A site on node2, by a playbook from node1

~50 min

Not running Starting usually ~20 s

Situation

The team's status page is moving to node2. A colleague put together an Ansible project ~/deploy on node1: the site.yml playbook sets up the nginx site status on node2 on port 8080 — the site config and the page from the templates in templates/, with the release taken from the release variable — and reloads nginx with a handler. Before leaving, the colleague ran the playbook: ansible-playbook site.yml finished without errors, yet there is no page on node2. The playbook is going to run every day, so a second run must change nothing.

node1 is your terminal: Ansible runs here, as student, from the ~/deploy directory. student logs in to node2 with a key: ssh node2 'command' or ssh node2, and exit to come back. sudo works without a password on both machines.

Task

ansible-playbook site.yml on node1 configures node2, and the playbook's tasks run on node2.
From node1 curl http://node2:8080/ gets the page from the template — with the release from the release variable.
When the site config on node2 has drifted from the template, a run restores it and nginx reloads the config; a run without changes leaves nginx alone.
A second run succeeds and changes nothing (changed=0), and ansible-playbook site.yml --check --diff finds no differences.

Constraints

Fix the ~/deploy project: the playbook configures node2. A manual edit on node2 is brought back to the template by the next run, so the check does not count it.
The check runs the playbook itself as student: a normal run (twice if the first one changed something), a run with --check --diff, and then it appends a line to /etc/nginx/sites-available/status on node2 and runs it once more — the playbook has to bring the file back to the template, and nginx has to reload the config.

There is no internet in the lab — only the network between node1 and node2. Everything needed is installed on both machines. After every change run the playbook and look beyond the exit code: at the warnings and the PLAY RECAP.

Lab goals

0 of 5

The site.yml playbook targets node2, and its tasks run on node2 — not checked yet
From node1 http://node2:8080/ serves the page from the template, with the release from the release variable — not checked yet
When the site config on node2 has drifted from the template, a run restores it and nginx reloads the config; a run without changes leaves nginx alone — not checked yet
Running ansible-playbook site.yml again succeeds and changes nothing (changed=0) — not checked yet
ansible-playbook site.yml --check --diff finds no differences on node2 — not checked yet

Hints

0 of 3 open · they open one at a time

Hint 1

Show the solution after 3 failed checks

Automation · picked for this lab

Ansible: inventory, modules and one-off commands

Cheat sheet

$_ — insert into the terminal

ansible -i hosts.ini all -m ping reach all machines
ansible -i hosts.ini all --list-hosts who a command will touch
ansible-inventory -i hosts.ini --graph groups and machines
ansible -i hosts.ini web -m command -a 'uptime' run a command
ansible -i hosts.ini web -m copy -a 'src=a.conf dest=/tmp/a.conf'
ansible -i hosts.ini web -b -m service -a 'name=nginx state=started'
ansible -i hosts.ini all -m ping -o one-line answers
ansible-playbook -i hosts.ini site.yml a playbook

Inventory

ini

[web]
node2

[db]
db1 ansible_host=10.0.0.21 ansible_user=deploy

[local]
localhost ansible_connection=local

[web:vars]
ansible_user=student

What	Where	Means
machine name	`node2`	how the machine is named in the output; Ansible also connects by it if there is no `ansible_host`
`ansible_host`	the machine's line	the address or name for SSH
`ansible_user`	the machine's line or `[group:vars]`	who to log in as; without it — your own name
`ansible_connection=local`	the machine's line	work on this machine without SSH
`[web]`	a header	a group; `all` is every machine in the inventory

text

student@node1:~/inv$ ansible-inventory -i hosts.ini --graph
@all:
  |--@ungrouped:
  |--@web:
  |  |--node2
  |--@local:
  |  |--localhost
student@node1:~/inv$ ansible -i hosts.ini all --list-hosts
  hosts (2):
    node2
    localhost

Without -i Ansible looks for /etc/ansible/hosts; the lab machine has none, and the command sees only localhost. Inventory errors in a playbook — ansible-playbook.

