A minimalist introduction to Ansible

Speaker 1 [00:00]

do this tutorial as much interactive as possible. If you have any questions you must wait for the microphone because of the audio recording. So the agenda, the time is not strictly fixed but I will try to give you an introduction of what Ansible is and why to use Ansible. I'm going to do a very small project just to give a full overview then we're going to have some time for some final considerations some discussions about possible any questions so far have questions raise your hand and then we try to bring the microphone so imagine that you had a no very rich uncle who passed away and give you a big father you can make a lot of of money with this farm. But the only way to access this farm is with a very very dirty road. You need a 4x4 with good traction for you to access and there's no infrastructure on this farm that you got from your uncle. But because it's a farm and you're going to get very rich with the farm you say okay I'll go and do some work. So you get some pegs and some wood and other things and hit the road but you need to get some tools, you need to get some hammers and other things for start doing work on your new farm. Ansible is your hammer to some extension. With Ansible, you can create users, you can install programs for your applications on your servers, manage system unit files starting with delete, create all different kind of files and lots of other things. The good thing is, as I mentioned, your farm is only accessible with a very dirt road. No nice API, just SSH, and that's where Ansible shines, one of the factors, because in terms of requirement, you need your server to have SSH installed, which to some degree is very standard these days if you're getting a remote server. You need to get some sort of credentials. It can be a username or password or some SSH key, which is also very standard. Optionally, you might get sudo access on that server, but it's not mandatory. It depends on what tests you're trying to do. And the sweet of using in Ansible is that you only work with YARN files. For better or worse, love or hate, Ansible will be primarily YARN files. In the back end, Ansible is all written in Python. So if you want to do very, very advanced things, then you can start to customize your own rules for tasks in Python, but for most of the work, it's like 90% or more, you only need to use YALM, which is great if you have adverse things that work with different languages, because then they can keep working on any other language and you all need to do YALM. So the other thing is that Ansible uses a push model. So you So you only need to have Ansible on your control node, which is represented here. It can be your own laptop, but it can be a CI-CD server somewhere, GitHub Actions, GitLab CD, Jenkins, any other thing. And the control node will push instructions for each one of the managed nodes, and you can use any flavor of Linux or Windows. we have a microphone here behind one question so you need access to pip right so you need to access to the package manager package manager you cannot just you can you also download and put push and civil tools the machine when the machine doesn't have access to the internet? So the control node needs Ansible, so we need pip or some other way to install Ansible. You don't need Ansible on the managed nodes. Generally you need Python for some tasks but not all the tasks. Some tests doesn't need Python at all on the managed nodes. So the first lesson that I want to share is that if you're trying to learn Ansible, you don't need to start spending hiring service on the cloud, you can start with a multi-container on your machine. If you're going to try to follow the tutorial here, I want you to come like a sandbox that that's the link it's also available sorry sorry sorry this so is I also add the link here the same box is also in the description for this talk realize so you can download it's just a collection of ansible files and part-minute document will make sense in a minute so that's as I say what we're going to use here for my examples the infrastructure that come on these files is that we're going to have your host machine or my machine field is following along there's a user the user will send requests instructions using the host shell and there's a container network here there's a control node that's all of them will be running Alpine but just to make the images smaller for this session you can use Ubuntu Fedora any of the distribution are you mount some files on the control node from the host that's just to make things simple to edit during the talk and the control node will be responsible to send instructions should manage node one and manage node two. Both have SSH running and then that's with the configuration. So if you downloaded the zip file that I pointed before and it's also on the description of this talk, there will be a couple of files. There will be one play.yaml file and there There is also going to be a compose.yaml file. These are the instructions if you're trying to run things locally. I will do on my machine. You can do with Docker. If you're using container engine, I will not be able to help you very much at this moment. Sorry. So I'll go back some slides just to copy the link, and then I'll try to do this as more interactive as possible. So I'm copying the link here, and I'll go back, I'll change the terminal. How is the font size for people? Is it good, big enough? So I use WCAD to get the zip file. the zip file. I can use curl or any other way that you prefer to get to the files but before this I just want to change, sorry, I will change the directory to make things less polluted. You don't need to do this one, mkt minus t, ktemp minus t, sorry for the mistake I just want to have an empty directory here so there's literally nothing on this directory so I do wget or curl and download the zip file so now I have a zip file here and I can unzip so unzip sandbox so those are the files those are the instruction here the first one I going