Worst Practice Lab VM Automation
I've started the process of switching my lab over from unmanaged to ansible. I've used Puppet and Salt quite extensively through work, but after a handful of false starts with the lab, I think ansible is the way to go.g his is a series of what
many (including myself) would consider "worst practices", but are more along the lines of "rapid iteration". The goal here
is to get something working in a short period of time, without spending hours, days, or weeks researching best practices.
This is instead something someone can put together on a Sunday afternoon, in between chasing after a 3 year old.
These are a handful of manual steps, each of which could be easily automated once you determine your "starting point".
Background: When I clone a VM in proxmox, it comes up with the hostname "xenial-template". I should be able to do something like I do with cloud-init under kvm, but I haven't gotten that far under the proxmox setup. Additionally, these hosts are not in dns until they are entered into the freeipa server. Joining a client to IPA will automatically create the entry. So the first thing I need to do to any VM is to set the hostname, fqdn, and then register it with IPA. My template
has a user called "yourtech", which I can use to login and configure the VM.
First, create an ansible vault password file: echo secret> ~/.vault_pass.txt. Next, create an and inventory directory and setup an encrypted group_vars/all.
mkdir -p inventory/group_vars
touch inventory/group_vars/all
Add some common variables to all:
---
ansible_ssh_user: yourtech
ansible_ssh_pass: secret
ansible_sudo_pass: secret
freeipaclient_server: dc01.lab.ytnoc.net
freeipaclient_domain: lab.ytnoc.net
freeipaclient_enroll_user: admin
freeipaclient_enroll_pass: supersecret
Then encrypt it: ansible-vault --vault-password-file=~/.vault_pass.txt encrypt inventory/group_vars/all
Generate inventory files.
With the following script, I can run ./add-new.sh example 192.168.0.121. If ansible failes, then I need to
troubleshoot. A better approach would be to add these entries into a singular inventory file, or better yet,
a database, providing a constantly updated and dynamic inventory. Put that on the later pile.
#!/usr/bin/env bash
NEWNAME=$1
IP=$2
DOMAIN=lab.ytnoc.net
FQDN="${NEWNAME}.${DOMAIN}"
ANSIBLE_VAULT_PASSFILE=~/.vault_pass.txt
BASEDIR=~/projects/ytlab/inventory
FILENAME="${BASEDIR}/${NEWNAME}"
LINE="${FQDN} ansible_host=${IP}"
export ANSIBLE_HOST_KEY_CHECKING=False
echo ${LINE} > ${FILENAME}
echo "Removing any prior host keys"
ssh-keygen -R ${NEWNAME}
ssh-keygen -R ${FQDN}
ssh-keygen -R ${IP}
echo "${FILENAME} created, testing"
ansible --vault-password-file ${ANSIBLE_VAULT_PASSFILE} -i ${FILENAME} ${FQDN} -m ping -vvvv
Let's go to work.
At this point, I should have a working inventory file for a single host and I've validated that ansible can
connect. Granted, I haven't tested sudo, but in my situation, I'm pretty sure that will work. But I haven't
actually done anything with the VM. It's still just this default template.
FQDN
Ansible provides a module to set the hostname, but does not modify /etc/hosts to get the FQDN resolving. As with
many things, I'm not the first to encounter this, so I found a premade role holms/ansible-fqdn.
mkdir roles
cd roles
git clone https://github.com/holms/ansible-fqdn.git fqdn
This role will read inventory_hostname for fqdn, and inventory_hostname_short for hostname. You can override
this, but these are perfect defaults based on my script above.
FreeIPA
Once again, we're saved by the Internet. alvaroaleman/ansible-freeipa-client is an already designed role that installs the necessary freeipa packages and runs the
ipa-join commands.
# assuming still in roles
git clone https://github.com/alvaroaleman/ansible-freeipa-client.git freeipa
The values this module needs just happens to perfectly match the freeipa_* variables I put in my all file earlier. I
think that's just amazing luck.
Make a playbook.
I call mine bootstrap.yml.
