Hot answers tagged

31

I never used Ansible but since a few weeks, I try to figure out what good Ansible could be in comparison with shell scrips–Which proves, at least in my case, that the haunting ad-campaigns they run are effective! After many unsuccessful attempts–which proves how their documentation fail at answering one of the most obvious question–I think I finally got it. ...


28

This is typically done by setting the following value in ansible.cfg: [defaults] host_key_checking = False If you don't want to modify ansible.cfg you can set an environment variable like so: export ANSIBLE_HOST_KEY_CHECKING=False Source: http://docs.ansible.com/ansible/intro_getting_started.html#host-key-checking


28

You can use the Ansible wait_for module which checks a specific TCP port is open. Since in this case, all ports should be open already, we can use a minimal no. of retries, just enough to cover network issues: - name: Check all port numbers are accessible from current host wait_for: host: mywebserver.com port: "{{ item }}" state: started ...


22

When you put it this way, even if Ansible has some inherent advantages, the benefits of using familiar tools (in this case shell scripting) must be outweighed. I don't think there's a clear cut answer to that. If the team can achieve the things Ansible offers with shell: Declarative, idempotent configuration management Access to re-usable snippets (i.e. ...


22

In your ansible.cfg file you need to add the following line: ssh_args = -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no You could also add those options in your ~/.ssh/config on every machine from which you run it something like this: Host * StrictHostKeyChecking no UserKnownHostsFile=/dev/null


21

Some options out there.. Testing tools: Sorted by github stars Serverspec - Ruby, most popular tool out there, built on ruby's rspec Goss - YAML, simple, <10MB self-contained binary, extremely fast, can generate tests from system state Inspec - Ruby, think of it as an improved serverspec, almost same syntax, made by the chef guys. Built to be easier to ...


20

There are of course several pro and cons for each of Puppet, Ansible, Chef and add your favorite tool here as well. So I'll try to stay away from opinion, and share what is great in Ansible as a matter of fact. The main capability that puts Ansible above the others is not having to rely on some custom/additional agent running on the target nodes, instead ...


15

You are looking for Dynamic Inventory Please look into ec2.py and ec2.ini of Ansible, and also the Dynamic Inventory docs of Ansible are very good for understanding how to manage your AWS inventory.


15

Your playbook will stop when a failure occurs and you're using serial: 1 according to the documentation. By default, Ansible will continue executing actions as long as there are hosts in the group that have not yet failed. That said there seems to be some confusion in the community over the default behavior, and it seems to have changed--or been buggy--...


15

Make separate tasks file make_site.yml: --- - name: Install apache site conf template: src: apache-sites-{{ site }}-conf.j2 dest: /etc/apache2/sites-available/{{ site }}.conf mode: 0644 - name: Enable site apache conf command: a2ensite {{ site }} args: creates: /etc/apache2/sites-enabled/{{ site }}.conf And in your playbook: - ...


14

The idea is to put all our sensitive data [...] The meaning of "all" in this sentence should be analyzed very carefully before implementing the solution that you plan. Ansible vault is a very useful tool, but it should be used only to store secrets that are: Specifically needed for the ansible deployments Easily made useless to owners that should become ...


13

The two tools I've seen for this are InSpec and ServerSpec. Serverspec is a Ruby-based tool that builds on RSpec. InSpec is inspired by RSpec and ServerSpec. I've used ServerSpec. It's cool, but maybe not 100% stable. I've had problems with testing for specific versions of software on Ubuntu. I've read the InSpec docs but haven't dug in deep. It does ...


13

I've had two runs at doing environment variables in a scalable way and neither has ended up perfect because, as I've discovered, is a very tricky thing to get right. I'll give a summary of both of my experiences below: Common Factors Environment variables are stored in a separate repository from the original source code (they are submoduled together but ...


13

The above answer covers part of it but misses one of the important elements: convergent design. I wrote some words a while ago about this in the context of Chef at https://coderanger.net/thinking/ but the short version is that a bash script is a set of instructions, while an Ansible playbook (or Chef recipe, Salt state, etc) is a description of desired state....