to start visual code you can start any text editor that you like for just make simply to see the files yeah when we need to edit so they all files are here is the font big enough for people to follow. So I can create a new terminal here and I will copy the command here for Portamon. So I was starting the network that I showed before. There's one controller node and two manage nodes. I can do Portamon LFPS or document PS and you see that they are running here it should take a few minutes I don't know how is the network here the conference for people to download the image for people that are trying to they I already have cached the base image here so that's why it was fast if anyone's trying to follow along can you just sign so I can get feedback on the time to download so continuing so the containers are running I will access my control node using podman or docker so podman exec, minus ET, ansible, minus cnode, minus cnode, and ping slash ch. That's the convention to access containers, if you're working for containers. So now my prompt here at the end is inside a container. If I do ls, as I mentioned the files that I unzip they are mounted inside the container so there is all these folders minimum working example MWE are listed here and we'll talk about these files as we go the other thing that is important here that I want to highlight is that I can connect from my controller machine that one that I'm accessing now to the manage nodes with SSH the password is 123 this one was true just saying that it is a good but I can do without true and you should be able to see that this different machine kind of thing so with that we have this network running we are on the control node here and we can use the control node to send commands to both manage node 1 and 2 so we finish with at least a sandbox for this tutorial there's two concepts that are fundamental in Ansible. One is inventory. Inventory is a file. It can be a YARN file. It can be also a init kind of file, but we're going to use a YARN file that describes and defines and describes all service nodes that you have on your network. We're coming to more details in a minute. The other concept is the playbook which also a YALM file and you define the commands that you want to run on each group or node so if you want to install some package or if you want to create a file those goes on the playbook so the inventory how is the syntax as I say is a YALM file the first mapping is going to be based on groups you can use any name for groups that you want. In the example here I have web, but they can have back-end, front-end, database, you choose. Each group will have a collection of hosts, so hosts here is a keyword, you need to keep it as hosts, and hosts has a mapping of every server that is on that group. You can name them as you like, but But if you don't use the way to access them in terms of full qualified domain, then you have to specify that later, the full qualified domain. For each host, you can also have some variables, keyword, paths. Here I have the password, I have path, and you can also have variables for the hook-full group. In this case, the Ansible user. I must highlight here, never store your passwords on the inventory as plain text. I'm just using here for practicality, so we don't need to be typing all the time. There's a complimentary tool on Ansible called Vault that can manage all your passwords and secrets safely encrypted. I'm not going to get too much into the details of Ansible Vault on this talk, but as I say, here are only as plain text because they are only intended for the tutorial. So if we move back the inventory here has PyCon D 2026 it's exactly the same example that was in the slides and if I do a cat inventory PyCon D 2026 on my shell you see the same output because we are mapping the files. So the second lesson is that you can run a single task against your inventory. That's not primarily how you use Ansible but it's a very useful thing to do in some occasions like if you need to reboot a server or service or if you want to update the caching of the package that you want. I'm going to copy this command. In a minute I will just explain the keywords. So Ansible is a program that is an augmented inventory that has what's the inventory that you just saw on the previous slide. Ansible is organized in modules. Modules are the tests that you're trying perform. This module is called community.general.apk. Because we're using Ansible, the package, not Ansible, sorry, Alpine. So all the containers are running Alpine. The default package for Alpine is called APK. Ansible has modules for for APT, if you're using Debian or Ubuntu, that is for Yon, if you're using Red Hat or Fedora or another Linux distribution. And if you're using Windows, there is also Chocolaty and other things. The reason that you're using APK here is because the image is Alpine. We can pass arguments to our modeling, so in this case, the name of the package that you want to install and you can pass any group or any server from the inventory as the target for this group so i will copy here and i will pass here it will execute it knows the password because it's on the inventory i am only executing for one of the machines the ansible mode one and from the output We will ignore this warning. It's not important on this tutorial. What's important is the output here. It will say that our task was successful. It says that there was no change on the machine because Python was already installed and that's what is on the message. So that was our first task. We already had Python but at least we saw that it was able to connect to the machine we can change the same command and run for all the machines if you want so i'll copy again and instead of ansible node i can use the group that's called web so now instead of running for only one machine, it will run the command for both machines. Any questions so far? All good? So there is a few more examples here. So in most of the Linux distributions we separate Python 3 and Python-dev, so dev comes with the