What is Ansible?
Long story short, Ansible is a tool which helps server administrators automate and execute tasks on multiple servers at the same time. Imagine having 20 Linux servers, each needing an installtion
of a web server. In the good old days, you would have to login to each server individually and perform the task, now though you can do it with a single command.
Why is Ansible preferred – other automation tools require you to install additional software on your remote servers, while Ansible does the job through SSH, which means no additional software on your target servers, less resources/low overhead, less things to troubleshoot then things go wrong.
Install Ansible
We will refer to the machine we install Ansible on as the command server. This could be your own laptop, stand alone server, or a small VPS. I personally run it on a small vps with 1GB ram and 50GB space from servercheap.net running CentOS 6
1 ) Let’s update our system with the latest packages
[root@ansible ~]# yum -y update
2) Enable EPEL repo
[root@ansible ~]# wget http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm [root@ansible ~]# rpm -ivh epel-release-6-8.noarch.rpm
3) Install Ansible via YUM
[root@ansible ~]# yum install ansible
4) Verify Ansible is installed
[root@ansible ~]# ansible --version ansible 2.3.1.0 config file = /etc/ansible/ansible.cfg configured module search path = Default w/o overrides python version = 2.6.6 (r266:84292, Aug 18 2016, 15:13:37) [GCC 4.4.7 20120313 (Red Hat 4.4.7-17)]
Setup SSH Keys/Password-less login
This step is necessary so Ansible is able to login to our remote server without you having to enter your root password every time and for each server.
1) Generate a public key on our control server
[root@ansible ~]# ssh-keygen -t rsa Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is: 53:48:d1:09:35:c6:3f:09:4f:33:36:c8:44:1a:8c:12 root@ansible The key's randomart image is: +--[ RSA 2048]----+ | E. o=X*o | | . ...=B.* | | . o .* = | | . = | | S . | | . | | | | | | | +-----------------+
2) Copy the key we just generated from /root/.ssh/id_rsa.pub
[root@ansible ~]# cat /root/.ssh/id_rsa.pub ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0xRif65UF6W0vdmG7FPcQJLsZZBREam2lxOFZudZUHMgYR+R3CaLedHrO5+66Mo0C4kzFgrC1NySqBe9LMG1T8Mj/bxA81RwSLOSXf+nyz8oRHr1xb73pS7W0VlYqSFTK+RG9JZNad1Pc6PVb60jHWhtRxWwDF/2Cj4aVhpOmQnfiMZrTAvhy4VK6fU63JKKrOYzw71MYrkOclSYiAaeUd9+gBniAKYmJx7geC3Z+/JWs9EghQPE2yTKeY12jd/xHfNlrq+/V+V8TNd6aa5SMTZdGTlBnwArmZGCOd2Czv1PogDpS48W1mGIBei+LaD2YxIcqOz7zNUc/eCFEavs5w== root@ansible
3) Place the above public key in /root/.ssh/authorized_keys on all your Linux servers and save the file
nano /root/.ssh/authorized_keys ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0xRif65UF6W0vdmG7FPcQJLsZZBREam2lxOFZudZUHMgYR+R3CaLedHrO5+66Mo0C4kzFgrC1NySqBe9LMG1T8Mj/bxA81RwSLOSXf+nyz8oRHr1xb73pS7W0VlYqSFTK+RG9JZNad1Pc6PVb60jHWhtRxWwDF/2Cj4aVhpOmQnfiMZrTAvhy4VK6fU63JKKrOYzw71MYrkOclSYiAaeUd9+gBniAKYmJx7geC3Z+/JWs9EghQPE2yTKeY12jd/xHfNlrq+/V+V8TNd6aa5SMTZdGTlBnwArmZGCOd2Czv1PogDpS48W1mGIBei+LaD2YxIcqOz7zNUc/eCFEavs5w== root@ansible
4) Let’s test it, if we have done everything properly, when we try to ssh to our linux server from our ansible control server, we should not be asked for password.
From our ansible control server we run:
[root@ansible ~]# ssh 1.1.1.1 The authenticity of host '[1.1.1.1] ([1.1.1.1])' can't be established. RSA key fingerprint is 86:88:3f:9d:35:41:e4:a8:0e:6b:15:26:3d:77:01:4b. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '[1.1.1.1]' (RSA) to the list of known hosts. Last login: Thu Jul 13 17:58:07 2017 from . [[email protected] ~]#
Configure Ansible Hosts
We need to tell Ansible the IPs of the servers we want to administer. This is done by adding your server ips in /etc/ansible/hosts
The default file looks like this:
[root@ansible ~]# cat /etc/ansible/hosts # This is the default ansible 'hosts' file. # # It should live in /etc/ansible/hosts # # - Comments begin with the '#' character # - Blank lines are ignored # - Groups of hosts are delimited by [header] elements # - You can enter hostnames or ip addresses # - A hostname/ip can be a member of multiple groups # Ex 1: Ungrouped hosts, specify before any group headers. ## green.example.com ## blue.example.com ## 192.168.100.1 ## 192.168.100.10 # Ex 2: A collection of hosts belonging to the 'webservers' group ## [webservers] ## alpha.example.org ## beta.example.org ## 192.168.1.100 ## 192.168.1.110 # If you have multiple hosts following a pattern you can specify # them like this: ## www[001:006].example.com # Ex 3: A collection of database servers in the 'dbservers' group ## [dbservers] ## ## db01.intranet.mydomain.net ## db02.intranet.mydomain.net ## 10.25.1.56 ## 10.25.1.57 # Here's another example of host ranges, this time there are no # leading 0s: ## db-[99:101]-node.example.com
Now let’s add our first host. At the bottom of the file we can do:
[test] LinuxServer1:7777 ansible_ssh_host=1.1.1.1
In the above example [test] is the name of the group which will contain our Linux servers. You can have as many groups as you wish.
