Chapter 5. Preparing your environment for managing IdM using Ansible playbooks

Procedure

1. Change into the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks

   Copy to Clipboard Toggle word wrap

2. Create the ~/MyPlaybooks/ansible.cfg file with the following content:

   [defaults]
   inventory = /home/your_username/MyPlaybooks/inventory
   remote_user = admin

   Copy to Clipboard Toggle word wrap

3. Create the ~/MyPlaybooks/inventory file with the following content:

   [eu]
   server.idm.example.com
   
   [us]
   replica.idm.example.com
   
   [ipaserver:children]
   eu
   us

   Copy to Clipboard Toggle word wrap

   This configuration defines two host groups, eu and us, for hosts in these locations. Additionally, this configuration defines the ipaserver host group, which contains all hosts from the eu and us groups.

4. Optional: Create an SSH public and private key. To simplify access in your test environment, do not set a password on the private key:

   $ ssh-keygen

   Copy to Clipboard Toggle word wrap

5. Copy the SSH public key to the IdM admin account on each managed node:

   $ ssh-copy-id admin@server.idm.example.com
   $ ssh-copy-id admin@replica.idm.example.com

   Copy to Clipboard Toggle word wrap

   These commands require that you enter the IdM admin password.

6. Create a password_file file that contains the vault password:

   redhat

   Copy to Clipboard Toggle word wrap

7. Change the permissions to modify the file:

   $ chmod 0600 password_file

   Copy to Clipboard Toggle word wrap

8. Create a secret.yml Ansible vault to store the IdM admin password:

   1. Configure password_file to store the vault password:

      $ ansible-vault create --vault-password-file=password_file secret.yml

      Copy to Clipboard Toggle word wrap

   2. When prompted, enter the content of the secret.yml file:

      ipaadmin_password: Secret123

      Copy to Clipboard Toggle word wrap
      Note

      To use the encrypted ipaadmin_password in a playbook, you must use the vars_file directive. For example, a simple playbook to delete an IdM user can look as follows:

      ---
      - name: Playbook to handle users
        hosts: ipaserver
      
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
      
        tasks:
        - name: Delete user robot
          freeipa.ansible_freeipa.ipauser:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: robot
            state: absent

      Copy to Clipboard Toggle word wrap

      When executing a playbook, instruct Ansible use the vault password to decrypt ipaadmin_password by adding the --vault-password-file=password_file option. For example:

      ansible-playbook -i inventory --vault-password-file=password_file del-user.yml

      Copy to Clipboard Toggle word wrap
      Warning

      For security reasons, remove the vault password file at the end of each session, and repeat steps 6-8 at the start of each new session.

Procedure

1. Create a file, for example inventory.yml, to generate a dynamic inventory based on your selected IdM server role or roles. For example, to create an inventory of servers that have the IdM DNS server role:

   ---
   plugin: freeipa
   server: server.idm.example.com
   ipaadmin_password: Secret123
   verify: ca.crt
   role: DNS server

   Copy to Clipboard Toggle word wrap
   • server defines the fully-qualified domain name of the host to start the scan.
   • verify defines the server TLS certificate file for verification.
   • role defines all the server roles that a host must have for the host to be returned.

2. Create a playbook, for example bind-playbook.yml, that you want to execute against the IdM servers identified by the freeipa inventory plugin. For example, to determine the release version of the bind package installed on the IdM DNS servers:

   ---
   - name: Check bind version
     hosts: ipaservers
   
     tasks:
       - name: Query bind package version
         package:
           name: bind
           state: present
         register: bind_version
   
       - name: Display bind release info
         debug:
           msg: "Bind release: {{ bind_version.results[0].version }}"

   Copy to Clipboard Toggle word wrap

3. [Optional] Create a graph representation of the IdM servers identified by the plugin:

   $ ansible-inventory -i inventory.yml --graph
   @all:
     |--@ungrouped
     |--@ipaservers:
     |  |--replica01.idm.example.com

   Copy to Clipboard Toggle word wrap

4. Run the Ansible playbook. Specify the inventory.yml file as inventory:

   $ ansible-playbook -i inventory.yml bind-playbook.yml
   [...]
   TASK [Display bind release info]
   ok: [10.0.193.174] => {
       "msg": "Bind release: 9.20.3"
   }
   [...]

   Copy to Clipboard Toggle word wrap