Ansible on Ricky

Windows SSH Setup

Tue, 03 Jan 2023 12:36:00 +0800

The default shell is cmd. The docs say to change the ansible_shell_type variable if needed. This should be set as a host variable in inventory: ansible_shell_type, with value cmd or powershell.
Add the ansible_connection host variable in inventory to indicate SSH connections. (192.168.192.11 ansible_user=Administrator ansible_connection=ssh ansible_shell_type=cmd )
You may need to add remote_tmp in ansible.cfg and set it to C:\TEMP.
In playbooks, use modules prefixed with win_, or use the raw module.

Convert Command Output to an Image

Thu, 10 Nov 2022 16:13:04 +0800

Convert Command Output to an Image

---
- name: Capture command output and convert to image
 hosts: all

 tasks:
 - name: Display content of /etc/redhat-release
 shell: cat /etc/redhat-release
 register: redhat_release_result

 - name: hostname
 shell: hostname
 register: hostname_result

 # You can use ImageMagick to convert text to an image
 - name: Convert command output as image
 shell: echo -e "{{ hostname_result.stdout }}\n{{ redhat_release_result.stdout }}" | convert label:@- {{ hostname_result.stdout }}.png
 delegate_to: localhost

LVM - lvg and lvol

Mon, 05 Sep 2022 15:32:05 +0800

LVM - lvg and lvol

volume group

- name: 在 /dev/sda1 跟 /dev/sdb1 之上建立 volume group，其 extend size 設置為 32MB
 community.general.lvg:
 vg: vg.services
 pvs: /dev/sda1,/dev/sdb1
 pesize: 32

local volume

- name: 建立一個大小為 512m 的 local volume
 community.general.lvol:
 vg: firefly
 lv: test
 size: 512

Example

---
- name: Create LVM for DRBD
 hosts: all
 become: yes

 vars:
 vg_name: drbdpool

 tasks:
 - name: Create a new primary partition for LVM
 community.general.parted:
 device: /dev/sdb
 number: 1
 align: optimal
 flags: [lvm]
 state: present

 - name: Create a volume group on top of /dev/sda1 with physical extent size = 32MB
 community.general.lvg:
 vg: "{{ vg_name }}"
 pvs: /dev/sdb1
 state: present

 - name: Create a logical volume
 community.general.lvol:
 vg: "{{ vg_name }}"
 lv: drbddata
 size: 100%FREE

What to Do With Long Strings in YAML?

Mon, 29 Aug 2022 15:01:40 +0800

What to Do With Long Strings in YAML?

YAML already defines this. In this case, there are four methods:

|: Newlines under it are preserved as newlines, and the last line ends with a newline.
>: Newlines under it are folded into spaces, forming a long string, and the last line ends with a newline.
|-: Newlines under it are preserved, but the last line does not end with a newline.
>-: Newlines under it are folded into spaces, and the last line does not end with a newline.

In short, > and >- improve YAML readability without adding extra newline characters. | and |- keep the string exactly as defined: if you see a newline in YAML, the string contains a newline.

Convert a List to a List of Dicts

Wed, 09 Mar 2022 11:26:23 +0800

Convert a List to a List of Dicts

list

my_users:
 - aaa
 - bbb
 - ccc

dict

my_users:
 - Name: aaa
 - Name: bbb
 - Name: ccc

playbook

- name: Transform data
 vars:
 orig_users:
 - aaa
 - bbb
 - ccc
 my_users: []
 set_fact:
 my_users: "{{ my_users + [{} | combine({'Name': item})] }}"
 loop: "{{ orig_users }}"

Explanation:

Use the combine filter to build a dict
Use loop to iterate orig_users
Use my_users + [{} | combine({‘Name’: item})] to append to the list```

Misspelling, missing collection, or incorrect module path for fortios_system_config_backup_restore

Thu, 06 Jan 2022 13:40:40 +0800

Misspelling, missing collection, or incorrect module path for fortios_system_config_backup_restore

issue

Hi,

I’m trying to retrieve the configuration from a Fortigate using the module fortios_system_config_backup_restore and basing on your playbook example.

I have ansible 2.10.6.

