Ansible new paradigms for orchestration

1. Ansible new paradigms for orchestration Paolo Tonin Sysadmin@Ideato pt@ideato.it

2. A quick poll ! -Chef -Puppet -Idephix -Saltstack -Fabric -All handmade -Mess of shell scripts

3. What this is NOT A detailed guide to Ansible A training course on Ansible

4. What this IS Some reason why you might consider Ansible Use case that works for mine usecase, MAYBE for you

5. Why

6. Ideato scenario Focus on great software development and good practices

7. In the beginning, there were sysadmins

8. and DevOps?!?

9. Ops: "Do you need $component in production?" Dev: "..."

11. Modern infrastructure management

13. You use YAML Infrastructure is not code

14. YAML vs RubyDSL user{"$user": managehome=>true, ensure => present, } file{"/home/$user": ensure=>directory, mode=>700, require=>User["$user"], } file{"/home/$user/.ssh": ensure=>directory, require=>File["/home/$user"], }

15. YAML vs RubyDSL - name: setup user user: name=paolo shell=/bin/bash password={{ password }}

16. Ansible is… (1) Pro Conﬁguration management Application deployment (could be) Cloud provisioning Ad-hoc task-execution

17. Go Agentless!

18. Ansible is… (2) Pro Needs only SSH, agentless! NO extra programming language Idempotent Low learning curve

19. Ansible is… Pro control machine - Inventory - Playbooks SSH Channels

20. Installation Pro On Mac OSX is a piece of cake Debian/Ubuntu $ brew update $ brew install ansible $ sudo apt-add-repository -y ppa:ansible/ansible $ sudo apt-get update $ sudo apt-get -y install ansible "Windows is not ofﬁcial supported as controller machine"

21. Installation •Servers should be accessible via SSH using keypair authentication •It's reccomended to have a user with sudo permission to run the tasks in the server How to conﬁgure SSH access for running Ansible bit.ly/ansible-ssh

22. Inventories Modules Ad-hoc commands Playbooks Ansible basics

23. Ansible basics Inventories

25. - Host list, logical groups - AWS, Openstack API, Azure

26. Inventory [webservers] 173.194.113.19 web1.mydomain.com [mongo_master] mongo_mm.local [mongo_slave] mongo1.local “/etc/ansible/hosts”

27. Inventory [webservers] 173.194.113.19 web1.mydomain.com [mongo_master] mongo_mm.local [mongo_slave] mongo1.local “/etc/ansible/hosts” Groups

28. Ansible basics Ad-hoc commands (conducting an orchestra)

29. Ad-hoc commands $ ansible web1 -a “free -m” $ ansible webservers -a “php -v” $ ansible all -a “sudo yum -y update”

30. Ad-hoc commands 173.194.113.19 | success >> { “changed”: false, “ping”: “pong” } web1.mydomain.com | success >> { “changed”: false, “ping”: “pong” } $ ansible -all -m ping mongo_mm.local | success >> { “changed”: false, “ping”: “pong” } mongo1.local | success >> { “changed”: false, “ping”: “pong” }

31. Ad-hoc commands 173.194.113.19 | success | rc=0 >> PHP 5.6.13 (cli) (built: Sep 3 2015 14:08:58) Copyright (c) 1997-2015 The PHP Group Zend Engine v2.6.0, Copyright (c) 1998-2015 Zend Technologies with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2015, by Zend Technologies web1.mydomain.com | success | rc=0 >> PHP 5.6.13 (cli) (built: Sep 3 2015 14:08:58) Copyright (c) 1997-2015 The PHP Group Zend Engine v2.6.0, Copyright (c) 1998-2015 Zend Technologies with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2015, by Zend Technologies $ ansible webservers -a “php -v”

32. Ansible basics Modules

33. Modules All standard modules are part of core, no abandoned modules All core modules are written in Python You can write custom modules in any language (eg. helper code in Ruby)

34. Modules $ ansible all -s -m shell -a 'apt-get install nginx' $ ansible all -s -m shell -a 'service mysqld restart'

35. Modules Batteries Included !! 200+ Ansible Modules

36. Modules •Run arbitrary commands •Copy files to and from servers •Install packages •Manage daemons •Manage user and groups •Gather facts

37. Modules http://docs.ansible.com/ansible/ modules_by_category.html $ ansible-doc -l Main documentation

38. Ansible basics Tasks

39. Tasks is a declaration about the state of a system Tasks Ansible basics

40. Tasks - name: install memcached yum: name=memcached state present - name: create database user mysql_user: name=bob.priv password=yaiShie8 priv=*.*:app_db state=present - name: Update apt apt: update_cache=yes

41. Tasks - name: install memcached yum: name=memcached state present - name: create database user mysql_user: name=bob.priv password=My_Passwd priv=*.*:app_db state=present - name: Update apt apt: update_cache=yes

42. Interesting but...

43. Where is automation?

44. Ansible basics Playbooks

45. Playbooks Plays are ordered set of tasks Written in YAML, declarative, no coding required Executed in the order it is written

46. BEFORE

47. #!/bin/bash if ! rpm -qa | grep -qw ntp; then yum install ntp fi if ps aux | grep -v grep | grep “[n]ntpd” > /dev/null then echo “ntpd is running” > /dev/null else /sbin/service ntpd restart > /dev/null echo “Started ntpd” fi chkconfig ntpd on Ansible basics

