2 - Handling the inventory¶

Hosts management¶

Inside the inventory file there can be groups, groups of groups, and variables. Since the variable precedence in Ansible is quite complex, we will handle the variables separately. There are many formats for a valid inventory file (depending on the inventory plugin being used). In this case we will focus in the INI-like format, since I believe it’s the easiest to work with when dealing with static inventories.

Consider the following content in the inventory file (taken from here):

[atlanta]
host1
host2

[raleigh]
host2
host3

[southeast:children]
atlanta
raleigh

In any inventory file there are two default groups: all (includes all of the hosts), and none (includes none of the hosts).

When defining a playbook we can target the right hostgroup in the hosts section. Also, we can target the hostgroup all, and then limit to the group of interest we want when running our playbook, like this:

(.venv) $ ansible-playbook -i inventory/hosts any_playbook_with_all_hosts.yml --limit atlanta

In our case let’s create an empty inventory file in the following path:

(.venv) $ mkdir -p ~/ansible_2/inventory
(.venv) $ touch ~/ansible_2/inventory/hosts

Let’s include the following content (yes, same file from part 1):

1 2 3 4 5 6 7 8

[nginx_webservers] 10.100.0.2 [all:vars] ansible_connection=ssh ansible_user=vagrant ansible_ssh_private_key_file=.vagrant/machines/default/virtualbox/private_key ansible_ssh_common_args='-o StrictHostKeyChecking=no'

Also create the role we’ll use in this section (again, same role from part 1):

(.venv) $ mkdir -p ~/ansible_2/roles/webservers-nginx/tasks/
(.venv) $ touch ~/ansible_2/roles/webservers-nginx/tasks/main.yml

Content is:

1 2 3 4 5 6 7 8 9 10 11 12

--- - name: install the nginx reverse proxy apt: name: nginx update_cache: yes - name: enable nginx service systemd: name: nginx state: started enabled: yes

Variables management¶

This section covers the use of variables by our inventory (and playbooks). The areas covered are: variables precedence and secrets via the usage of ansible-vault files (encrypted files to conveniently place secrets)

Cleaning-up the current inventory file¶

• Make sure the following content is in the file ~/ansible_2/inventory/hosts.ini:

  1 2	[nginx_webservers] 10.100.0.2

Create files to place variables¶

• Create a global group_vars file:

  (.venv) ansible_2 $ mkdir -p group_vars/all
  (.venv) ansible_2 $ touch group_vars/all/vars.yml
  

• Make sure the content of group_vars/all/vars.yml is:

  1 2 3 4

  --- ansible_connection: ssh ansible_ssh_common_args: '-o StrictHostKeyChecking=no'

• Create the inventory-level group_vars file:

  (.venv) ansible_2 $ mkdir -p inventory/group_vars/all
  (.venv) ansible_2 $ touch inventory/group_vars/all/vars.yml
  

• Make sure the content of inventory/group_vars/all/vars.yml is:

  1 2 3 4 5

  --- ansible_ssh_port: 2200 ansible_connection: ssh ansible_ssh_common_args: '-o StrictHostKeyChecking=no'

• Create the inventory group_vars/GROUP_NAME vars file:

  (.venv) ansible_2 $ mkdir -p inventory/group_vars/nginx_webservers
  (.venv) ansible_2 $ touch inventory/group_vars/nginx_webservers/vars.yml
  

  Note

  The name of this directory must match a hostgroup inside the inventory file

• Make sure the content of inventory/group_vars/nginx_webservers/vars.yml is:

  1 2 3 4 5 6 7

  --- ansible_ssh_port: 22 ansible_user: vagrant ansible_ssh_private_key_file: .vagrant/machines/default/virtualbox/private_key simple_auth_username: admin

Create the vagrant box¶

• Initialize vagrant with an ubuntu image:

  (.venv) ~/ansible_2 $ vagrant init bento/ubuntu-16.04 --minimal
  

  Note

  This will create the file ‘Vagrantfile’.

• Open the auto-generated Vagrantfile, and make sure the content looks like this:

  1 2 3 4 5 6

  Vagrant.configure("2") do |config| config.ssh.port = 2200 config.vm.box = "bento/ubuntu-16.04" config.vm.network "private_network", ip: "10.100.0.2" config.vm.hostname = "tutorial-2" end

• Start the virtual machine

  (.venv) ~/ansible_2 $ vagrant up
  

  Note

  Time to get a cup of tea while this is done.

Run the playbook¶

Similar to part 1, run:

(.venv) ~/ansible_2 $ ansible-playbook -i inventory/hosts.ini webservers.yml

The output should be:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

PLAY [nginx_webservers] ************************************************************************************************************************************************

TASK [Gathering Facts] *************************************************************************************************************************************************
ok: [127.0.0.1]

TASK [webservers-nginx : install the nginx reverse proxy] **************************************************************************************************************
changed: [127.0.0.1]

TASK [webservers-nginx : enable nginx service] *************************************************************************************************************************
ok: [127.0.0.1]

PLAY RECAP *************************************************************************************************************************************************************
127.0.0.1                  : ok=3    changed=1    unreachable=0    failed=0   

In conclusion, same desired result as in part 1, but now using a nice layout for the inventory.

