Skip to main content

Useful ansible stuff

inventory_hostname


inventory_hostname‘ contains the name of the current node being worked on…. (as in, what it is defined in your hosts file as) so if you want to skip a task for a single node –
- name: Restart amavis
service: name=amavis state=restarted
when: inventory_hostname != "boris"

(Don’t restart Amavis for boris,  do for all others).

You could also use :
...
when: inventory_hostname not in groups['group_name']
...

if your aim was to (perhaps skip) a task for some nodes in the specified group.

 

Need to check whether you need to reboot for a kernel update?



  1. If /vmlinuz doesn’t resolve to the same kernel as we’re running

  2. Reboot

  3. Wait 45 seconds before carrying on…


- name: Check for reboot hint.
shell: if [ $(readlink -f /vmlinuz) != /boot/vmlinuz-$(uname -r) ]; then echo 'reboot'; else echo 'no'; fi
ignore_errors: true
register: reboot_hint

- name: Rebooting ...
command: shutdown -r now "Ansible kernel update applied"
async: 0
poll: 0
ignore_errors: true
when: kernelup|changed or reboot_hint.stdout.find("reboot") != -1
register: rebooting

- name: Wait for thing to reboot...
pause: seconds=45
when: rebooting|changed

Fixing ~/.ssh/known_hosts


Often an ansible script may create a remote node – and often it’ll have the same IP/name as a previous entity. This confuses SSH — so after creating :
- name: Fix .ssh/known_hosts. (1)
local_action: command ssh-keygen -f "~/.ssh/known_hosts" -R hostname

If you’re using ec2, for instance, you could do something like :
- name: Fix .ssh/known_hosts.
local_action: command ssh-keygen -f "~/.ssh/known_hosts" -R {{ item.public_ip }}
with_items: ec2_info.instances

Where ec2_info is your registered variable from calling the ‘ec2’ module.

Debug/Dump a variable?


- name: What's in reboot_hint?
debug: var=reboot_hint

which might output something like :
"reboot_hint": {
"changed": true,
"cmd": "if [ $(readlink -f /vmlinuz) != /boot/vmlinuz-$(uname -r) ]; then echo 'reboot'; else echo 'no'; fi",
"delta": "0:00:00.024759",
"end": "2014-07-29 09:05:06.564505",
"invocation": {
"module_args": "if [ $(readlink -f /vmlinuz) != /boot/vmlinuz-$(uname -r) ]; then echo 'reboot'; else echo 'no'; fi",
"module_name": "shell"
},
"rc": 0,
"start": "2014-07-29 09:05:06.539746",
"stderr": "",
"stdout": "reboot",
"stdout_lines": [
"reboot"
]
}

Which leads on to —

Want to run a shell command do something with the output?


Registered variables have useful attributes like :

  • changed – set to boolean true if something happened (useful to tell when a task has done something on a remote machine).

  • stderr – contains stringy output from stderr

  • stdout – contains stringy output from stdout

  • stdout_lines – contains a list of lines (i.e. stdout split on \n).


(see above)
- name: Do something
shell: /usr/bin/something | grep -c foo || true
register: shell_output

So – we could :
- name: Catch some fish (there are at least 5)
shell: /usr/bin/somethingelse
when: shell_output.stdout > "5"

Default values for a Variable, and host specific values.


Perhaps you’ll override a variable, or perhaps not … so you can do something like the following in a template :
...
max_allowed_packet = {{ mysql_max_allowed_packet|default('128M') }}
...

And for the annoying hosts that need a larger mysql_max_allowed_packet, just define it within the inventory hosts file like :
[linux_servers]
beech
busy-web-server mysql_max_allowed_packet=256M

Comments

Popular posts from this blog

Saltstack and Vault integration

First install and configure vault using this tutorial: https://apassionatechie.wordpress.com/2017/03/05/hashicorp-vault/ Use the latest version of vault. Then install salt using the steps given here: https://docs.saltstack.com/en/latest/topics/installation/ If you face any issues then refer these links: https://apassionatechie.wordpress.com/2017/07/31/salt-issues/ https://apassionatechie.wordpress.com/2017/08/03/salt-stack-formulas/ Now let's integrate vault and salt so that we can access vault secrets from inside salt state. First let's add some key values into our vault. vault write secret/ssh/user1 password="abc123" Then you can check it by reading: vault read secret/ssh/user1 To allow salt to access your secrets you must firstly create a policy as follows: salt-policy.hcl [code] path "secret/*" { capabilities = ["read", "list"] } path "auth/*" { capabilities = ["read", "list","sudo",...

Salt stack issues

The function “state.apply” is running as PID Restart salt-minion with command:  service salt-minion restart No matching sls found for ‘init’ in env ‘base’ Add top.sls file in the directory where your main sls file is present. Create the file as follows: 1 2 3 base: 'web*' : - apache If the sls is present in a subdirectory elasticsearch/init.sls then write the top.sls as: 1 2 3 base: '*' : - elasticsearch.init How to execute saltstack-formulas create file  /srv/pillar/top.sls  with content: base : ' * ' : - salt create file  /srv/pillar/salt.sls  with content: salt : master : worker_threads : 2 fileserver_backend : - roots - git gitfs_remotes : - git://github.com/saltstack-formulas/epel-formula.git - git://github.com/saltstack-formulas/git-formula.git - git://github.com/saltstack-formulas/nano-formula.git - git://github.com/saltstack-f...

How to grep the output of cURL?

curl writes the output to stderr, so redirect that and also suppress the progress: curl - v -- silent https :// google . com / 2 >& 1 | grep expire The reason why  curl  writes the information to stderr is so you can do: curl <url> | someprgram  without that information clobbering the input of  someprogram It is possible to use  --stderr -  as parameter, to redirect the output from stderr (default) to stdout. With this option you also should use  --silent  to suppress the progress bar. $ curl - v -- silent https :// google . com / -- stderr - | grep expire * expire date : 2015 - 09 - 01 00 : 00 : 00 GMT