headers and so on. So let's see if you could install dev. So if I'm trying to execute this, we will see that now we get an error different than before. It says that it failed. There was no change, but it failed to install python3-dev. And the reason that it fails is it kind of couldn't find the package of python3-dev. The reason this happened is that this is a fresh new container image so there's no archiving cache of the package so we can try to update the cache that's the second command here and if you try to execute or paste here what we're going to see is that it also failed but now on the message you see that there's a different type of error. It's saying that there is no enough permissions to run this command because it's running at the moment as a normal user and as you might imagine to install package you need pseudo permissions. So which brings us to our third lesson you can escalate privileges when using Ansible by using this become argument so these two commands are the same ones that we saw before with the difference that they use this be minus minus become my minus become pass which means that now and so we run the update of the cache in the installation using our pseudo privilege so I can run this one to update the cache so I paste it as my password my pseudo password in this case which also 1 2 3 and you take a little bit more and then you can see that it execute it says change so generally every Ansible task will have one of three possible output will say pass as we encountered before I'm scroll here up so success it means that everything run as expected you can have change it change it means that it executed as expected but some state on your machine change or it can fail as we saw before so now we have update our cache and we can solve Python minus minus three so it was the password again one two three in our case and it's downloading everything and after a moment you install things again it will show that the output was changed because it installed the package what is is interesting in ansible is that we can try to run the same command to install python three minus dev again one more time if you we do this same one asking the password one two three it will not show change but just success now so ansible works on a model that it tries to avoid repeating things, doing things more than once if they're not needed, which brings us to lesson four. So Ansible will look at what changes you're trying to do and determine if those changes need to be performed or not. There's some technicality terms, it's called independent, that's this feature. Most of the modules on Answa, they are writing to be independent, but not all of them. On the previous slide, we have a good example, the APK, but this applies for APT or YUM. If you're only trying to install a package, as is here, so I'm trying to install, it has this independent characteristic. If you already install it, Ansible will not do anything. But if you're trying to update the cache, every time that you do an update, even if the cache is kind of like the same, the instructions is that the cache will change. So then it's not independent. Every time Ansible will be running. This is important later if you're trying to optimize the time that Ansible is running because if it's not independent then it will take more time because Ansible will be executing things. So we start this one, the independent one, which then we more or less finish with inventory. We're now going to pass to playbook, which is the second of the concepts that I said are core for Ansible. So, the playbook has all the rules, all the tasks that you're trying to run on your service. It's young, it's a syntax, so you see the syntax here. It's a list, so every playbook is a list. It's a list of plays. Every play will have a collection of tasks here. So, you must give a name to your plays. The names can be more or less anything. You just use it for you to know how to navigate the plays and be explanatory. You also must have a host as a play keyword, which is the one that defines which part of the servers you're going to apply those transformations. And you have the tasks. Tasks are what you actually doing with the server. Each task is an item on the list. It is recommended to use the fully qualified name of the module for the task. And you can have as many tasks as you want. So on this small example we have the name is my first play we will apply to the hosts web that we saw in our previous inventory I will explain this later this got effects we have only one task on this playbook which you just print at the bug frame so this file is already on the hello.yaml on the zip file that you downloaded is exactly the same that was on the slides I can do a cat here on the terminal so that's the file and then we can execute this playbook is ansible minus e you need to say the inventory so we're going to get inventory Python D 2026 that young and And you need to say what playbook you're doing. So we're going to run for hello.yaml. And it's missing a host. Oh, sorry. This is always good to have arrows in front of the audience because you learn what you missed, forgot to tell your audience. Ansible comes as a collection of different commands. We have been using just the command ansible, and ansible is for this one single command. If you're trying to execute a playbook, you should use ansible minus playbook. So ansible minus playbook. Now we can say the inventory. And we can pass the playbook. That's what we're going for. And I will go back on the explanation here in a minute. I want to go back. So we had this, it executed the print message. One thing that you notice is that there's this double curly breaks with pet here. And Ansible on the playbooks, you use Ginger for templating. So, in many, many parts of your playbook, you can use Zinja 2 for template, and this is one use. So, on this module, which is the debug, we only print the message, but we're going to get this pad available from our inventory. So the inventory here we have for one machine the pet is called