PING Philly Meetup 2014-03-13

http://www.meetup.com/PING-Philly/events/159013012/

Transcript

1. Ansible Beyond Configuration Management Alexander Popov Solution Architect, CSC alexanderpopov1@gmail.com
2. Hello I grew up in Kazakhstan…
3. kɑːzəkˈstɑːn Yes, it’s a real country
4. No, I’ve never met this guy
5. • I am also a programmer • Indian food and Earl Grey tea addict • Aspiring tree house builder
6. • I am not a sysadmin • Linux isn’t my middle name • I find myself googling “mkdir –p” occasionally • I’m secretly envious of guys who can do: #!/bin/sh echo "fs.file-max=20000" | sudo tee -a /etc/sysctl.conf sudo apt-get -y install build-essential postgresql-9.2 sudo apt-get -y install apache2 sudo a2enmod rewrite sudo tee /etc/apache2/sites-available/mysite <<ENDOFFILE <VirtualHost *:80> Include /etc/apache2/sites-available/mysite-common </VirtualHost> ENDOFFILE in their sleep • I found out devops isn’t something run by Blackwater only last September • So, why am I here ?!?
7. Because I have been looking for • An easier way to deliver my solution to the market • Repeatable, idempotent way to provision an environment, configure OS, deploy my applications, run my test suite and go home.
8. Yes, I am aware of • CFEngine, Cobbler, Func, Pallet, Fabric, Capistrano, and other “model-driven frameworks orchestration complex infrastructure API organic solution automation databags” * • CSC just purchased ServiceMesh… *- Lynch, John (CTO, Kaleo Software). Ansible Presentation. Slideshare.net
9. What I needed was • AWS provisioning out of the box – VPCs, private subnets, IGWs, SGs, EC2s, ASGs, ELBs, EMR, EIPs, IAMs, AMIs, etc. • Configuration Management – bind, yum, amq, iptables, WinRM, IIS, dcpromo, … • Applications deployment – git, apt-get, yum, chocolatey, … • git checkout and run
10. What I kept finding was • I had to run a server to run my servers • I had to run a different tool to provision a VM $ knife ec2 server create --run-list "role[phpapp]" -I ami-3d160149 --region eu-east-1 - G www,default -x ubuntu --node-name server01 --identity-file ~/.ssh/sshkey.pem but I couldn’t place it into a private subnet… • I had to create /etc/chef-server/chef-server.rb to override my chef-server’s internal AWS DNS name • I needed to learn DSL Ruby…
11. “Benefit of Puppet DSL […] is that it encourages the mental shift that Puppet requires” – PuppetLabs.com
12. So, why Ansible? • Simplicity – Automation in plain English… YAML – Python 2.4 on nodes, 2.6 on workstation – Agent-less = zero bootstrapping on nodes – I can show a playbook to my boss and she can find an error • Batteries Included: – Provisioning – Configuration idempotency – Common stack and custom app deployment – Extensibility in any language (within reason)
13. But the truth is • I decided to commit to Ansible for one week • I ported a few of my Rakefiles with knife ec2 and aws cli commands to Ansible’s playbooks • I slightly modified source for ec2, ec2_vpc and ec2_elb modules • And it started to stick
14. Ansible Origins • Project started February 2012 • Incorporated as AnsibleWorks (changed to Ansible recently) in 2013 • RedHat execs form the founding team • Ansible project founder, Michal Dehaan, is the CTO – He also started Cobbler and Func
15. Architecture Image: Author Unknown, Source: http://terry.im/wiki/terry/Ansible.html
16. Getting started
17. Basics • Playbooks • Inventory
18. Running from devel branch $ cd /opt # <- your choice $ git clone https://github.com/ansible/ansible.git $ cd ansible $ source ./hacking/env-setup $ sudo pip install paramiko PyYAML jinja2 –upgrade # setup your working dir $ mkdir ~/ansible/inventory –p $ cat > ~/ansible/inventory/hosts [local] localhost
19. Playbook # save above playbook into ~/ansible/install-apache.yml
20. Running a play $ ansible-playbook install-apache.yml –i inventory
21. Dynamic inventory # copy dynamic ec2 inventory provider into working dir $ ~/ansible/inventory $ cp /opt/ansible/plugins/inventory/ec2.* . # create .boto config file to access your AWS account $ cat > ~/.boto [Credentials] aws_access_key_id = <your_access_key_here> aws_secret_access_key = <your_secret_key_here> # to run inventory any time, do $ ~/ansible/inventory/ec2.py
22. Ad-hoc commands # ping all instances as ubuntu user $ ansible –m ping –u ubuntu all # ping all instances in us-east-1 region $ ansible –m ping –u ubuntu us-east-1
23. Provisioning a VPC
24. Security Group
25. EC2 Instance
26. EC2 Modules (Ansible v1.5) ec2 ec2_ami ec2_eip ev2_elb ec2_elb_lb ec2_facts ec2_group ec2_key ec2_snapshot ec2_tag ec2_vol ec2_vpc elasticache route53 s3 emr (WIP) winrm (WIP)
27. Best Practices http://docs.ansible.com/playbooks_best_practices.html
28. What I do with it • Maintain 3-5 non-production environments – 15-20 VMs each, ReHEL, CentOS, Windows – EMR, HBase, MarkLogic, AMQ, Rabbit, Viaduct (CSC), IIS, AD/ADFS, Orchard, OpenVPN... – Packer, Aminator • “Production” environment – 2 region HA, Active/Active – Cross region VPN
29. References • Ansible: https://github.com/ansible/ansible • Docs: http://docs.ansible.com/index.html • AnsWerS: http://answersforaws.com/episodes/2-ansible-and-aws/ • Ansible Blog: http://blog.ansibleworks.com/author/michaeldehaan/ • My VPC modifications (will go into Ansible 1.6): https://github.com/alexanderpopov1/ansible.git $ git checkout “csc-devel” branch