Ansible pour le cloud

PHP Tour Luxembourg 12/05/15

Maxime Thoonsen

@maxthoon

Ansible est un framework d'automatisation de tâches

Ansible est simple

Sans agent à installer

Local

Serveur distant

Commande Ansible

Modules de bases

apt, template, shell, ...
mongodb, mysql, ...

Ecrire du Ansible

YAML

Template en jinja2 (Twig)

Un script Ansible

hosts/

roles/

vars/

playbook.yml

Playbook

---
- name: Symfony app
  hosts: all
  vars_files:
    - vars/main.yml
    - vars/fail2ban.yml
    - vars/iptables.yml
  sudo: yes
  roles:
    - common       
    - { role: ANXS.mysql, tags: mysql  } 
    - nginx-symfony
    - php
    - composer
    - nickjj.fail2ban
    - Stouts.iptables

Un script Ansible

hosts/

roles/

vars/

playbook.yml

Rôle

Rôle

roles/mysql/
          defaults/
          handlers/
          tasks/
          template/

• Nom
• Module

Tâche

Tâche + Condition

Handlers

roles/mysql/
          defaults/
          handlers/
          tasks/
          template/

Tâche + Handler

Les variables

hosts/

roles/

vars/

playbook.yml

Les variables

roles/mysql/
          defaults/
          handlers/
          tasks/
          template/

Les variables

Tâche + Variables

- name: Ensure PHP packages are installed
  apt: name={{ item }} state=installed
  with_items: php_packages

- name: Create mods-available directory
  file:
    path={{ php_conf_basepath }}/mods-available
    state=directory

Rôle

mysql/
      defaults/
      handlers/
      tasks/
      template/

Tâche + Template

- name: add server main conf
  template: 
    src=etc/nginx/conf.d/conf 
    dest=/etc/nginx/conf.d/main.conf
  notify: restart-nginx

Template

Modules natifs pour IAAS

Modules de gestion de VM

# Amazon Elastic Compute Cloud
# création de 3 VMs ubuntu
- ec2:
    key_name: mykey
    instance_type: t2.micro
    image: ubuntu-1204-lts
    wait: yes
    group: webserver
    count: 3
    assign_public_ip: yes

Modules de gestion de VM

# Openstack
# Assign a floating ip to the instance

- quantum_floating_ip: 
    login_username=admin 
    login_password=admin
    login_tenant_name=admin 
    network_name=external_network
    instance_name=vm1

Les serveurs

hosts/

roles/

vars/

playbook.yml

Inventaires

#groupe
[paris]
75.0.0.1
75.0.0.2

[bretagne]
22.22.22.22
29.29.29.29

#groupe de groupes
[france:children]
paris
bretagne

Variables serveur/groupe

---
#hosts/host_var/bretagne

serveur_name: prod.bzh
mysql_pwd: crepes

Ansible vault

Heartbleed

Heartbleed

- hosts: france
  sudo: yes
  tasks:
    - name: Update OpenSSL and OpenSSH (Debian)
      apt: name={{ item }} state=latest update_cache=yes
      with_items:
        - openssl
        - openssh-client
        - openssh-server

  post_tasks:
    - name: Reboot servers
      command: reboot

Ansible Tower

Ansible Tower

Vagrantfile

# Ansible
  config.vm.provision "ansible" do |ansible|
    ansible.sudo = true
    ansible.playbook = "provision/playbook.yml"
    ansible.limit = "vagrant" # hosts group
    ansible.inventory_path = "provision/hosts/vagrant"
    ansible.verbose = "v" #Use vvvv to get more log
  end

Gestion de l'OS du serveur

Gérer les containers

Module de base Docker

# Ensure that a data container
# with the name "mydata" exists.

- name: data container
  docker:
    name: mydata
    image: busybox
    state: present
    volumes:
    - /data

Ansible in Dockerfile

#Sécurité
FROM ubuntu

COPY ./symfony-ansible /ansible

RUN install_ansible.sh
 
RUN ansible-playbook -i "localhost," \
    -c local /ansible/provisioning/playbook.yml
    
CMD ["start.sh"]

Démarrez maintenant !

Rejoignez nous !

fansible