snake and for the second machine is milk snake. So when you see here the output the double curly breaks was replaced with corn snake and milk snake. So you can use this to customize parts of the commands that you're trying to run on different servers service with variables that is relevant for each one of the service. So one other thing is, if you're using Ansible, there's plenty of extensions for different visual editors. If you're using Deskcode, there's one extension. For others, you can search the Internet. But the other important thing is there is a link that you can use it to avoid to get common people in your playbook. To run the lint you can do ansible minus lint and you can pass all your files or directory. So we do inspect your directory and report if there is any file, a young file that it's find some rules that it's important I already linked it this one before loading for the stores there's none but it's quite useful so lesson number six this was the one that we just did before so you do answer minus playbook, if you have your full playbook to run, in this case, hello.yaon, which is different, as we saw by my mistake, if you only use Ansible, you're trying to get one single command. So, just out of curiosity, because of the example, that's the corn snake and the milk snake. Those are both like real like pet snakes kind of thing people have as pets I don't but you can go online and watch some videos to see after the talk okay lesson number seven the we see that on our example our curly double curly breaks with the pet it was replaced by variables that we define on the inventory you can define variables in different places on Ansible, on your files. I call this like precedence trap because Ansible has a way to define which variable, in which place it's more important than the other one. My recommendation is for you to only put variables in one of those, these three places. We're not going to cover rows in In Ansible, rows is kind of like a package, that's the straight forward way to explain. You allocate lots of different tasks into a single row. Those are the lowest ones. If you, in the future, start using rows, then you can put some variables there as defaults. Then you have the inventory files. the one that we use before but if you want to change from what is on the inventory you can pass as command extra line arguments and those ones always have the highest precedence on the variables you can pass a single environment a single variable with a minus n or if you want you can also have file and have a yellow file with the variables and you pass with minus M option out of curiosity because I mentioned that passwords and other secrets you should keep on Ansible vote the way to load those passwords is with minus and you pass your vote and Ansible will ask you for passwords for the vote and following up. I'll change to the editor so I can show an example of this. So it has the same one before, nco minus playbook minus e inventories by com.de. Hello. So we saw this one before. I'm just doing one more time. So there is my pet is corn snake, my pet is milk snake. I can now pass a minus R option so I can say pet noun equals mouse and when I execute you see that now the output here in both ones was replaced by mouse instead of the corn snake and milk snake. Can I have the microphone here so if I SSH into the one of the managed nodes will I get the pet environment variable the ENV or is it a no the pet environment is just here on the inventory okay later I'll show when you go to the smallest project then I'll show you how to move things to the environment variable kind of thing of your manage node is there any inspection of a managed node that would tell me which variables are yeah okay you can thank you so if you're operating with variables and so on, you might want to process them with different things. You can use changes built-in filters but NSQL also comes with extra batteries for your things. So on this example just trying to count the number of words that is on the variable. This example is also across the files is this one filters.yaml is the same one that is on these slides. It's just trying to change, as I say, having the words and the filter here. I can cat here, so filters, and then I can do ansible playbook-inventories, like on the year 2016, and filters.yaml. So now it counts the two words, so there's like milk snake, corn snake, so there's two words. you can capitalize change titles lowercase there's quite a few things that you can do with the variables then but if you're using variables there is three types of special values that Ansible has which connects with your question the first one here that I mentioned is connection variables we saw them earlier before. I will change the term just to highlight them. So on my inventory, Ansible password is one of these connection variables. It tells Ansible how to connect to your machine. The second one is magical variables. Those generally are related with your host or the Ansible play that you're executing. is this one is just example and the third one that's your question is called facts so ansible always you can disable this we have been disabling it always start collecting our information from the system that you're running and then it collects lots of environment variables and other things so then you can use those information to make decision on what you want to run this This example here is also on the file, so it's called variables here, it's exactly the same, I can show on the cat, variables, and I can execute ansible minus playbook, minus i, inventory, python d, variables. So, one thing that I mentioned, to answer your question, that Ansible runs this gathering facts tasks at the beginning. It's not listed here, it runs by default. On previous ones of the playbooks that you have been running, I will, in hello here, I have gathered facts, false, so it's not collecting that, and I will explain in the the next slide but back to the variable so it collects the facts here and then it's execute print corn