redhatnordicssa / ansible-roadshow

One day hands on lab with Ansible and Ansible Tower

ansible-roadshow

Hello and welcome. This is a hands on lab with Ansible and Ansible Tower.

What is this?

This is a lab which provides an introduction to Ansible, Ansible Tower, how to write Ansible content and how to work with Ansible at scale. At the end of the day, you will know enough to go out in the real world and do real useful stuff.

Estimated time to complete this lab is 4-6 hours, depending on previous experience.

For an overview of the lab, go to: Lab overview

What is this NOT?

A complete walkthrough of all Ansible features and best practices. If you think something important is missing: contribute. For more information about contributing, see: Contributing.

You may also want to have a look at https://github.com/ansible/lightbulb which is a more complete walkthrough of all things Ansible.

❗ Some basic advise; This lab is not about doing it as fast as possible. It's about learning. Take your time to read the labs properly.

Maintainers

This lab is maintained by members of Red Hat's Nordic Solution Architect team.

• Teemu Uotila (@teemu-u)
• Ilkka Tengvall (@ikke-t)
• Peter Gustafsson (@pgustafs)
• Magnus Glantz (@mglantz)

Contributing

This lab is an open source (GPL 3.0) project, so if you find any problems with it, feel free to open up an issue or send a pull request. For more information about contributing to this project, please see:

• CODE OF CONDUCT
• CONTRIBUTING
• PROJECT LICENSE

For information about installing this lab, go to the bottom of this page.

Lab overview

The lab includes information about:

• Ansible basics (clientless nature, inventory, ansible-playbook basic commands)
• Git workflows for working with Ansible (GitHub workflow)
• How to create playbooks (basic playbooks, work with inventories and groups, encrypted vaults)
• How to work with roles (transform a playbook to a role)
• Ansible Tower (projects, inventories, job templates, credentials)
• An introduction to Ansible Galaxy
• How to create your own Ansible module
• How to work with Ansible code
• Ansible Tower basics
• How to test your Ansible playbooks and roles

BELOW is an overview of the labs. This is for the students in the lab.
❗ Start at 0 and go forward to 10. The labs depends on each other, so don't skip stuff.

0. Getting started

1. Ansible basics

2. Writing Your First Playbook

3. Writing the Wildfly Playbook

4. Writing the Load Balancer Playbook

5. Handling Secrets with Ansible Vault

6. Working with Ansible as code

7. Introducing Ansible Tower

8. Installing wildfly and nginx from Tower

9. Testing Ansible playbooks

10. Developing Ansible Modules

Lab prerequisites

• Internet access
• A web browser
• A SSH client installed on your laptop/workstation
• Ability to SSH to thing on the internet (port: 22/tcp)

Setting up the lab on AWS

This is for operators of the lab. Go to below page for information about setting up this lab on Amazon: Setting up the Ansible lab on AWS

ansible-roadshow's Issues

SSH folder doesn't exist by default

SSH folder doesn't exist by default..

so

ssh-keyscan -H client_systemX client_systemY client_systemZ >> ~/.ssh/known_hosts

will fail...

Update all playbooks with new path according to re-structuring commit

Automate the user creation on the gitlab server

Lab 7: missing step by step instructions

There are no step by step instructions on how to create artifacts in tower. More detail is needed.

add letsencrypt for tower to get valid cert

enable icmp for troubleshoot ping in security group

ping won't go through atm

Lab 6: very unclear instructions for GitHub

You are almost required to know git in order to complete this lab.

I suggest that a disclaimer in the top reads "you can skip this lab if you know git".

Then make the instructions more clear on how to use git with step by step instructions.

lab-09: needs more handson

Lab doesn't really contain any work..

Some playbooks with faults (wrong indentation, typos, others) should be created...

Lab 9: connection from Tower server to Ansible lost

I can't see logs or status of workflows in the Tower console when I start a new job.