---
- hosts: all
become: yes
roles:
- fqdn
- freeipa
Execute
Let's run our playbook against host "pgdb02"
ansible-playbook -i inventory/pgdb02 --vault-password-file=~/.vault_pass.txt bootstrap.yml
Output:
ytjohn@corp5510l:~/projects/ytlab$ ansible-playbook -i inventory/pgdb02 --vault-password-file=~/.vault_pass.txt base.yml
PLAY ***************************************************************************
TASK [setup] *******************************************************************
ok: [pgdb02.lab.ytnoc.net]
TASK [fqdn : fqdn | Configure Debian] ******************************************
TASK [fqdn : fqdn | Configure Redhat] ******************************************
skipping: [pgdb02.lab.ytnoc.net]
TASK [fqdn : fqdn | Configure Linux] *******************************************
included: /home/ytjohn/projects/ytlab/roles/fqdn/tasks/linux.yml for pgdb02.lab.ytnoc.net
TASK [fqdn : Set Hostname with hostname command] *******************************
changed: [pgdb02.lab.ytnoc.net]
TASK [fqdn : Re-gather facts] **************************************************
ok: [pgdb02.lab.ytnoc.net]
TASK [fqdn : Build hosts file (backups will be made)] **************************
changed: [pgdb02.lab.ytnoc.net]
TASK [fqdn : restart hostname] *************************************************
ok: [pgdb02.lab.ytnoc.net]
TASK [fqdn : fqdn | Configure Windows] *****************************************
skipping: [pgdb02.lab.ytnoc.net]
TASK [freeipa : Assert supported distribution] *********************************
ok: [pgdb02.lab.ytnoc.net]
TASK [freeipa : Assert required variables] *************************************
ok: [pgdb02.lab.ytnoc.net]
TASK [freeipa : Import variables] **********************************************
ok: [pgdb02.lab.ytnoc.net]
TASK [freeipa : Set DNS server] ************************************************
skipping: [pgdb02.lab.ytnoc.net]
TASK [freeipa : Update apt cache] **********************************************
ok: [pgdb02.lab.ytnoc.net]
TASK [freeipa : Install required packages] *************************************
changed: [pgdb02.lab.ytnoc.net] => (item=[u'freeipa-client', u'dnsutils'])
TASK [freeipa : Check if host is enrolled] *************************************
ok: [pgdb02.lab.ytnoc.net]
TASK [freeipa : Enroll host in domain] *****************************************
changed: [pgdb02.lab.ytnoc.net]
TASK [freeipa : Include Ubuntu specific tasks] *********************************
included: /home/ytjohn/projects/ytlab/roles/freeipa/tasks/ubuntu.yml for pgdb02.lab.ytnoc.net
TASK [freeipa : Enable mkhomedir] **********************************************
changed: [pgdb02.lab.ytnoc.net]
TASK [freeipa : Enable sssd sudo functionality] ********************************
changed: [pgdb02.lab.ytnoc.net]
RUNNING HANDLER [freeipa : restart sssd] ***************************************
changed: [pgdb02.lab.ytnoc.net]
RUNNING HANDLER [freeipa : restart ssh] ****************************************
changed: [pgdb02.lab.ytnoc.net]
PLAY RECAP *********************************************************************
pgdb02.lab.ytnoc.net : ok=18 changed=8 unreachable=0 failed=0
Recap
Essentially, we created a rather basic inventory generator script, we encrypted some
credentials into a variables file using ansible-vault, and we downloaded some roles
"off the shelf" and executed them both with a single "bootstrap" playbook.
If I was doing this for work, I would first create at least one Vagrant VM and work through
an entire development cycle. I would probably rewrite these roles I downloaded to make them
more flexible and variable driven.
In case you got lost where these files go:
.
├── add-new.sh
├── bootstrap.yml
├── inventory
│ ├── group_vars
│ │ ├── all
│ ├── pgdb01
│ ├── pgdb02
│ └── sstorm01
└── roles
├── fqdn
└── freeipa