Implementing Roles
Implementing Roles
Roles are Collection of playbooks and supporting items arranged in
a specific structure for easy sharing, portability, and reuse.
Ansible roles allow administrators to organize their playbooks into
separate, smaller playbooks and files. So it can be developed in
parallel by different administrators
Roles provide Ansible with a way to load tasks, handlers, variables,
static files and templates in a specific structure.
Roles can be written so they are general purpose and can be reused.
Roles make larger projects more manageable
The files that define a role have specific names and are organized in
a rigid directory structure, which will be discussed later.
$ tree roles/motd-role
roles/motd-role
Paths for Roles
By default ansible looks for role in below path
Implementing Roles
# ansible-config dump | grep roles
DEFAULT_ROLES_PATH(default) = ['/home/student/.ansible/roles',
'/usr/share/ansible/roles', '/etc/ansible/roles']
in it.
# mkdir roles
# grep roles_path ~/.[Link]
roles_path=/tmp/roles
# ansible-config dump | grep roles
DEFAULT_ROLES_PATH(/home/student/.[Link]) = ['/tmp/roles']
Creating Roles
To create roles we can either manually create all the structure.
We can create raw structure by using ansible-galaxy. And later we
can configure it as per requirement. We can list, create, install or
uninstall the roles by using ansible-galaxy.
# ansible-galaxy list
# ansible-galaxy list -p roles
# ansible-galaxy init roles/banner-role
Implementing Roles
Role Subdirectories
Banner Role
# tree roles/banner-role/
roles/banner-role/
Implementing Roles
ars
# cat roles/banner-role/files/[Link]
*********************************************************
* *
* *
* You are accessing restricted server *
* Your actions are being monitored *
* It will be reported to system owner *
* *
* *
* *
* *
*********************************************************
# cat roles/banner-role/handlers/[Link]
---
# handlers file for roles/banner-role
- name: restart sshd
service:
name: sshd
state: reloaded
# grep -v "\#" roles/banner-role/meta/[Link]
galaxy_info:
Implementing Roles
author: linux2cloud
description: To configure banner
company: Linux2Clud
license: license (GPL-2.0-or-later, MIT, etc)
min_ansible_version: 2.4
galaxy_tags: []
dependencies:
- motd-role
# cat roles/banner-role/[Link]
Role Name
=========
Configure Banner
Requirements
------------
It is a basic module to configure [Link] and /etc/motd
Role Variables
--------------
Variables are defined in default/[Link]
Dependencies
------------
No dependencies for this role
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables
passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- banner-role
License
-------
BSD
Author Information
------------------
Implementing Roles
For any feedback contact at info@[Link]
# cat roles/banner-role/tasks/[Link]
- name: Creating [Link] file
copy:
src: [Link]
dest: /etc/[Link]
owner: root
group: root
backup: yes
# cat roles/banner-role/tasks/[Link]
- name: Configure sshd
lineinfile:
dest: /etc/ssh/sshd_config
insertafter: "Banner"
line: "Banner /etc/[Link]"
state: present
create: yes
backup: yes
notify:
- restart sshd
# cat roles/banner-role/tasks/[Link]
---
# tasks file for roles/banner-role
- include: [Link]
- include: [Link]
MOTD Role
# cat roles/motd-role/defaults/[Link]
---
# defaults file for roles/motd-role
system_owner: root@[Link]
Implementing Roles
# cat roles/motd-role/tasks/[Link]
- name: Update /etc/motd template
template:
src: motd.j2
dest: /etc/motd
owner: root
group: root
mode: 0644
# cat roles/motd-role/tasks/[Link]
---
# tasks file for roles/motd-role
- include: [Link]
# cat roles/motd-role/templates/motd.j2
This is the system {{ ansible_facts['fqdn'] }}.
This is a {{ ansible_facts['distribution'] }} version {{
ansible_facts['distribution_version'] }} system.
Only use this system with permission.
You can request access from {{ system_owner }}.