snake milk snake that's from the inventory it prints a sample of variables because that's the name of the play it's here our play and the last one it gets a user ID from the whole the manage nodes both identical in this case of the wolf are 1000 but you could have 1001 and 1005 and you're not the one that we collected it comes from the facts there's a full list of all these facts on the documentation. Did I answer your last question? Good. Okay, so then this is about the facts that I was saying. You, Ansible, will execute these gathering facts on every play, not task. So remember that you have your playbook. Playbook is your YARN file, every place the first top-level item on your list. So for each one of those, Ansible will execute a gathering fax. If you have very long playbooks, this can start to consume quite a bit of time of SSH connection to collect the fax. So this example just to illustrate that it collects multiple times because you have in this case two plays. It's also on the files is this FATS one here so I have two plays, first and second play. I can do a cat on FATS. It's the same one and I can do ansible-playbook-e-inventory-icon.de and facts. And as I say, we're going to get the first gathering facts for my first play. It collects, it prints. Then on my second play, I execute again, the gathering facts. If you know that you don't need to collect the facts, you can disable. That's what we did on some of the earlier playbooks. It will give you some speed up in terms of execution of your playbook. There's also some way of you to cache the effects but I'll be careful with the caching because the idea of the reason that it's collected on every play is because a play might have modified your server environment so you don't want you having to debug cache problems with Ansible Ansible also allow you to have loops which can be quite helpful so you can repeat the same task for multiple values so on this example here I have the keyword loop here so for each item on this keyword is always the keyword loop I have a variable called item which will repeat this example is on the loop playbook here, the same one from the slide. I can show on the terminal cat loop and the same one and I can do ansible playbook-e-inventory.pycom.de, loop and you see here that for each one of the values that was on my loop keyword it execute the same test again you separately will use loops because most of the modules they are designed already in mind that you might want to install don't search yourself but you might want to repeat something so the carpet for example you can pass more than one package name and then you install all of them so you don't need to use loop on that case but it's also interesting to know if you need to keep repeating things more than once and of course ansible has conditioners you can conditionally execute part of your play, including or removing tasks. Although this is kind of like all this Ansible support of Jinja is quite powerful, my recommendation is to try to avoid it because the mental model for you to understand what is going on or not becomes quite annoying. So this example is also on the files, is the conditional here so I can do a cat conditional down and then I can do a small playbook minus the inventory by country conditional so the first condition here that was only fed equals corn snake it's only executed for the first server and the second one that has pad equals milk snake is only executed for the second server and with that that ends the first part that i mentioned that's like a summary of what things you can do with Ansible and now we're going to do a small project any questions so far should we go okay so don't this small project doesn't try to teach you like good software development or anything practice I'm trying to just show features from Ansible so try to pick things with a little bit of salt on this. What we're trying to do is we're going to have a Flask hello world that we get from the Flask documentation and then we're going to deploy this Flask app to a testing server which will be our Ansible mode 02 and later if everything goes as planned we want to also deploy to our production server. Is that clear? okay so the inventories for our small project we want to have acceptance and production to separate inventories each one will have a flask group that has a host and then you have the name of the host a fully qualified name of the host with username and passwords again you probably want to keep and so user and Ansible passwords on a vault. The reason to split into inventories is as we saw before when you execute a call Ansible playbook you pass the inventory so you want to separate because you want to run first on acceptance later on production that will make our life easier. I already created both of those inventories so we have acceptance here and production here on the inventory folder so that's inventory you have both inventory acceptance and get inventory production now we're going to start with our hello world thing as I say this comes from the flask quick start with one exception the line 5 here is new and this class here is new from the flask quick start. The line 5 I'm just going to get an environment variable from the server and I will use that on the output. This is just to connect the question that our colleague made earlier. I have this file already here in terms of demo.py. If you're not familiar with Flask, the name could be different, but Flask is quick to use for examples here. So I have demo.py, it should run. I'm not going to show running here now because I want to run show on the next server. So now that we already have our Flask app, we're going to start writing our playbook. I have this playbook already written on demo.yaml. it's all here but I want to start and do one step by step with you all so I call live.yau just so I can construct it live with you so first this playbook has needs a play so we have a item we need to give a name for this life then we need to have hosts and that host is flask and we want to have tasks