00:16:45 #startmeeting ROC.py 00:16:45 Meeting started Wed Nov 18 00:16:45 2015 UTC. The chair is decause. Information about MeetBot at http://wiki.debian.org/MeetBot. 00:16:45 Useful Commands: #action #agreed #halp #info #idea #link #topic. 00:16:52 #chair threebeand 00:16:52 Current chairs: decause threebeand 00:16:54 #chair threebean 00:16:54 Current chairs: decause threebean threebeand 00:16:57 Hi 00:17:00 I'm ralph 00:17:07 I hack on Fedora full-time 00:17:12 come hang out in IRC and hack with us :) 00:17:26 I use ansible on my personal machine, but also to manage all our servers in Fedora 00:17:30 #topic Ansible 00:17:47 namesake - Machine for super-liminal communication. From ender's game. 00:17:57 diff wikipedia 00:18:37 Ansible is a free software platform tool for managing and configuring computers. Taks management, over ssh, or powershell. Modules work over JSON and stdout. System uses .yaml to create descriptions of machines. 00:19:22 #topic People 00:19:28 Michael DeHaan(sp) 00:19:45 helped write ansible, and also Func. Wrote cobbler also, and took lessons to help make ansible. 00:20:01 Seth Vidal, author of Yum, helped Michael write ansible. 00:20:15 "We're making another func/cobbler? Is this a good idea" asked Seth 00:20:28 Michael says Seth's support had a big role in actually building it 00:20:34 RIP skvidal 00:20:42 #topic Health Benefits 00:20:49 Ansible is a configuration and orchestration tool 00:20:51 there are many tools like it 00:20:57 salt, puppet, chef 00:21:01 but Ansible is agentless 00:21:21 other machines, you have to install an agent, so there is a bootstrapping to get their system installed 00:21:24 not ansible 00:21:34 Ansible also has a PKI (Public Key INfrastructure) 00:21:49 itdoes everything over ssh, and you can reuse the PKI, and not manage another on top of that. 00:21:57 it has a really simple syntax/format 00:22:00 it uses .yaml 00:22:46 which is "yet another markup language" 00:24:05 you only need ssh, and python 2.4 or greater (but less than 3) 00:25:30 #topic Module Index 00:25:40 #link https://docs.ansible.com 00:25:47 #chair decause 00:25:47 Current chairs: decause threebean threebeand 00:25:51 #topic Module Index 00:25:59 #link https://docs.ansible.com 00:26:03 * decause shrugs 00:26:16 here you can see all the modules, and there is a whole set of thigns you can manage 00:26:40 Q: These are small python modules that bind ansible to the platform listed? 00:26:52 A: It becomes like a function you can call from your playbooks. 00:27:00 Q: Oh, so it reads the .yaml ,and makes python? 00:27:03 A: Yes! 00:27:09 This is .yaml (shows a playbook) 00:27:51 you define what you want (i.e. make my key present on this machine) and each time you run it, it will make sure that stuff has happened. 00:28:53 you can write your own in any language. YOu just make your module print out json to stdout! 00:29:07 a "callback" plugin can be called at the end of tasks 00:29:14 lookup plugins can be run before 00:29:42 #topic comparisons 00:30:20 puppet is a pull-based system 00:30:26 agents query the puppet master 00:30:31 but ansible is push oriented 00:30:37 it sends commands across the network 00:30:52 we had a puppet infrastructure, but then we used ansible to run puppet ;) 00:30:57 puppet needs it's own PKI 00:31:04 puppet is ruby, ansible is python 00:31:17 puppet has a DSL that looks like Ruby, but isn't turing complete 00:31:29 Ansible is .yaml, arguably readable 00:31:33 puppet uses ERB 00:32:07 puppet config style is declarative--a machine "should" have this service running, which means this package needs to be installed, and orders the resource treee into a dependency graph 00:32:19 ansible is imparative, which means you declare steps, and they happen in order 00:32:33 in a way puppet is more powerful, where you can specify a complicated resource graph 00:32:43 I got frustrated when the graph would get resolved in ways that I didn't expect 00:33:08 (e.g. applying an selinux label with two puppets, would be non-deterministic when I used it) 00:33:16 puppet is Ruby only, Ansible can be any language 00:33:26 You can invoke ansible directly to do "one offs" 00:34:04 ansible all -m ping 00:34:19 Q: How does ansible know "all"? MDNS? 00:34:31 A: You have an "inventory" file where you define everything 00:34:51 You can define things in your inventory like "database group" and within that a "staging" group 00:35:53 #topic modes of operation 00:35:58 mode #2, playbooks 00:36:18 you can specify extra arguments, and change what happens at the command-line 00:36:31 #3: using the python api. You can import ansible.runner 00:36:40 you can use the "virt" module, and then the "node info" command 00:37:37 #topic Example playbook 00:37:48 #info Slide #12 on threebean's slides 00:39:02 here is a playbook for shellshock 00:39:03 #12 00:39:08 here is a playbook for heartbleed 00:39:19 #info Slide #13 on threebean's slides 00:39:52 #topic lightsaber 00:40:13 #link https://github.com/ralphbean/lightsaber 00:40:23 this is a glorified dot-files repo 00:40:33 I use it to manage my laptop, and my cloudnodes, etc... 00:41:24 you can define parent/child releations, which themeselves can be gropus 00:41:29 you can create overlapping hierarchies 00:42:14 roles are like python modules 00:42:20 groups that contain many tasks 00:48:09 *threebean shows off playbooks and roles in lightsaber repo* 00:48:26 #topic 00:48:32 #topic Secrets 00:48:48 there are two repos: one has the public facing stuff, and one has the passwords and certs 00:50:04 we use ansible vaults 00:50:11 Q: We use git-crypt! 00:50:23 Q: we have a clear.yaml and encrypted.yaml 00:50:45 it auto-encrypts on push! 00:50:48 A: very cool 00:52:42 #topic Fedora Infra Playbooks 00:52:44 #link https://infrastructure.fedoraproject.org 00:53:06 fedmsg publishes whenever playbooks are run too, so we can make announcments 00:54:37 we have many playbooks, but most of the action is in the "groups" folder 00:54:44 we have a notifications backend playbook, for example 00:54:49 first line "include virt-create" 00:55:02 which passes in a command to spin up a node, or if it exists, continue 00:55:08 it doles out some generic configurations 00:55:23 it operates on the notice backend and notice backend staging group 00:55:35 we have a number of roles 01:04:40 *threebean shows off update playbook* 01:08:17 *threebean shows off vhost reboot playbook* 01:22:34 Without reading the scrollback, this is the best meeting ever. 01:46:27 tibbs|w: :) 01:46:35 forget to end it, got caught up in discussion 01:46:59 #link https://threebean.org/presentations/ansible 01:47:23 #link https://threebean.org/presentations/ansible/ 01:47:40 thanks all for your patience :) 01:47:43 #endmeeting