System total memory: {{ ansible_facts['memtotal_mb'] }} MiB. System
processor count: {{ ansible_facts['processor_count'] }}
Ansible Roles in playbook
# cat [Link]
---
- name: Configure MOTD and [Link]
hosts: remote
Implementing Roles
roles:
- motd-role
- banner-role
Creating Role Dependencies
Once we set dependencies then that roles does not need to call in
playbook, however it should be present in location of role
# grep -v "\#" roles/banner-role/meta/[Link]
galaxy_info:
author: linux2cloud
description: To configure banner
company: Linux2Clud
license: license (GPL-2.0-or-later, MIT, etc)
min_ansible_version: 2.4
galaxy_tags: []
dependencies:
- motd-role
# cat [Link]
---
- name: Configure Banner
hosts: remote
roles:
- banner-role
# ansible-playbook [Link]
# mv /tmp/motd-role/ roles/
Implementing Roles
Variables for Roles
Variables can be locally called in playbook for roles
# cat [Link]
---
- name: Configure MOTD and [Link]
hosts: remote
roles:
- role: motd-role
system_owner: user1@[Link]
Another approach to call variable
# cat [Link]
---
- name: Configure MOTD and [Link]
hosts: remote
roles:
- { role: motd-role, system_owner: user2@[Link] }
Multiple role can be called within playbook with there variables
# cat [Link]
---
- name: Configure MOTD and [Link]
Implementing Roles
hosts: remote
roles:
- role: banner-role
- { role: motd-role, system_owner: user2@[Link] }
Controlling Order Of Execution
When role is added in playbook then it executed first then other
tasks in playbook.
But sometime we need to execute some task before the execution
of role like creating repository. So we can control the order of
execution by using pre_tasks and post_tasks.
# cat [Link]
---
- name: Control the order
hosts: mn-node1
pre_tasks:
- name: Configure repository
yum_repository:
name: baseos
baseurl: [Link]
gpgcheck: 0
description: "Create by Ansible"
roles:
- motd-role
post_tasks:
- name: call handler
user:
name: testaccount
state: present
Using Roles as a Task
Implementing Roles
We can use the roles in playbook for a certain task by using
---
- name: Configure Web server
hosts: mn-node1
tasks:
- name: Start Firewall
service:
name: firewalld
state: started
enabled: true
- name: Configure httpd
include_role:
name: httpd-role
- name: Add port in firewall
firewalld:
service: http
state: enabled
immediate: true
permanent: true
Create httpd-role
# cat roles/httpd-role/handlers/[Link]
---
# handlers file for roles/httpd-role
- name: restart httpd
service:
name: httpd
state: restarted
Implementing Roles
# cat roles/httpd-role/tasks/[Link]
---
- name: Install package
yum:
name: "{{ web_req }}"
state: latest
# cat roles/httpd-role/tasks/[Link]
---
- name: Start service
service:
name: "{{ web_req }}"
state: started
enabled: true
# cat roles/httpd-role/tasks/[Link]
---
- name: Configure httpd
template:
src: httpd.j2
dest: "{{ conf_path }}/[Link]"
owner: root
group: root
mode: 0644
notify:
- restart httpd
- name: Copy index file
template:
src: index.j2
dest: "{{ document_root }}/[Link]"
mode: 0644
# cat roles/httpd-role/tasks/[Link]
- name: Print infromation
debug:
msg:
Implementing Roles
- Orignal website is available on [Link] ansible_facts['hostname']
}}
- Add entry in /etc/hosts file if it is not resolve by dns - {{
ansible_facts['default_ipv4']['address'] }} {{ ansible_facts['hostname']
}}
# cat roles/httpd-role/tasks/[Link]
---
# tasks file for roles/httpd-role
- include: [Link]
- include: [Link]
- include: [Link]
- include: [Link]
# cat roles/httpd-role/templates/httpd.j2
<VirtualHost *:80>
ServerAdmin admin@{{ ansible_facts['hostname'] }}
DocumentRoot /var/www/html
ServerName {{ ansible_facts['hostname'] }}.[Link]
ErrorLog "/var/log/httpd/{{ ansible_facts['hostname'] }}-error_log"
CustomLog "/var/log/httpd/{{ ansible_facts['hostname'] }}-access_log"
common
</VirtualHost>
# cat roles/httpd-role/templates/index.j2
<h1><center> {{ ansible_facts['fqdn'] }} {{
ansible_facts['default_ipv4']['address'] }} </center></h1>
Ansible Galaxy
Ansible Galaxy [[Link] is a public library of
Ansible roles written by a variety of Ansible administrators and
users.
Implementing Roles
It is an archive that contains thousands of Ansible roles and it has a
searchable database that helps Ansible users identify roles that
might help them accomplish an administrative task.
Ansible Galaxy includes links to documentation and videos for new
Ansible users and role developers.