so So that's the beginning as we saw from our syntax. The first task that we want is to install Flask on our server. So I need to expand here, so I will install Flask, I need to become true because I need super users on that and i use the apricot install and i will update the cache here so i can save this one and i can run ansible playbook minus e inventory now we're going to use only the acceptance one and I will use life.yaml so it's hosts not hosts there's a missing s here so it connects and you see that there's an error there's missing studio password because I forgot to tell what's the password so the way that we fix this is we say ask become pass and you ask for password is 123 and now we wait a little bit it to update the cache and install the package as I say before when you are explaining things you might want to not use update cache here because you want to make things independent when you're doing the servers. I'll just skip it here for sake of example. So now we install Flask on our server. We're going to create a folder to host our app. This is a new module for us. It's part of the default Ansible collection. It operates on file. It has a path, that's the location on the server. It says a state, in this case you want a directory. And it's always a good practice for you to say what's the owner, the group, and the permissions for your things. Because Ansible has this stateful mindset, so this will ensure that all the information is precisely there. So we are going to paste again here, going to adjust the Yaw level, so it's a task, correct, so I can execute again, I can just press up key and execute, one, two, three, you notice that now things have been installed here already so it's just okay no change but it creates the folder for us if you want to check that the folder was created you can SSH to the machine so we can do SSL SSH ansible mode 2 ansible and node 02 and I can do an ls. So there's our directory there. So now we create the folder. We just want to create a readme to help our future self. This has a new command that we didn't see before. It's called copy. It will get the content here. As I say you can use ginger and we'll create the folder read me on that for that we create before with the correct owner group and permissions so copy and paste this one so now I'm just in the index here so we have now here I can execute one more time the Ansible playbook. I need to give the become password. I'm installing, creating the folder and now creating the readme.file which is created. I'm not going there to check but if you're curious you can go. Now we're going to copy our source code. so this is the same module that you saw before I'm going back one slide so it's the same copy module but before I was using content and now I'm using source source is a file on the control note so I'm copying the file from my control node 2, the manage node, so I'm copying this one and I will just indentation so I will execute again 123 the password so it install Flask, create a folder created with me and now copy the flask app so I can show you that the file is there so it says SSH and NCO and node02 cat app demo so that's the file on on the remote server as we wanted. So now I have the file. And now I want to start the server. As I say, for this example, I'm sacrificing some things. You probably would not start things with a JavaScript. You might want to use other things. But this is one way, for example, that I could create the environment variables that you mentioned. So, I will have my own script and I will have my environment variable there and I build it as I want. This demo.start.sh is already existed here on our save folder. I can do a cat demo.start.sh is here and then I can add the ansible rule to our playbook. So now we want to copy here, adjust the YARN file and I can do ansible So, minus inventory, s can pass, life, 123 for the password, it will copy things, and now it copy the render, I will do a cat on the demo start, that's it, so this is on the server now for the output and you can see here that now the ginger variable was replaced here so I'll get acceptance for the acceptance server production for the production server so this is the second to the last step as I mentioned I'm I'm sacrificing some things. Most of the time, you probably want to have your server starting as a systemd servers thing. Because it will make it easy if your server has to reboot. Your app goes back when it's come back alive. You can have systemd on containers. It's not generally what's happening, because you want to have only one process per container. So on this one, I'm just using nohup to have a way to send an SSH instruction saying, start run this shell script, but don't kill it when you disconnect. It's a hack for the tutorial, but we'll get us where we want in terms of the demo. So I'm copying here. and now we can execute here again so and so once playbook my cemetery acceptance has come past life one two three for the password and we wait for it to execute things and starting the server okay so it should be have a server running that so we can do a SSH ansible and node 02 if I do PS it should sorry this is the password 1 2 3 if I do a PS it should show a Python flask running so it's here One important thing here, at least for this example, there's a really nice thought before the lunch called why Python doesn't like PID number one. We should be careful in killing these things, not having any zombie process. So as I say, I'm doing some things that is only for the sake of the example here. So we have the demo and we have the Flask app. It's running on port 800. I can do wget and I can say localhost port 880 and it should get us where we want. Okay, it has a file here. I can remove the file, it's not important here, but the server answered to us. local host here I did have SSH to the managed server so I'm going to quit and now I probably want to know that this thing is actually accessible from outside that managed there so I can do wget ansible-node-02-880 because of the example