One-off commands

ansible <machines> -m <module> -a '<arguments>' runs one module on all machines of a group. The answer comes per machine:

text

student@node1:~/inv$ ansible -i hosts.ini web -m copy \
> -a 'content="hello\n" dest=/tmp/hello.txt'
node2 | CHANGED => {
    "changed": true,
    "dest": "/tmp/hello.txt",
    ...
}

The same command again gives node2 | SUCCESS and "changed": false: the file is already like that. The command module (also the default without -m) does not know what the command does and always reports CHANGED:

text

student@node1:~/inv$ ansible -i hosts.ini web -m command -a 'id -un'
node2 | CHANGED | rc=0 >>
student

In the output	Means
`SUCCESS`	the module ran, there was nothing to change
`CHANGED`	the module changed the machine (`command` always does)
`FAILED!`	the module ran with an error — the cause is in `msg`
`UNREACHABLE!`	cannot connect to the machine — ansible

-o prints each machine's answer on one line. service returns hundreds of unit fields — -o or a playbook is easier to read.

become: through sudo

Modules run as the user Ansible logged in as. Writing to /etc without the rights:

text

node2 | FAILED! => {
    ...
    "msg": "Destination /etc not writable"
}

-b (--become) runs the module through sudo:

text

student@node1:~/inv$ ansible -i hosts.ini web -b -m command -a 'id -un'
node2 | CHANGED | rc=0 >>
root

On the lab machines student's sudo needs no password. Where sudo asks for one, add -K (--ask-become-pass). In a playbook it is the same — become: true.

Playbooks and roles

yaml

# site.yml
- hosts: web
  become: true
  vars:
    pkg: nginx
  tasks:
    - name: Install {{ pkg }}
      apt: { name: "{{ pkg }}", state: present, update_cache: true }
    - name: Config from a template
      template: { src: nginx.conf.j2, dest: /etc/nginx/nginx.conf }
      notify: reload nginx        # triggers the handler on change
    - name: Start and enable
      service: { name: "{{ pkg }}", state: started, enabled: true }
  handlers:
    - name: reload nginx
      service: { name: nginx, state: reloaded }

bash

ansible-playbook -i inventory.ini site.yml
ansible-playbook -i inventory.ini site.yml --check --diff
ansible-playbook -i inventory.ini site.yml --limit web1 --tags config
ansible-galaxy init roles/myrole       # role skeleton

Variables go in group_vars/, host_vars/; secrets in ansible-vault (ansible-vault encrypt secrets.yml, run with --ask-vault-pass). The lab machine has no network to the outside: update_cache and packages from the network will not work.

How to read a run, changed=0 on the second run, handlers, --check --diff and playbook errors — ansible-playbook.

UNREACHABLE!

Ansible could not connect over SSH; the module never ran, the exit code is 4. The cause is in msg, which is the error text of ssh itself (lines wrapped):

text

node3 | UNREACHABLE! => {
    "msg": "Failed to connect to the host via ssh: ssh: Could not
      resolve hostname node3: Temporary failure in name resolution",
node2 | UNREACHABLE! => {
    "msg": "Failed to connect to the host via ssh: admin@node2:
      Permission denied (publickey).",
web1 | UNREACHABLE! => {
    "msg": "Failed to connect to the host via ssh: Host key
      verification failed.",

Text	Cause	What to do
Could not resolve hostname	the name is neither in DNS nor in `/etc/hosts`	fix the name or set `ansible_host`
Permission denied (publickey)	this user does not have your key	the right `ansible_user`, or the key in their `authorized_keys`
Host key verification failed	the host key is not in `known_hosts`, or it changed	`ssh` to that address by hand and accept the key; a changed one — `ssh-keygen -R <address>`

On the lab machines host key checking is off for the names node1 and node2 (/etc/ssh/ssh_config.d/99-lab.conf), but not for an IP address in ansible_host: the same node2 by address gives Host key verification failed. Check by hand as the same user: ssh -o BatchMode=yes node2 true; details — ansible … -vvv. Keys — ssh-keys.

Destination /etc not writable

The module runs without root rights: use -b or become: true — ansible.

sudo: a password is required

You need --become and working sudo. With a password — --ask-become-pass (-K) or NOPASSWD, see sudo.

A task is "changed" every time

You're using command/shell instead of an idempotent module. Use modules (apt, copy, template, lineinfile) — they only change things when needed. For command, use creates=/changed_when:, more in ansible-playbook.

Vault: can't decrypt anything

You need the vault password (--ask-vault-pass or --vault-password-file). Without it, encrypted variables are unavailable.

A site on node2, by a playbook from node1

Situation

Task

Constraints

Signing in is needed to start the machine

Inventory

One-off commands

become: through sudo

Playbooks and roles

UNREACHABLE!

Destination /etc not writable

sudo: a password is required

A task is "changed" every time

Vault: can't decrypt anything