When I use the collection fortinet.fortios:1.1.8, I got the following error: missing 1 required positional argument: 'mod'

The full traceback is:
Traceback (most recent call last):
 File "/home/ansible/.ansible/tmp/ansible-local-8668osvgufxk/ansible-tmp-1615481963.0092971-8768-3877705280026/AnsiballZ_fortios_system_config_backup_restore.py", line 102, in <module>
 _ansiballz_main()
 File "/home/ansible/.ansible/tmp/ansible-local-8668osvgufxk/ansible-tmp-1615481963.0092971-8768-3877705280026/AnsiballZ_fortios_system_config_backup_restore.py", line 94, in _ansiballz_main
 invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)
 File "/home/ansible/.ansible/tmp/ansible-local-8668osvgufxk/ansible-tmp-1615481963.0092971-8768-3877705280026/AnsiballZ_fortios_system_config_backup_restore.py", line 40, in invoke_module
 runpy.run_module(mod_name='ansible_collections.fortinet.fortios.plugins.modules.fortios_system_config_backup_restore', init_globals=None, run_name='__main__', alter_sys=True)
 File "/usr/lib/python3.8/runpy.py", line 207, in run_module
 return _run_module_code(code, init_globals, run_name, mod_spec)
 File "/usr/lib/python3.8/runpy.py", line 97, in _run_module_code
 _run_code(code, mod_globals, init_globals,
 File "/usr/lib/python3.8/runpy.py", line 87, in _run_code
 exec(code, run_globals)
 File "/tmp/ansible_fortinet.fortios.fortios_system_config_backup_restore_payload_mplamrs7/ansible_fortinet.fortios.fortios_system_config_backup_restore_payload.zip/ansible_collections/fortinet/fortios/plugins/modules/fortios_system_config_backup_restore.py", line 472, in <module>
 File "/tmp/ansible_fortinet.fortios.fortios_system_config_backup_restore_payload_mplamrs7/ansible_fortinet.fortios.fortios_system_config_backup_restore_payload.zip/ansible_collections/fortinet/fortios/plugins/modules/fortios_system_config_backup_restore.py", line 436, in main
TypeError: __init__() missing 1 required positional argument: 'mod'
fatal: [fortigate-01]: FAILED! => {
 "changed": false,
 "module_stderr": "Traceback (most recent call last):\n File \"/home/ansible/.ansible/tmp/ansible-local-8668osvgufxk/ansible-tmp-1615481963.0092971-8768-3877705280026/AnsiballZ_fortios_system_config_backup_restore.py\", line 102, in <module>\n _ansiballz_main()\n File \"/home/ansible/.ansible/tmp/ansible-local-8668osvgufxk/ansible-tmp-1615481963.0092971-8768-3877705280026/AnsiballZ_fortios_system_config_backup_restore.py\", line 94, in _ansiballz_main\n invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n File \"/home/ansible/.ansible/tmp/ansible-local-8668osvgufxk/ansible-tmp-1615481963.0092971-8768-3877705280026/AnsiballZ_fortios_system_config_backup_restore.py\", line 40, in invoke_module\n runpy.run_module(mod_name='ansible_collections.fortinet.fortios.plugins.modules.fortios_system_config_backup_restore', init_globals=None, run_name='__main__', alter_sys=True)\n File \"/usr/lib/python3.8/runpy.py\", line 207, in run_module\n return _run_module_code(code, init_globals, run_name, mod_spec)\n File \"/usr/lib/python3.8/runpy.py\", line 97, in _run_module_code\n _run_code(code, mod_globals, init_globals,\n File \"/usr/lib/python3.8/runpy.py\", line 87, in _run_code\n exec(code, run_globals)\n File \"/tmp/ansible_fortinet.fortios.fortios_system_config_backup_restore_payload_mplamrs7/ansible_fortinet.fortios.fortios_system_config_backup_restore_payload.zip/ansible_collections/fortinet/fortios/plugins/modules/fortios_system_config_backup_restore.py\", line 472, in <module>\n File \"/tmp/ansible_fortinet.fortios.fortios_system_config_backup_restore_payload_mplamrs7/ansible_fortinet.fortios.fortios_system_config_backup_restore_payload.zip/ansible_collections/fortinet/fortios/plugins/modules/fortios_system_config_backup_restore.py\", line 436, in main\nTypeError: __init__() missing 1 required positional argument: 'mod'\n",
 "module_stdout": "",
 "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
 "rc": 1
}

Using the recent pre release fortinet.fortios:2.0.0 , I got:

[Community] Cisco UCS CIMC series

Thu, 15 Jul 2021 17:16:52 +0800

ansible.builtin.slurp - read file content

Mon, 31 May 2021 17:15:04 +0800

ansible.builtin.slurp - read file content

---
- name: Use HTTP POST to upload file
 hosts: all

 tasks:
 - name: Read binary file content
 slurp:
 path: "/bin/ls"
 register: bin_file

 - name: Send HTTP POST Request
 uri:
 url: "https://your_server/upload.php"
 headers:
 Accept: "application/json"
 Content-Type: "application/octet-stream"
 method: POST
 validate_certs: false
 body: "{{ bin_file.content }}"
 status_code:
 - 200
 - 201
 register: upload_result

 - name: Display upload_result
 debug:
 var: upload_result

Using slurp avoids the limitations of lookup(‘file’).