and permissions on podman if I do wget I'm going to get an error probably on doc you're not going to get an error but I will show you what needs to happen so this is just permission deny podman by default runs as unprivileged users so it means that given that I'm mounting my files the user that is inside this control node doesn't have the permission to write those files because they are from outside that's what's happening here it tries to write the index dot HTML and say oh I don't have the permissions we can send to the output yeah no not we want to just wait for you to repeat the questions yeah but you could read it in the browser not because of reports that I'm exporting on this example you can have an example that you export in the port on portman or docker and you'll be able to so you could configure it in a yaml file and export the ports and then you could have basically ansible mnode02 8080 exported to the outside world and could enter that into a browser and it would resolve it. You can, you can. There's some ways. I wanted to keep this. Yeah, sure, sure. I just wanted to understand because one side is the permission side, the other one is the access side. And you answered it. Thank you very much. So I can do cat minus Q, this is just silence, minus O, minus this is for the standard output and so and note minus 2 880 and then I can do a cat sorry there's a missing space here the output here is for this belt was without a space so now you can see here the output that's so then yeah so we start the server we can add a set on our ansible so we start the server and we can test if the server is actually running there's some scenarios that generally Ansible will test things for most of the modules if like if you starting out on your server system this server and so we like yeah did you it actually started or did it started in queue given that we don't have all the system infrastructure here we might not just want to have our assessment so you can do the tests and get what if you answer or not so I'm going to get this one are you before executing again I just want you look the process ID of the previous run and kill it so I'm going to So I'm going to do ssh ansible mnode 02 ps123 and I want to queue this 700 on my machine. I just want to build this 7.7.1 as well okay so I don't have the server running here anymore I add the assess here and now sorry now I can run one more time so ansible playbook minus e inventory acceptance live and i can run i forgot to add the pseudo password here so So it's installed and continuing and starts the server and it tests if the server is running. So now everything is working here. I can do the wget as before, and it's here. And this is the command that I was using. Now that this is running as expected, we can do the same thing for the production. So the only change between the first and the second, Can we have the microphone? It's the name of the inventory. Can you go back to the terminal, please? Yeah. Shouldn't it say class equals acceptance? Yes, it should. I don't know where it's missing here. Yeah, yeah. I thought that I had fixed it, this one. Yeah. Yeah, it's a string. Yeah. it that's wasn't I fix it and I forgot to fix again but thank you for paying attention so so now I can execute this one for for the production And I can do a wget and now we can see production. Thanks for helping us fix the mining thing. questions so far? So with this one we came to the end of our small project. If you remember the idea is that it was going to write this Flask app and it was going to deploy to the Studio server. So we did that. There is a few more things, sorry, there's a few more things that I want you to talk and I believe that I'm track with the time. So the first thing is provision, configuration and deployment. I'm a little bit stealing this from a talk from Forsten. You should go and look on the full talk from FOSS and from this year. But all these three terms, they overlap. There's a big gray area of what people understand and how they perceive each one of those terms. For the software, I'm going to use provision as just the creation of your server. It might include buying or putting credentials on aws or asia or something it stops once you get your server configuration is installation of packets some firewall rules and other things and deployment is copying your application your project to the server and start it and possibly once you do a rollback if things fail. Again, sometimes people say one, including the auto because there's this big gray area. Ansible can be used on all three things. So far we primarily saw on configuration. That's what we saw they useful in school this is what I'm saying can use for all three things if you're doing looking for provision it can as well has plugins for most of the cloud or on-premise providers you have more useful either guys Asia happiness and are VMware, Chromeworks, you can specify how many servers, what servers do you want, and it can execute, make the API calls, get the information back, and you save where you want, like you can save it on your inventory and so on. I'm not giving any example here. The good thing is that the documentation from Ansible is full of examples, so you can copy and paste I can click here for example and show so this is from the Amazon AWS there is lots of modules here to do so many things but like S3 bucket you go and there's lots of options and when you scroll all the way down there's a big catalog of examples for how you can create AWS S3 buckets. So that's lesson 14. You can also do the deployment, especially if you're using containers. Ansible has plugins for Powerpoint, Document, Kubernetes, it includes Compose and Helm. You can also use a hybrid approach. That's what I'm using at my working. So I'm using Ansible with Ginger to create Docker compose file and then I write the compose file on the server and then I use Ansible to start the compose file but if you want to not use a hybrid approach you can have Ansible operating on a per level container on your