
    name: "{{ item.name }}"
    uid: "{{ item.uid }}"
    groups: "{{ item.groups }}"
    state: present
  with_items:
     - { name: testuser1, uid: 1002, groups: "wheel, staff" }
     - { name: testuser2, uid: 1003, groups: staff }

get path location of current Playbook (pwd)
{{ playbook_dir }}


Set playbook to be verbose by default
- hosts: blah
  strategy: debug
run playbook with verbose traceback
ansible-playbook -i hosts myPlaybook.yaml -vvv

run playbook on multiple Host groups
- hosts: "search_head, deployer"

Run playbook locally on host

hosts: 127.0.0.1
connection: local


Prompt for password during Playbook run

# Playbook to change user password

- name: pw change
  hosts: target
  become: true
  become_user: root
  vars_prompt:
    - name: username
      prompt: "enter username for which to change the pw"
    - name: password
      prompt: "enter new password"
      private: yes
 
  tasks:
    - name: change pw
      user: "name={{ username }} password={{ password }} update_password=always"
 


run playbook with "dry run" / NOOP / simulate
ansible-playbook foo.yml --check

Run task on different target,
- name: run something on some other server
  debug: msg="running stuff"
  delegate_to: someserver

Delegate task to a host group
- name: restart web servers
  service: name=memcached state=restarted
  delegate_to: "{{ item }}"
  with_items: "{{ groups['webservers'] }}"

Get IP or facter of a remote host
- name: get IP
  debug: msg="{{ hostvars['nycweb01']['ansible_default_ipv4']['address'] }}"

or

debug: msg="{{ hostvars[item]['ansible_ssh_host'] }}"
with_items: "{{ groups['webservers'] }}"

synchronize file (copy file from Ansible host to target)
  - synchronize: 
     src: "{{ playbook_dir }}/files/vscode.repo"
     dest: /etc/yum.repos.d/ 

synchronize from server A to server B with a wildcard
    - name: copy Splunk Apps
      synchronize:
        src: "/opt/splunk/etc/apps/{{ item }}" (server A)
        dest: "/opt/splunk/etc/shcluster/apps/"  (server B)
      with_items:        - item1        - item2
      delegate_to: server A

wget a file to a location
  - get_url:
      url: 'https://dl.google.com/go/go1.10.linux-amd64.tar.gz' 
      dest: '/tmp'
      force: no  # dont download if file already exists

untar tar.gz


USER AND GROUP MGMT


change user password for user Joe (user Fred running the cmd as sudo on the target box)

# 1 install passlib 
pip install passlib

#2 update the pw, using a hash
ansible targethost -s -m user -a "name=joe update_password=always password={{ 'MyNewPassword' | password_hash('sha512') }}" -u fred --ask-sudo-pass

copy public ssh key to remote authorized_keys file
- hosts: targetHost
  tasks:
      - name: update nessus SSH keys
        become_user: root
        become_method: sudo
        become: true
        authorized_key:
           user: nessus
           key: "{{ lookup('pipe','cat ../files/ssh_keys/nessus.pub') }}"
           state: present




FILES & DIRS

delete all files and hidden files in a directory
vars:
  app_home: /var/opt/application

tasks:
  - name: clear home dir

  - shell: "ls -la {{ app_home }}/"
    register: files_to_delete
  - file: path="{{ app_home }}/{{ item }}" state=absent
    with_items: "{{ files_to_delete.stdout_lines }}"

get files from node
ansible node1 -s -m fetch -a "src=/etc/hosts dest=/tmp"

copy file to node
ansible node1 -m copy -a "src=/etc/hosts  dest=/tmp/hosts"

remove all files matching a wildcard
file: path={{ item }} state=absent
with_fileglob: /tmp/*.rpm



FACTER

get all facts from a node (ad hoc)
ansible -i hosts targetName -m setup -a "filter="facter_*"

use fact in a playbook
include fact as {{ ansible_factname }}

add fact to Hosts file
[group]
host1 admin_user=jane
host2 admin_user=jack
host3 

[group:vars]
admin_user=john

get default IPV4 address
ansible_default_ipv4.address

Local facts

place .fact file into /etc/ansible/facts.d on target node
vim /etc/ansible/facts.d/fruits.fact

[fruits]
sweet=banana, apple, grapes
bitter=grapefruit

get Local facts
ansible -i hosts mrx -m setup -a "filter=ansible_local"