48. LET’S CONVERT OLDER BASH INTO ANSIBLE PLAYBOOK !!!

49. A Simple Playbook --- - hosts: all sudo: yes tasks: - yum: name=ntp state=installed - service: name=ntpd state=started enabled=yes # playbook.yml Deﬁnes hosts or Groups

51. IDEMPOTENCY

52. A Simple Playbook --- - hosts: all sudo: yes tasks: - yum: name=ntp state=installed - service: name=ntpd state=started enabled=yes # playbook.yml

53. A Simple Playbook --- - hosts: all sudo: yes tasks: - yum: name=ntp state=installed - service: name=ntpd state=started enabled=yes # playbook.yml

54. Ansible basics Another playbook…

55. A Simple Playbook --- - hosts: all sudo: yes tasks: - name: Update apt-cache - apt: update_cache=yes - name: Install Nginx - apt: pkg=nginx state=latest # playbook.yml

56. Ansible basics Templates

57. Templates Autogenerating configurations Jinja2 Python template engine (similar to Twig for PHP) It can be anything (like config files, system settings etc..)

58. Templates <Virtualhost *:80> ServerName {{ domain }} ServerAlias www.{{ domain }} DocumentRoot {{ doc_root }} <Directory {{ doc_root }}> AllowOverride AuthConfig Require all granted </Directory> </Virtualhost> # templates/vhost.conf.j2

59. Templates Let's build a playbook !

60. -- - hosts: web1 sudo:yes vars: domain: readyfortraffic.com doc_root: /var/www/readyfortraffic.com/ tasks: - name: Add a new virtualhost template: src=templates/vhost.conf.j2 dest=/etc/httpd/conf.d/{{ domain }}.conf notify: restart httpd - name: Add a welcome page template: src=templates/index.html dest={{ doc_root }}/index.html backup=yes handlers: - name: restart httpd service: name=httpd state=restarted

61. Ansible basics Conditions & Loops

62. Conditions & Loops - name: Install PHP packages apt: name={{ item }} state=latest with_items: - php5-fpm - php5-cli - php5-mysql - php5-pdo - php5-mcrypt - php5-curl - php5-memcache when: ansible_distribution == 'Ubuntu'

63. Conditions & Loops - name: Install PHP packages apt: name={{ item }} state=latest with_items: - php5-fpm - php5-cli - php5-mysql - php5-pdo - php5-mcrypt - php5-curl - php5-memcache when: ansible_distribution == 'Ubuntu'

64. Sample use cases Shellshock

65. - hosts: all gather_facts: yes remote_user: updater sudo: yes tasks: - name: Update Shellshock (Debian) apt: name=bash state=latest update_cache=yes when: ansible_os_family == "Debian" - name: Update Shellshock (RedHat) yum: name=bash state=latest update_cache=yes when: ansible_os_family == "RedHat"

66. Sample use cases Heartbleed

67. - hosts: all gather_facts: yes remote_user: updater sudo: yes tasks: - name: Update OpenSSL (Debian) apt: name={{ item }} state=latest update_cache=yes with_items: - openssl when: ansible_os_family == "Debian" - name: Update OpenSSL (RedHat) yum: name={{ item }} state=latest update_cache=yes with_items: - openssl when: ansible_os_family == "RedHat" post_tasks: - name: Reboot servers command: reboot

68. Sample use cases Let's reboot all servers ansible all -a "reboot"

69. Ansible basics Cloud Providers Support for most major Cloud providers; AWS, Rackspace, Azure, DigitalOcean etc.. Provision, configure networking, storage, manage security etc...

70. Ansible for AWS Install python module on execution host $ yum install python-boto awscli Add localhost to inventory [local] localhost Pattern used in playbooks for provisioning - hosts: localhost connection: local gather_facts: false $ pip install python-boto

71. Ansible for AWS--- - hosts: locahost connection: local tasks: - name: create ec2 instance with volume that already exists action: module: ec2 zone: eu-central-1a image: ami-a1b2c3d4 instance_type: t2.medium state: present region: eu-central vpc_subnet_id: subnet-abcd1234 group: sg-ssss9999 volumes: - device_name: /dev/sda1 device_type: gp2 volume_size: 20 delete_on_termination: true

72. Ansible basics NOT ONLY for servers

73. Even for network devices!

74. Extra resources http://galaxy.ansible.com

75. What we didn't talk... -Variables -Roles (many Playbooks) -Ansible-vault -Ansible Tower

76. Putting all together

77. Putting all together Build a environment with Vagrant for Dev

79. Putting all together

80. Links https://github.com/ideatosrl/vagrant-php-template https://github.com/ideatosrl/vagrun https://www.ideato.it/technical-articles/vagrant-conﬁguration- automatizzare-si-puo http://docs.ansible.com/ansible/modules_by_category.html https://servercheck.in/blog/ansible-101-cluster-raspberry-pi-2s

82. Questions?!?

Ansible new paradigms for orchestration

Ansible new paradigms for orchestration

Recomendados

Más contenido relacionado

Was ist angesagt?

Was ist angesagt?(20)

Similar a Ansible new paradigms for orchestration

Similar a Ansible new paradigms for orchestration(20)

Último

Último(15)

Ansible new paradigms for orchestration