LinuxServer1 is the friendly name of our first server.
:7777 tells Ansible that the SSH port of our server is 7777. If your server runs SSH on the standard port 22, you can leave that part out.
ansible_ssh_host=1.1.1.1 tells Ansible the IP of our server
So far so good. By now we have Ansible installed and our first server is configured.
Let’s run some sample commands:
[root@ansible ~]# ansible LinuxServer1 -m shell -a 'ps ax' LinuxServer1 | SUCCESS | rc=0 >> PID TTY STAT TIME COMMAND 1 ? Ss 0:49 init -z 2 ? S 0:00 [kthreadd/342] 3 ? S 0:00 [khelper/342] 60 ? Ss 0:02 /usr/lib/systemd/systemd-journald 67 ? Ss 0:00 /usr/lib/systemd/systemd-udevd 106 ? Ss 0:15 /usr/lib/systemd/systemd-logind 107 ? Ss 0:32 /bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation 108 ? Ss 0:00 /usr/sbin/xinetd -stayalive -pidfile /var/run/xinetd.pid 112 ? Ssl 0:00 /usr/sbin/rsyslogd -n 138 ? Ss 0:00 /usr/sbin/saslauthd -m /run/saslauthd -a pam -n 2 139 ? S 0:00 /usr/sbin/saslauthd -m /run/saslauthd -a pam -n 2 153 ? Ss 0:00 /usr/sbin/sshd 165 ? Ss 0:00 /bin/sh /usr/bin/mysqld_safe --basedir=/usr 197 ? Ss 0:01 /usr/sbin/crond -n 202 tty2 Ss+ 0:00 /sbin/agetty --noclear tty2 linux 204 tty1 Ss+ 0:00 /sbin/agetty --noclear --keep-baud console 115200 38400 9600 vt220 386 ? Sl 17:06 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib64/mysql/plugin --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/lib/mysql/mysql.sock 406 ? Ss 0:28 sendmail: accepting connections 436 ? Ss 0:00 sendmail: Queue runner@01:00:00 for /var/spool/clientmqueue 5723 ? Ss 0:01 /sbin/rpcbind -w 11951 ? Ss 0:25 /usr/sbin/httpd -DFOREGROUND 20486 ? S 0:02 /usr/sbin/httpd -DFOREGROUND 20487 ? S 0:04 /usr/sbin/httpd -DFOREGROUND 20488 ? S 0:03 /usr/sbin/httpd -DFOREGROUND 23767 ? Ss 0:00 sshd: root@pts/0 23797 pts/0 Ss+ 0:00 /bin/sh -c /usr/bin/python /root/.ansible/tmp/ansible-tmp-1499985693.17-135220611748439/command.py; rm -rf "/root/.ansible/tmp/ansible-tmp-1499985693.17-135220611748439/" > /dev/null 2>&1 && sleep 0 23808 pts/0 S+ 0:00 /usr/bin/python /root/.ansible/tmp/ansible-tmp-1499985693.17-135220611748439/command.py 23809 pts/0 S+ 0:00 /usr/bin/python /tmp/ansible_nWpKck/ansible_module_command.py 23810 pts/0 R+ 0:00 ps ax
Cool, we now see all the running processes on our remote server. Alternatively we can run:
[root@ansible ~]# ansible test -m shell -a 'ps ax'
Remember we created a group called test in our /etc/ansible/hosts file? The above command will then execute the command ‘ps ax’ on all servers under the group test. Since currently we only have one server, the output will be the same as above.
Ansible Playbooks
With the above example you can automate a lot of things, however Ansible is all about playbooks. What is a playbook? – it is just a text file in YAML format, where you list a bunch of commands for Ansible to execute. Let’s get right into some examples.
Scenario: Let’s image we are administering 20 linux servers. On each of them we have a custom shell script running. We have now made changes to our script and we would like to update it on all 20 servers. In the good old days you would have had to login to each server individually and update the file, let’s see how we can perform this task with the help of Ansible in just a few seconds.
Lets create a file called test.yaml in /etc/ansible (the location of the files do not matter and you are free to place them where ever you wish)
[root@localhost ansible]# cd /etc/ansible/ [root@localhost ansible]# nano test.yaml
And we insert the following yaml code:
---
- hosts: LinuxServer1
tasks:
- name: Copy scripts over
synchronize: src=/etc/ansible/test.yaml dest=/root
- name: Set execute persmission on ave
file: path=/root/test.yaml owner=root group=wheel mode=0775 state=file
Lets break the above code down:
– hosts: LinuxServer1 – the destination server, alternatively you could put the group name, in our case ‘test’, which would then cause ansible to copy our file to all servers in the group.
– name: Copy scripts over – a general description of our task.
synchronize: src=/etc/ansible/test.yaml dest=/root – this line tells ansible to copy the file test.yaml which is located in /etc/ansible on our local control server and place it in /root on the destination server.
file: path=/root/test.yaml owner=root group=wheel mode=0775 state=file – this line tells ansible to change the permissions of the test.yaml once it is copied to the destination server.
And we execute it:
[root@ansible ~]# ansible-playbook test.yaml
If we now check our destination server, we will see test.yaml in /root with 755 permission
Pretty cool eh ? Now you have a basic knowledge and understanding of what Ansible is and how it works. But don’t just stop here. Ansible is a massively powerful tool which can allow you to automated almost anything you can think of.
Keep reading and studying the ansible playbooks here
Enjoy!
