Chapter 15. Using Ansible to manage the replication topology in IdM

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the add-topologysegment.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/add-topologysegment.yml add-topologysegment-copy.yml

3. Open the add-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the suffix variable to either domain or ca, depending on what type of segment you want to add.
   • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
   • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.
   • Ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysegment
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
   - name: Add topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: domain
         left: server.idm.example.com
         right: replica.idm.example.com
         state: present

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory add-topologysegment-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the add-topologysegments.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/add-topologysegments.yml add-topologysegments-copy.yml

3. Open the add-topologysegments-copy.yml file for editing.

4. Adapt the file by setting the following variables in the vars section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • For every topology segment, add a line in the ipatopology_segments section and set the following variables:

     • Set the suffix variable to either domain or ca, depending on what type of segment you want to add.
     • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
     • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.

5. In the tasks section of the add-topologysegments-copy.yml file, ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Add topology segments
     hosts: ipaserver
     gather_facts: false
   
     vars:
       ipaadmin_password: "{{ ipaadmin_password }}"
       ipatopology_segments:
       - {suffix: domain, left: replica1.idm.example.com , right: replica2.idm.example.com }
       - {suffix: domain, left: replica2.idm.example.com , right: replica3.idm.example.com }
       - {suffix: domain, left: replica3.idm.example.com , right: replica4.idm.example.com }
       - {suffix: domain+ca, left: replica4.idm.example.com , right: replica1.idm.example.com }
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Add topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: "{{ item.suffix }}"
         name: "{{ item.name | default(omit) }}"
         left: "{{ item.left }}"
         right: "{{ item.right }}"
         state: present
       loop: "{{ ipatopology_segments | default([]) }}"

6. Save the file.

7. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory add-topologysegments-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the check-topologysegments.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/check-topologysegments.yml check-topologysegments-copy.yml

3. Open the check-topologysegments-copy.yml file for editing.

4. Adapt the file by setting the following variables in the vars section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • For every topology segment, add a line in the ipatopology_segments section and set the following variables:

     • Set the suffix variable to either domain or ca, depending on the type of segment you are adding.
     • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
     • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.

5. In the tasks section of the check-topologysegments-copy.yml file, ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Add topology segments
     hosts: ipaserver
     gather_facts: false
   
     vars:
       ipaadmin_password: "{{ ipaadmin_password }}"
       ipatopology_segments:
       - {suffix: domain, left: replica1.idm.example.com, right: replica2.idm.example.com }
       - {suffix: domain, left: replica2.idm.example.com , right: replica3.idm.example.com }
       - {suffix: domain, left: replica3.idm.example.com , right: replica4.idm.example.com }
       - {suffix: domain+ca, left: replica4.idm.example.com , right: replica1.idm.example.com }
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Check topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: "{{ item.suffix }}"
         name: "{{ item.name | default(omit) }}"
         left: "{{ item.left }}"
         right: "{{ item.right }}"
         state: checked
       loop: "{{ ipatopology_segments | default([]) }}"

6. Save the file.

7. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory check-topologysegments-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the verify-topologysuffix.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/ verify-topologysuffix.yml verify-topologysuffix-copy.yml

3. Open the verify-topologysuffix-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipatopologysuffix section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the suffix variable to domain. If you are verifying the presence of the ca suffix, set the variable to ca.
   • Ensure that the state variable is set to verified. No other option is possible.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysuffix
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Verify topology suffix
       ipatopologysuffix:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: domain
         state: verified

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory verify-topologysuffix-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the reinitialize-topologysegment.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/reinitialize-topologysegment.yml reinitialize-topologysegment-copy.yml

3. Open the reinitialize-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the suffix variable to domain. If you are reinitializing the ca data, set the variable to ca.
   • Set the left variable to the left node of the replication agreement.
   • Set the right variable to the right node of the replication agreement.
   • Set the direction variable to the direction of the reinitializing data. The left-to-right direction means that data flows from the left node to the right node.

   • Ensure that the state variable is set to reinitialized.

     This is the modified Ansible playbook file for the current example:

     ---
     - name: Playbook to handle topologysegment
       hosts: ipaserver
     
       vars_files:
       - /home/user_name/MyPlaybooks/secret.yml
       tasks:
       - name: Reinitialize topology segment
         ipatopologysegment:
           ipaadmin_password: "{{ ipaadmin_password }}"
           suffix: domain
           left: server.idm.example.com
           right: replica.idm.example.com
           direction: left-to-right
           state: reinitialized

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory reinitialize-topologysegment-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the delete-topologysegment.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/delete-topologysegment.yml delete-topologysegment-copy.yml

3. Open the delete-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the suffix variable to domain. Alternatively, if you are ensuring that the ca data are not replicated between the left and right nodes, set the variable to ca.
   • Set the left variable to the name of the IdM server that is the left node of the replication agreement.
   • Set the right variable to the name of the IdM server that is the right node of the replication agreement.
   • Ensure that the state variable is set to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysegment
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
   - name: Delete topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: domain
         left: replica01.idm.example.com
         right: replica02.idm.example.com:
         state: absent

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory delete-topologysegment-copy.yml