Lab1, tower server can't reach managed nodes over ssh

$ ansible -i hosts all -m ping
wildfly2 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: ssh: connect to host 34.240.6.124 port 22: Connection timed out\r\n",
"unreachable": true
}
wildfly1 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: ssh: connect to host 52.210.56.118 port 22: Connection timed out\r\n",
"unreachable": true
}
loadbalancer1 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: ssh: connect to host 34.241.117.172 port 22: Connection timed out\r\n",
"unreachable": true
}

Set correct password for gitlab users

Set correct password for gitlab users

Lab 6: no description on how to create a new git repo for GitHub

You are given a task in the lab "As a first step, go ahead and create a new repository on GitHub and put the ping playbook that you created in lab-2 there.", but there is no description of how to do it.

Lab 1 : Ansible version

The versions are not aligned.

In instructions :

$ansible --version
ansible 2.4.2.0
config file = /etc/ansible/ansible.cfg
configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python2.7/site-packages/ansible
executable location = /bin/ansible
python version = 2.7.5 (default, May 3 2017, 07:55:04) [GCC 4.8.5 20150623 (Red Hat 4.8.5-14)]

Command line gives the following :

$ansible --version
ansible 2.6.3
config file = /etc/ansible/ansible.cfg
configured module search path = [u'/home/student/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python2.7/site-packages/ansible
executable location = /usr/bin/ansible
python version = 2.7.5 (default, May 31 2018, 09:41:32) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]

Lab 1 :

Please specify that the user should ssh with user : student.

"Ensure that you are logged in to your Ansible control server."

Lab3

"Finally you need to apply the newly created role to your wildflyservers group. In dir $WORK_DIR create a file named site.yml. Put the following content into the file:"

Please introduce the concept of "role".

Lab2, show how the playbook should look like when you have changed the ping message to crash,

must set "ignore invalid ssl certs" option for tower

otherwise tower can't connect to self-signed ssl GitLab. This is the option:

/etc/tower/settings.py:

AWX_TASK_ENV['GIT_SSL_NO_VERIFY'] = 'True'

I tested this works.

add letsencrypt for gitlab to get valid cert

add "move to next lab" link to the end of each lab

Merge Lab-7 and Lab-8

There are some of the same stuff in these two labs.. They should be merged

Update documentation with Gitlab instructions

Add instructions how to use Gitlab where GitHub is used.

gitlab server provisioning fails

PLAY [setup stuff in Gitlab VMs] ***************************************************************************************

TASK [Gathering Facts]
This is before I setup the gitlab key. Is it expected for the playbook to fail then?
@teemu-u @pgustafs

---

The authenticity of host '18.196.100.102 (18.196.100.102)' can't be established.
ECDSA key fingerprint is SHA256:eFbgxanqdTzH8pOsO1PJk4nmRPmmjinrZkwaNowkA8k.
Are you sure you want to continue connecting (yes/no)? yes
fatal: [18.196.100.102]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: Warning: Permanently added '18.196.100.102' (ECDSA) to the list of known hosts.\r\[email protected]: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).\r\n", "unreachable": true}
to retry, use: --limit @/Users/mglantz/code/github/ansible-roadshow/content/provision-all.retry

Naming - Control server

In the labs we are referring to control server. In the machine info about the labs containing IP and username we say Ansible Tower (not control server). Maybe we should change the description in the labs calling it ansible tower instead.

Install all basic editors

ssh-key should be generated on fly, not to use public one

This is "looks bad security habbit" -kinda issue, but it hurts me see we share private ssh key in github. We should generate the key for the first user, and keep inserting the key everywhere by ansible.

E.g: Run ssh-keygen on the tower machine, register and print it to local file. Then push it to all the machines for student users.

Lab 3: use ansible-galaxy init wildfly to setup file structure

Use ansible-galaxy init wildfly to initialize the file structure and start from there.

document tower install into infra setup README

Tower installation guide is missing from content/README.md

add all playbooks needed into provision-all.yml

There is the provision-all playbook that should do it all in one playbook run. I added instance creation and gitlab install while I tried gitlab part. Make sure all parts are included. Still missing at least:

1. tower install
2. lab machines configs
3. gitlab add users and import project.