You can read files on managed hosts, or use delegate_to: localhost to read files on the controller.
You can read binary files for further processing, such as base64 encoding.

New LibSSH Connection Plugin for Ansible Network Replaces Paramiko, Adds FIPS Mode Enablement

Wed, 25 Nov 2020 21:09:50 +0800

New LibSSH Connection Plugin for Ansible Network Replaces Paramiko, Adds FIPS Mode Enablement

Switching Ansible Playbooks to use LibSSH

# Installing LibSSH
pip install ansible-pylibssh

Using LibSSH in Ansible Playbooks

Method 1. The ssh_type configuration parameter can be set to use libssh in the active ansible.cfg file of your project

[persistent_connection]
ssh_type = libssh

Method 2: Set the ANSIBLE_NETWORK_CLI_SSH_TYPE environment variable

$ export ANSIBLE_NETWORK_CLI_SSH_TYPE=libssh

Method 3: Set the ansible_network_cli_ssh_type parameter to libssh within your playbook at the play level

Backup FortiOS config with Ansible - with RestAPI

Tue, 03 Nov 2020 17:59:24 +0800

Create access profile

FGTAWS0004BE1ADE # config system accprofile
FGTAWS0004BE1ADE (accprofile) # edit readOnly
new entry 'readOnly' added
FGTAWS0004BE1ADE (readOnly) # set sysgrp read
FGTAWS0004BE1ADE (readOnly) # end

Create API user in Fortigate

FGTAWS0004BE1ADE # config system api-user
FGTAWS0004BE1ADE (api-user) # edit api-admin
new entry 'api-admin' added
FGTAWS0004BE1ADE (api-admin) # set accprofile "readOnly"
FGTAWS0004BE1ADE (api-admin) # set vdom root
FGTAWS0004BE1ADE (api-admin) # config trusthost
FGTAWS0004BE1ADE (trusthost) # edit 1
new entry '1' added
FGTAWS0004BE1ADE (1) # set ipv4-trusthost 'ip_address_of_your_machine' 255.255.255.255
FGTAWS0004BE1ADE (1) # end
FGTAWS0004BE1ADE (api-admin) # end

Generate API token

FGTAWS0004BE1ADE # execute api-user generate-key api-admin
New API key: 'your_api_token'
NOTE: The bearer of this API key will be granted all access privileges assigned to the api-user api-admin.

Test

# fortigate.py
import requests
import urllib3 # disable security warning for SSL certificate
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) # disable security warning for SSL certificate


def config_download(ipaddr, api_token, filename='backup.conf'):
 '''
 input: ipaddr(string) - target ip address of fortigate
 input: api_token(string) - api_token for api user(accprofile should have sysgrp.mnt)
 input: filename(string) - file name of the config to be saved. default backup.conf
 output: True if backup successfule. False if not successful.
 Tested on: Fortigate OnDemand on AWS - FortiOS6.0.4
 '''
 base_url = f'https://{ipaddr}/api/v2/'
 headers = {'Authorization': f'Bearer {api_token}'}
 params = {'scope': 'global'}
 uri = 'monitor/system/config/backup/'

 rep = requests.get(base_url + uri, headers=headers, params=params, verify=False)

 if rep.status_code != 200:
 print(f'Something went wrong. status_code: {rep.status_code}')
 return False

 with open(filename, 'w') as f:
 f.write(rep.text)

 return True

>>> import fortigate
>>>
>>> ip_addr = 'Fortigate_IP_Address'
>>> api_token = 'API_TOKEN'
>>>
>>> if (fortigate.config_download(ip_addr, api_token, 'backup20190215.conf')):
... print('Done!')
... else:
... print('Error!!')
...
Done!
>>>
>>> with open('backup20190215.conf', 'r') as f:
... f.readline()
...
'#config-version=FGTAWS-6.0.4-FW-build0231-190107:opmode=0:vdom=0:user=api-admin\n'
>>>

