Otter and ansible

[PhilippeC.]

Up
Nobody is using otter on linux ?

[atripp]

We do have a lot of users who configure Linux servers, but their usage doesn't seem much more involved than ensuring packages, files, and directories. You may be ablet o get a lot accomplished with just doing that? I'm not sure... happy to learn and help though!

[PhilippeC.]

Thanks for you reply.
I ll try to make some module to interact with ansible.
Actually I am thinkink just to push playbook and run it thru otter.
Best regards from France and take care.

[atripp]

Thanks!! We'd love to learn more.

By the way, With Otter, we have a general plan to make UPack-based "rafts", and allow users to dowload them from a feed. This way, we can make a community feed of rafts. Easier to build and work-with than extensions, I think.

[philippe.camelio_3885]

This post is deleted!

[PhilippeC.]

That would be great.
There is a lack of experience sharing between users.

[PhilippeC.]

Finally I just make a generic function which run ansible playbook on the target server.
The function get as input variable

• The path where the playbook is located
• The name of the asset file - the playbook
• Variables if need - they are replace in the playbook after it is pushed to the server using Ensure-Asset.
  In this way I let otter to manage mysql credentiel for exemple.
  All the playbook and config files are stored in a raft.
  The config fines if need are pushed by otter not by ansible.

Very basic but enough for me in this way I have a central point to push and configure apps on windows and linux.

I keep Buildmaster for inhouse dev deployement, clone prod apps from prod to dev etc ...

Best regards from France
Stay home, keep safe
PhilippeC.

[atripp]

Neat! Would you mind sharing it?

We are trying to build up content libraries that show you to do stuff like this... such as this BuildMaster and Terraform content, which does use Modules, but also establishes a nice CI/CD pattern.

Getting an idea of how to do this w/ playbooks would be nice :)

[philippe.camelio_3885]

I read about Terraform and BuildMaster. I follow more or less the same guideline.

I assumed the following original configuration:

• connection to the server with SSH as root
• ansible is already installed (without any config) - it is included in my Ubuntu vm template
• Assign the ANSIBLE-BASE Role to the server

Create a Role : ANSIBLE-BASE

• Variables : Set ${ANSIBLE-ROOT} = /tmp/ansible
• Configuration Plan

##AH:UseTextMode

    Ensure-Asset
    (
        Name: hosts,
        Raft: ANSIBLE,
        Type: File,
        Directory: /etc/ansible,
        FileName: hosts
    );
Ensure-Directory ${ANSIBLE-ROOT};

• Asset file host is

[localhost]
127.0.0.1  ansible_connection=local

Generic Playbook ANSIBLE::PLAYBOOK

##AH:UseTextMode
##AH:Description Execution d'un playbook pour un role
module PLAYBOOK<$FOLDER, $FILE, %MAP = %()>
{
    Ensure-Directory $FOLDER;

    Ensure-Asset
    (
        Name: $FILE.yml,
        Raft: ANSIBLE,
        Type: File,
        Directory: $FOLDER,
        FileName: playbook.yml
    );

    foreach $mapKey in @MapKeys(%MAP)
    {
        Replace-Text
        (
            Include: playbook.yml,
            Directory: $FOLDER/,
            SearchText: "`#$mapKey`#",
            ReplaceWith: $MapItem(%MAP, $mapKey)
        );
    }

    SHExec ansible-playbook $FOLDER/playbook.yml;

    Ensure-Directory $FOLDER
    (
        Exists: false
    );
}

Exemple to deploy MariaDB

• Create a Resource credential for MariaDB root password named ANSIBLE-MYSQL-ROOT

Create the module 
##AH:UseTextMode
module ROLE-MARIADB
{
    # General
    # Role MARIADB
    {
        for role ANSIBLE-ROLE-MARIADB
        {
            set %{ANSIBLE-VAR-MAP} = %();

            set %{ANSIBLE-VAR-MAP} = %(mysql_root_password:$GetCredentialProperty(ANSIBLE-MYSQL-ROOT,Password));

            set ${ANSIBLE-ROLE} = mariadb;

            set ${ANSIBLE-ROLE-FOLDER} = ${ANSIBLE-ROOT}/${ANSIBLE-ROLE};

            call ANSIBLE::PLAYBOOK
            (
                FOLDER: ${ANSIBLE-ROLE-FOLDER},
                FILE: ${ANSIBLE-ROLE},
                MAP: %{ANSIBLE-VAR-MAP}
            );

            Ensure-Directory ${ANSIBLE-ROLE-FOLDER}
            (
                Exists: false
            );
        }
    }
}

The ansible playbook of MariaDB is here - based of various info I grab on the net - a very straightforward installation
=> Install MariaDB 10.4
=> Setup the root password

- hosts: 127.0.0.1 
  connection: local
  vars:
        mysql_root_password: '#mysql_root_password#'
  tasks:           
    - name: update apt cache  
      apt: update_cache=yes cache_valid_time=3600     
    - name: Install Utility software 
      apt: name={{item}} state=latest     
      with_items:            
        - software-properties-common   
        - python-mysqldb         
    - name: Add apt key          
      command: apt-key adv --fetch-keys https://mariadb.org/mariadb_release_signing_key.asc     
    - name: Add MariaDB Repo  
      apt_repository:        
        filename: MariaDB-10.4    
        repo: deb [arch=amd64,i386]  http://ftp.igh.cnrs.fr/pub/mariadb/repo/10.4/ubuntu bionic main   
        state: present   
    - name: Install MariaDB Packages   
      apt: name={{item}} state=present default_release=bionic update_cache=yes    
      with_items:                
        - mariadb-client        
        - mariadb-common        
        - mariadb-server         
    - name: Start MariaDB    
      service: name=mysql state=started    
    - name: Is root password set?   
      command: mysql -u root --execute "SELECT NOW()"    
      register: is_root_password_set       
      ignore_errors: yes    
    - name: Delete anonymous users  
      mysql_user: user="" state="absent"    
      when: is_root_password_set.rc == 0       
    - name: Set root password    
      mysql_user: user=root password="{{mysql_root_password}}" host=localhost          
      when: is_root_password_set.rc == 0     
    - name: Set root password for other hosts  
      mysql_user: user=root password="{{mysql_root_password}}" host="{{item}}" login_user="root" login_host="localhost" login_password="{{mysql_root_password}}"      
      when: is_root_password_set.rc == 0    
      with_items:   
        - "127.0.0.1"     
        - "::1"   

Then, If I need to deploy MariaDB in a Job, I just call the MariaDB module like :

call ANSIBLE::ROLE-MARIADB();

Actually, the more complexe deployment is about an Asset Management software named GLPI with 3 playbook (MariaDB, Apache2, GLPI itself) called in a job .
I could do it with a single ansible playbook, but as I need to deploy MariaDB and Apache2 for other software, it is better to make some modules and call them.

All this stuff can be improve a lot

• Better error handling
• using Text Template for the playbook instead of Asset file
  ...
  but it is working :)

Best Regards
PhilippeC.

[atripp]

thanks!! Very interesting to see.