When lab 8 is done, lab 7 will not work

This is because lab 8 introduces roles, which has secrets in the inventory. Either we should create new inventory for lab 8, or add secret to the ping template. Discuss which is preferred. We need a compromise to keep description short.

git, Peer's certificate issuer has been marked as not trusted by the user.

git clone https://ec2-34-243-30-147.eu-west-1.compute.amazonaws.com/root/ansible-roadshow.git
Cloning into 'ansible-roadshow'...
fatal: unable to access 'https://ec2-34-243-30-147.eu-west-1.compute.amazonaws.com/root/ansible-roadshow.git/': Peer's certificate issuer has been marked as not trusted by the user.

Create student user on all client systems

Create student user on all client systems

disallow ssh from the outside, except for to tower server

replace mkdir role things with ansible-galaxy

ansible-galaxy init role_name

instead of mkdir role/wildfly ...

Shouldn't use root user

LAB1:
ansible -i hosts -u root all -m ping

Should be changed to:

ansible -i hosts -u student all -m ping

Lab1 :

where X,Y,Z are replaced by the numbers for servers assigned to you.

should be

client_system_X,client_system_Y,client_system_Z are replaced by the IPs for servers assigned to you.

ansible host targets need different format in lab1

should be like:
lbservers]
client_system_1 ansible_host=54.171.199.128

[wildflyservers]
client_system_2 ansible_host=52.209.159.2
client_system_3 ansible_host=34.241.151.42

client systems unreachable, permission denied

[root@ip-172-31-29-42 work]# ansible -i hosts -u root all -m ping
52.213.129.63 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).\r\n",
"unreachable": true
}
34.253.133.33 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).\r\n",
"unreachable": true
}
34.245.231.98 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).\r\n",
"unreachable": true
}

Lab 0, make it clear that https://github.com/mglantz/ansible-roadshow should be cloned to the WORK_DIR

Lab 0, make it clear that https://github.com/mglantz/ansible-roadshow should be cloned to the WORK_DIR

Lab3, student user not allowed to do sudo on managed nodes

$ ansible-playbook -i hosts site.yml

PLAY [wildflyservers] *************************************************************************************************************************************************************

TASK [Gathering Facts] ************************************************************************************************************************************************************
fatal: [client_system_3]: FAILED! => {"changed": false, "module_stderr": "Shared connection to 34.242.233.117 closed.\r\n", "module_stdout": "sudo: a password is required\r\n", "msg": "MODULE FAILURE", "rc": 1}
fatal: [client_system_2]: FAILED! => {"changed": false, "module_stderr": "Shared connection to 34.246.180.58 closed.\r\n", "module_stdout": "sudo: a password is required\r\n", "msg": "MODULE FAILURE", "rc": 1}
to retry, use: --limit @/home/student/work/site.retry

PLAY RECAP ************************************************************************************************************************************************************************
client_system_2 : ok=0 changed=0 unreachable=0 failed=1
client_system_3 : ok=0 changed=0 unreachable=0 failed=1

Lab1, ansible -i hosts all -m ping

[student@ip-172-31-29-72 work]$ ansible -i hosts all -m ping
client_system_3 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).\r\n",
"unreachable": true
}
client_system_1 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).\r\n",
"unreachable": true
}
client_system_2 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).\r\n",
"unreachable": true
}

lab-4, move template from files to templates -directory

Lab 0: inconsistency in naming

Lab 0 refer to control server, but this isn't refered to in the diagram. Furthermore control server is not a term in Asnible. Use Tower server instead.

set strong passwords for users

lab3, play recap does not display IP as stated in the labs

PLAY RECAP ************************************************************************************************************************************************************************
client_system_2 : ok=8 changed=5 unreachable=0 failed=0
client_system_3 : ok=8 changed=0 unreachable=0 failed=0

lab-07: missing instructions for vault secret

the guide doesn't mention you need to add vault credentials too, it only lists to add machine creds.

ERROR! Attempting to decrypt but no vault secrets found

Inconsistency in naming.

Lab 1
Instruction in lab 1 refer to ‘you got three servers assigned to you’. The email you receive when joining says refer to 'Client Systems'. Make sure those two things are aligned.

Remove instructions to clone to laptop

Should be to control server

Fix overview so it includes gitlab server and more

Add proper domain for Gitlab

Create R53 A record for Gitlab server (@mglantz has a domain already set-up)