13

Here is the definition: DEFAULT_VAULT_PASSWORD_FILE = get_config(p, DEFAULTS, 'vault_password_file', \ 'ANSIBLE_VAULT_PASSWORD_FILE', None, value_type='path') This means that you either put in ansible.cfg or playbook: vault_password_file: ~/.vault_pass.txt Or in your shell defined this variable: export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt


13

As @webKnja mentioned this is possible with async mode. I have recently discovered it myself and learned that you can use it in 3 different ways depending on your needs. Execute and poll the results, notice the poll:5, This will poll the results every 5 seconds. You may save some time with this method. - name: My long runing task some_module_name: ip:...


11

When using configuration management tools, such as Ansible, the tool itself would be responsible preventing configuration drift. Once you used Ansible to set a certain configuration, repetitive execution of Ansible will ensure your configuration is as you defined it to be. This also requires your Ansible code to be written in a manner which is idempotent. ...


11

I think you're looking for the wait_for module. It will allow you to check and make an action when a certain port is available and more.


10

No, people moving away from Puppet to Ansible (or vice versa) has nothing to do with what can or cannot be accomplished with either tool. Puppet/Chef/Ansible - it's mostly a matter of taste. For example, Ansible is based on Python, and Python developers typically feel more at home with it (no need to learn a DSL), or Ruby (for Chef)). Easier for Python ...


10

In such context the typical advice should be immediately applicable: use the right tool for the job. But then you also cannot ignore nowadays the almost virulent tendency of software tools to extend functionality into more or less related fields and actually become toolsets for various reasons: cool feature(s) to have, expand customer base, amass more ...


10

With the help of @Levi (refered to Stackoverflow) I managed to find a way to connect straigt into the docker containers using ansibles docker connection driver and the remote API capability of Docker. First of all you have to expose the API which is by default not the case. Simply add -H tcp://0.0.0.0:1337 to the ExecStart constant of the systemd script. ...


10

There are options you can pass through apt-get to dpkg that will handle the config choices. We usually do something like: apt-get install -y --no_install_recommends -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' <package_name> When using ansible you can do: apt: pkg: "{{ item }}" only_upgrade: yes ...


8

Until Puppet 4.0 there was no easy way to orchestrate application spread over multiple servers or services, as it was hard to specifically order actions in Puppet, which was a design choice. Ansible was better at orchestrating and ordering the steps, especially across multiple servers. This was especially significant in applications where the wrong order of ...


8

The problem here is caused by the random salt in ansible-vault encryption. You can hack VaultEditor class to pass the salt to it from an argument in ansible-vault. The random salt is generated in lib/ansible/parsing/vault/__init__.py on this line. It is called from lib/ansible/cli/vault.py where you can easily add the argument for fixed salt. If you do ...


8

I'm not sure it's a best practice but what I would do is using filebeat to read the log in near real time and push it to ElasticSearch. AWS provides an ElasticSearch Service which can save you from this part. The drawback of using filebeat directly to elasticsearch is that the time of events will be the time the prospector read them and if your logs have a ...


8

There is no general method and it might depend on how boxcutter/ol67 was packed. The easiest method would be to define the password in the Ansible inventory file: [oracle-vm:vars] ansible_ssh_user=vagrant ansible_ssh_pass=vagrant The second method would be to leave the insecure private key configured on the oracle-vm machine and inject the private key to ...


8

Based on techraf's 3rd suggestion I did the following: vagrant up ansible ssh-keygen (no password just pressed Enter) copied .ssh/id_rsa and .ssh/id_rsa.pub to the project directory vagrant destroy ansible modified the Vagrantfile to copy the id_rsa to all hosts modified the Vagrantfile to copy the id_rsa.pub into authorized_keys on all hosts modified the ...


8

This is a simple thumb rule one could follow Use version control (git, svn, cvs) for the work product created by humans Use artifact management tool (artifactory, nexus, apache archiva) for the software bundle (artifacts) created by the system thru build or packaging process HUMAN ==> System GIT/SVN (build/packaging) ...


8

You can use env lookup plugins. Plugins are always evaluated in the context of "parent" ansible process on the control host. - debug: msg: "{{ lookup('env', 'PWD') }}" More lookup plugins can be found here: http://docs.ansible.com/ansible/latest/user_guide/playbooks_lookups.html


8

Vault password First of all, you should get familiar with the fact that vault password file can be executable script. In this case Ansible executes it and expects to receive password as its output. For example you can use gpg-agent or keychain to store your actual password and unlock it when required. Read more in this blog post: https://benincosa.com/?p=...


Only top voted, non community-wiki answers of a minimum length are eligible