apartment or docker, infrastructure or kubernetes as you can see. Just going to create this and that. The last one is in In terms of rollback, Ansible has an option of block and rescue. So on the block you write your tasks. If one of the tasks fails, Ansible will jump to rescue. So let's say like you're trying to do a database migration thing. You can have a block where you try to perform the database migration. If it fails, then you can have the rescue to undo your data beta migration. And I think this is the last slide. Ansible, once you get quite advanced with long plays and so on, you can organize things on your structure for these five steps. Pre-tasks, roles, tasks, post-tasks, and handlers. And so we'll execute them top to bottom kind of thing. One scenario that might go with those things, if you're doing a deployment, you might want to have pre-tasks to disable some things. So for example, analytics, you can say, I want to do the deployment. So remove this from my alert server. And then you can have your roles and tasks to do the new deployment. On the post-tasks, you reconnect the new deployment to your analytics. That's one scenario that can break things down. Handlers, you generally use it when you have different tasks. And they required a service to be restarted. So if you're doing Nginx, you want to add Nginx to your deployment with Ansible, you might have a test to install Nginx, a second test to add Nginx configurations, and so on. But instead of having to restart the Nginx server every time that you attempt to do a deployment, handlers allow you to only restart if any of the previous tasks change. So if you don't change the NGINX configuration, then you don't need to restart the NGINX service. That's the use case for handlers. And yeah, this is the last one. If you end up using Ansible, there is a marketplace, a community marketplace called Ansible Galaxy that has lots of collections and roles. So it's a good place to look if you're trying to get some examples for things to be done. Like, let's say you want to deploy a Harbo on your server. So then there's a role for Harbo. I would like to write on Ansible Galaxy. It's a good thing. And you can also contribute if you have your own rules. So with that, I come to the end of the tutorial. Hopefully that you enjoy and you learn some things. There is some recommendation readings if you want to be interesting. These slides are also on the conference page. I'm hoping for questions, and I'll be doing the conference if I want to talk more. Thank you. So, first of all, apologies on behalf of the colleague. We don't know what happened to them. I'm the substitute chair. I'm actually pretty worried. And, yeah, so we can start with the questions. I see no questions online at the moment. So, who has questions? You mentioned several extensions for Visual Studio Code. Are there anything really necessary? Can you repeat the question, sorry? You mentioned that there are lots of extensions for Visual Studio Code using Ansible. There is primarily one extension for Visual Studio Code that's developed by the same people that developed Ansible, which is, I will find this slide here for you, it's a VS Code extension, you can install it. It helps you show on the YARN file that the YARN is answering. It has server, like, language server information to try to understand, oh, like, you're missing this keyword, or is this keyword that you're trying to do? Does that answer your question? They're helpful, but not necessary, using them. Yeah. I personally don't use, but it's there for people that want to use. Thank you very much at first and this was really good information for me and I have one question, because usually I use Liquibase for database deployment stuff like that but come always to the problem you say it's stateful and mkdir in the bash is also stateful I mean if the folder is there it won't create it again but what what are you doing to record the stuff you're doing using Ansible because sometimes you install Python 3.10 that it doesn't work then you install 3.13 how can I track the changes I've made to the ansible and make sure I make the same state in production which has achieved in my test environment yeah so good question there's one slide here so generally for me this control node ends up being CI, CD server like GitLab Actions, GitHub Actions or GitLab CI, CD. I have my Ansible playbook on GitHub for every commit, GitHub will run the playbook across the servers. To your question of control the versions that is installed it, the modules, the Ansible modules, they allow you to lock what version do you want. So I mostly lock on my playbook what version do I want. So I say I want Postgre 18 and then it will only install 18. There is a personal experience and this was, I'm sharing mostly because it was a learning lesson thing. The IT department, they update the server from docker 1 to docker 2, but there was a small breakup change on docker between those two versions and then my department stopped working. So it was annoying to figure out why it was because it's like how to go down up to docker version thing which connects to your question as like oh the problem was on docker version what can i do so depending on the package manage that you're doing uh you can lock the version so if using Debian or Ubuntu, apt allows you to lock the version. You not upgrade even if a new version is allowed because you lock the version. That's what I end up doing on my case. I say like docker is locked. Don't upgrade docker because if it broke once, it can broke later. Then you just like, it's a trade-off. You lock things, you know that they not change but then once you need to do our upgrade you need to do a two steps things you need to unlock upgrade lock again which you can do in a school probably using this one step thing that we learn at the beginning so you do you're only going to do once time so you might do that manually for your our service it's clear more questions okay anyone can come later and meet me you can find me online as well