Configure Ansible inventory and playbook

$ cat hosts
[fortigate]
x.x.x.x access_token=w4q9qtfbGry3Nbc40kHjsk9mxG****
y.y.y.y access_token=tfy8c9b8Nxw6N3Q5Q5bg9z69dn****

$ cat fortigate_backup.yml
 - name: fortigate config backup
 connection: local
 hosts: fortigate

 tasks:
 - name: get current config
 uri:
 url: 'https://{{ ansible_host }}/api/v2/monitor/system/config/backup/?scope=global&access_token={{ access_token }}'
 return_content: yes
 validate_certs: no
 register: current_config

 - name: write config to local file
 local_action: copy content={{ current_config.content }} dest=./{{ inventory_hostname }}_{{ ansible_date_time.date }}.txt

Ansible Introduction

Sat, 26 Sep 2020 16:57:21 +0800

Getting to know Ansible.

Introduction

安裝部署工具、設定管理工具等
同類型工具：Chef、Puppet、SaltStack
不需要 Agent、透過 ssh
Linux 有 python 即可 ( ssh port )
Win 啟用 winrm 即可 ( 5986 port )
- https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html#inventory-options
資料夾結構簡單易懂、官方文件豐富易懂、模組多支援設備多、易撰寫

Install

pip install ansible
- pip3 install ansible
yum install ansible
apt-get install ansible
apk add ansible

Common modules

Common modules - ping

Abount Ansible Hosts

Tue, 12 May 2020 19:46:04 +0800

# hosts 可以這樣寫

$ ansible 'max-compute[!3:9][0:3][0:3]' -m setup --list-hosts
 hosts (4):
 max-compute10
 max-compute13
 max-compute20
 max-compute23
$ ansible 'max-compute[!3:9][0:4][0:4]' -m setup --list-hosts
 hosts (3):
 max-compute10
 max-compute14
 max-compute20
$ ansible 'max-compute[!0:3]' -m setup --list-hosts
 hosts (6):
 max-compute4
 max-compute5
 max-compute6
 max-compute7
 max-compute8
 max-compute9

plugin: gcp_compute
projects:
 - project-XXX
zones:
 - asia-east1-a
 - asia-east1-c
 - asia-east1-b
 - asia-east2-a
 - asia-east2-c
 - asia-east2-b
auth_kind: serviceaccount
service_account_file: /root/.ssh/sa001.json
filters:
 - status="RUNNING"
hostnames:
 - name
groups:
 nginx: "'nginx' in name"
 cassandra: "'cassandra' in name"
 redis: "'redis' in name"
 misc: "name in ('noc', 'mt-center')"
 prod: "'prod' in name and 'gke' not in name"
 all: "'gke' not in name"
 search: "'search' in name"

cht_domain:
 "{{ 'web.qat.cht' if ansible_default_ipv4['network'] == '192.168.40.0'
 else 'ap.qat.cht' if ansible_default_ipv4['network'] == '192.168.50.0'
 else 'db.qat.cht' if ansible_default_ipv4['network'] == '192.168.60.0'
 else 'qat.cht' }}"

string field was converted to True (type string)

Wed, 15 Apr 2020 21:34:09 +0800

Cannot set command timeout per task with network_cli

Tue, 14 Jan 2020 16:34:03 +0800

- name: run command
 ios_command:
 commands:
 - show version
 vars:
 ansible_command_timeout: 40

Trellis Ansible Bad Interpreter Error

Fri, 06 Dec 2019 22:34:31 +0800

Trellis Ansible Bad Interpreter Error

Bad Interpreter Error

Error we got using Ansible was a bad interpreter error. Python 2.7 is not to be found:

zsh: /usr/local/bin/ansible-vault: bad interpreter: /usr/local/opt/python@2/bin/python2.7: no such file or directory

And that was correct because when we checked /usr/local/opt we only had Python 3.

Installation Python 2

brew install python@2

Python Crashing Hard

Next, on Ansible version check I got another error

➜ trellis git:(master) ansible --version
[1] 19153 abort ansible --version

It was somehow crashing Python 2.7 though it should just work with it. I decided to upgrade Ansible as well

Jinja docx template, avoiding new line in nested for

Tue, 29 Oct 2019 10:17:35 +0800

Jinja docx template, avoiding new line in nested for