Inventory layout 1: multiple environments¶

Consider the following inventory layout:

inventory
├── prod
│   ├── group_vars
│   │   ├── all
│   │   │   └── vars.yml
│   │   └── nginx_webservers
│   │       └── vars.yml
│   └── hosts
├── qa
│   ├── group_vars
│   │   ├── all
│   │   │   └── vars.yml
│   │   └── nginx_webservers
│   │       └── vars.yml
│   └── hosts
└── uat
    ├── group_vars
    │   ├── all
    │   │   └── vars.yml
    │   └── nginx_webservers
    │       └── vars.yml
    └── hosts
group_vars
└── all
    └── vars.yml

In this layout we see how different environments can be defined by just turning our single inventory file into a folder with many small inventories. Things to notice are:

• Variables that apply to all environments can be specified in the group_vars/all/vars.yml that is located in the same hierarchy as the inventory directory
• Variables that apply for all groups within an environment, can be specified in the files inventory/[prod, qa, or uat]/group_vars/all/vars.yml. Useful for defining endpoints attached to a specific environment, for example.
• Variables that apply to a certain hostgroup, in the files inventory/[prod, qa, or uat]/group_vars/[hostgroup]/vars.yml. An extension of this approach is to also add the hostvars in parallel to the group_vars, but since that’s a bit tedious, you might want to automate that task.

Another variation of this layout is the following:

inventory
├── group_vars
│   ├── all
│   │   └── vars.yml
│   ├── nginx_webservers
│   │   └── vars.yml
│   ├── prod
│   │   └── vars.yml
│   ├── qa
│   │   └── vars.yml
│   └── uat
│       └── vars.yml
├── hosts-prod
├── hosts-qa
└── hosts-uat
group_vars
└── all
    └── vars.yml

Inventory layout 2: multiple environments, multiple customers or deployments¶

Consider the following inventory layout:

inventory/
├── customer1
│   ├── group_vars
│   │   ├── all
│   │   │   └── vars.yml
│   │   ├── nginx_webservers
│   │   │   └── vars.yml
│   │   ├── prod
│   │   │   └── vars.yml
│   │   ├── qa
│   │   │   └── vars.yml
│   │   └── uat
│   │       └── vars.yml
│   ├── hosts-prod
│   ├── hosts-qa
│   └── hosts-uat
├── customer2
│   ├── group_vars
│   │   ├── all
│   │   │   └── vars.yml
│   │   ├── nginx_webservers
│   │   │   └── vars.yml
│   │   ├── prod
│   │   │   └── vars.yml
│   │   ├── qa
│   │   │   └── vars.yml
│   │   └── uat
│   │       └── vars.yml
│   ├── hosts-prod
│   ├── hosts-qa
│   └── hosts-uat
└── customer3
    ├── group_vars
    │   ├── all
    │   │   └── vars.yml
    │   ├── nginx_webservers
    │   │   └── vars.yml
    │   ├── prod
    │   │   └── vars.yml
    │   ├── qa
    │   │   └── vars.yml
    │   └── uat
    │       └── vars.yml
    ├── hosts-prod
    ├── hosts-qa
    └── hosts-uat
group_vars
└── all
    └── vars.yml

It is pretty much the same as the last example of the multiple environments section, just adding another folder. At the end of the day the decision of the type of inventory layout will depend on the actual problem you’re trying to solve. Just keep in mind that this is very flexible, and that the variable precedence levels can come very handy.

For our purposes we’ll keep using the simple layout: a single environment:

inventory
├── group_vars
│   ├── all
│   │   └── vars.yml
│   └── nginx_webservers
│       └── vars.yml
└── hosts
group_vars
└── all
    └── vars.yml

Let’s talk about secrets now!

Encrypt a file¶

ansible-vault encrypt path/to/file

Decrypt file¶

ansible-vault decrypt path/to/file

• We will enable simple HTTP authentication in our nginx server
• We will create a vault file to create a variable that will hold the password
• We will encrypt that vault file so it’s safely stored in the repository

Run playbook using the usual command¶

Command:

(.venv) ansible_2 $ ansible-playbook -i inventory/hosts.ini webservers.yml

The output should be an error similar to the following:

PLAY [all] **************************************************************************************
ERROR! Attempting to decrypt but no vault secrets found

Run playbook asking for the vault password¶

Command:

(.venv) ansible_2 $ ansible-playbook -i inventory/hosts.ini webservers.yml --ask-vault-pass

Now Ansible will prompt for the vault password. After providing the password, now try to access the local nginx webserver http://10.100.0.2. It should prompt using the basic HTTP authentication dialog box (credentials are admin:admin), similar to this one:

Nginx basic HTTP auth

Run using a file with the vault password in it¶

Create a file and store the password in it:

(.venv) ansible_2 $ echo "vaultpassword" > vaultPasswordFile

Run the playbook specifying the file:

(.venv) ansible_2 $ ansible-playbook -i inventory/hosts.ini webservers.yml --vault-password-file ./vaultPasswordFile

The playbook should run successfully.

Run using the vault password file environment variable¶

Export the location of the password file as an environment variable:

(.venv) ansible_2 $ export ANSIBLE_VAULT_PASSWORD_FILE=$( pwd )/vaultPasswordFile

Run the playbook without specifying the vault password file:

(.venv) ansible_2 $ ansible-playbook -i inventory/hosts.ini webservers.yml

The playbook should run successfully.

(.venv) ansible_2 $ ANSIBLE_VAULT_PASSWORD_FILE=$( pwd )/vaultPasswordFile ansible-playbook -i inventory/hosts.ini webservers.yml