It use to search/install roles online from [Link]
# ansible-galaxy search "samba" --platform EL
Get information about module
# ansible-galaxy info [Link]
Install role from [Link]
# ansible-galaxy install [Link]
Install role from online in specific path
# ansible-galaxy install [Link] -p roles/
Include roles in playbook
---
- name: Configure SAMBA
hosts: mn-node1
roles:
- [Link]
tasks:
Implementing Roles
- name: Add in firewall
firewalld:
service: "{{ item }}"
state: enabled
immediate: true
permanent: true
loop:
- samba
- samba-client
To remove module
# ansible-galaxy remove [Link]
Installing vsftpd role
# ansible-galaxy install [Link]
# cat [Link]
---
- name: Configure VSFTPD
hosts: mn-node1
tasks:
- name: Configure vfstpd
include_role:
name: vsftpd
- name: Add in firewall
firewalld:
service: "{{ item }}"
state: enabled
immediate: true
permanent: true
loop:
- ftp
Implementing Roles
Install hardening role
# ansible-galaxy install [Link]-hardening
Note In older version if we do not us -- by
default it always hit to internet ([Link]) to install the
modules. So to create offline roles
# ansible-galaxy init --offline [Link]
We can disable this feature - we need to comment one line in
ansible version 2.0, but from above of this version we do not need to
set in file. Below is the changes. Coment these lines
Sharing and installing roles
To share or store the role, we need create tar ball (optionally
compress)
# tar -cvzf /tmp/[Link] roles/banner-role/
To install the roles from local source.
# cat [Link]
---
- name: motd-role
src: [Link]
# ansible-galaxy install -p roles -r [Link]
To install the roles from remote location.
Implementing Roles
cat [Link]
---
# Install from remote httpd server
- name: motd-role
src: [Link]
To install roles placed on git.
# Install from git
- name: motd-role
src: [Link]
scm: git
version: roles
Installing RHEL Roles
Install RHEL System Roles.
# yum install rhel-system-roles
# ansible-galaxy list
After installation, the RHEL System roles are located in the
/usr/share/ansible/roles
Documents will be available in /usr/share/doc/rhel-system-roles-1.0/
Note: If we do not have subscription we can download and install the
package
[Link]
Defines the time synchronization variables overriding the role
defaults and then we can use the roles in a playbook. We can read
detail about module and playbook in below location
# cat /usr/share/ansible/roles/[Link]/[Link]
vars:
timesync_ntp_servers:
- hostname: [Link]
iburst: yes
- hostname: [Link]
Implementing Roles
iburst: yes
- hostname: [Link]
iburst: yes
roles:
- [Link]
# cat [Link]
---
- name: Configure NTP Client
hosts: mn-node1
vars:
timesync_ntp_servers:
- hostname: cm-node1
timezone: UTC
roles:
- [Link]
tasks:
- name: Set timezone
timezone:
name: "{{ timezone }}"
Configure Window as managed host
Install pywinrm plugins on controle node
$ pip3 install --user pywinrm
Set inventory file for window with credentials
[winhost]
[Link]
[winhost:vars]
ansible_user=deepak
ansible_password=redhat
Implementing Roles
ansible_connection=winrm
ansible_winrm_server_cert_validation=ignore
Change network adapter properties to private or in domain in place
of public
Open PowerShell IDE with Admin and create a executable *.ps1 file
to start and enable winrm on window host and save at some
location
[Link]
20acd7143fddbf33ea5f/examples/scripts/ConfigureRemotingForAnsible.ps1
Open PoweShell with Admin. Execute the script. First script
execution need to enable on powershell
Set-ExecutionPolicy RemoteSigned
.\ ConfigureRemotingForAnsible.ps1
Check connectivity from Control Host
# ansible winhost -m win_ping
Playbook to create user on window host
---
- name: Create user
hosts: winhost
tasks:
- name: create user
win_user:
name: user1
fullname: Test User
password: redhat
Implementing Roles
Lab
you will create two roles that use variables and parameters:
myvhost and myfirewall.
The myvhost role will install and configure the Apache service on a
host. The role will include fixed files, templates, tasks, and
handlers. A dependency will be created later, so it should have a
meta subdirectory. A template is provided that will be used for
/etc/httpd/conf.d/[Link]: [Link].j2.
# {{ ansible_managed }}
<VirtualHost *:80>
ServerAdmin webmaster@{{ ansible_fqdn }}
ServerName {{ ansible_fqdn }}
ErrorLog logs/{{ ansible_hostname }}-[Link]
CustomLog logs/{{ ansible_hostname }}-[Link] common
DocumentRoot /var/www/vhosts/{{ ansible_hostname }}/
</VirtualHost>
Create the [Link] file in the tasks subdirectory of the role. The
role should perform four tasks:
o Install the httpd package.
o Start and enable the httpd service.
o Install the template configuration file that configures the
webserver.
o Create the handler for restarting the httpd service. Use a text
editor to create a file called roles/myvhost/handlers/[Link].
Include code to use the service module
The myfirewall role installs, enables, and starts the firewalld
daemon. It opens the firewall service port specified by the
firewall_service variable.
Create the [Link] file in the tasks subdirectory of the role. The
role should perform three tasks:
o Install the firewalld package.
o Start and enable the firewalld service.
o Open a firewall service port.