Solutionnaire Ansible
1. Bibliographie Ansible
- Documentation Ansible
- Jason Edelman, Network Automation with Ansible, O’Reilly Media, Inc, 2016.
- Lorin Hochstein, Rene Moser, Ansible: Up and Running, 2nd Edition, O’Reilly Media, Inc, 2018., Github Repo
- Ansible Automation Workshops
- Jeff Geerling, Ansible for DevOps, Server and configuration management for humans, LeanPub, 2020 Github Repo
2. Ansible Stackoverflow
2.1. Variables
- How to include vars file in a vars file with ansible?
- Ansible - Use default if a variable is not defined
- Pass bash script arguments to ansible command in script
- Ansible - read inventory hosts and variables to group_vars/all file
- In Ansible v2, which variable stores the ssh username?
- Ansible remote_user vs ansible_user
- Ansible: Set variable only if undefined
- group_names variable in ansible
- How to write dynamic variable in Ansible playbook
2.2. Texte
- Ansible: lineinfile for several lines?
- How to search for files containing a particular text with Ansible?
- How to modify sudoers file with ansible ?
- Ansible string concat before filter
- How to remove the line breaker character ‘\n’ from the result of lookup() module in Ansible?
- ansible: create a list from comma separated string
- Convert list variable to comma separated list in ansible
- How to properly output a comma delimited string in j2 template?
- Ansible snippets - manipulating JSON data
- Json parsing in Ansible
2.3. Logique
- Ansible: filter a list by its attributes
- Ansible map dictionary items to a list (duplicate)
- Check if arrays are defined and not empty in ansible
- How can I use a condition to set a variable value in Ansible?
- Run task only if host does not belong to a group
- Is it possible to map multiple attributes using Jinja/Ansible?
- Using True False with Ansible When Clause
- How to nicely split on multiple lines long conditionals with OR on ansible?
- ipaddr filter
- How to correctly define subelements in Ansible jinja2 template(with subelements)?
- Is there a way to check that a dictionary key is not defined in ansible task?
- Ansible Nested Loops - How to loop over a loop item?
- Double loop Ansible
- Ansible playbook with_subelements
- Splitting variable not working in Ansible
- Jinja2 filter list using string contains test
2.4. Modules
- Module failed to start Ansible
- Using ansible to manage disk space
- Use ansible templating but rysnc to move files
2.5. Inventaire
- Ansible dynamic Inventory with bash script
- Accessing inventory host variable in Ansible playbook
- Best way currently to create an ansible inventory from terraform
3. Certificats TLS auto-signés
3.1. Module command
Voici une solution fonctionnelle avec le module command mais elle est “brut de décoffrage”.
- name: Install nginx and python-openssl
apt:
name:
- nginx
- python-openssl
update_cache: yes
cache_valid_time: 3600
- name: Create self-signed certificate, if configured.
command: >
openssl req -x509 -nodes -subj '/CN=localhost' -days 365
-newkey rsa:4096 -sha256 -keyout {{ key_file }} -out {{ cert_file }}
creates={{ cert_file }}
notify: restart nginx
- name: "fix right on key file"
file:
name: "{{ key_file }}"
mode: 0600
notify: restart nginx
3.2. Modules openssl_*
Voici une solution avec des variables et des tâches idempotentes grâce aux modules Ansibles openssl_* :
openssl_privatekeyopenssl_csropenssl_certificateopenssl_dhparam
Variables
vars:
key_file: "/path/{{ ansible_fqdn }}.key.pem"
csr_file: "/path/{{ ansible_fqdn }}.csr.pem"
cert_file: "/path/{{ ansible_fqdn }}.cert.pem"
dh_file: "/path/{{ ansible_fqdn }}.dh.pem"
Tâches
- name: Generate an OpenSSL private key.
openssl_privatekey:
path: "{{ key_file }}"
notify: restart nginx
- name: Generate an OpenSSL CSR.
openssl_csr:
path: "{{ csr_file }}"
privatekey_path: "{{ key_file }}"
common_name: "{{ ansible_fqdn }}"
notify: restart nginx
- name: Generate a Self Signed OpenSSL certificate.
openssl_certificate:
path: "{{ cert_file }}"
privatekey_path: "{{ key_file }}"
csr_path: "{{ csr_file }}"
provider: selfsigned
notify: restart nginx
- name: "fix right on key file"
file:
name: "{{ key_file }}"
mode: 0600
notify: restart nginx
Pour générer un fichier Diffie-Helman (DH) :
- name: "generate a DH key"
openssl_dhparam:
path: "{{ dh_file }}"
size: 2048
