Chapter 6. Backing up IdM servers using Ansible playbooks
Using the ipabackup
Ansible role, you can automate backing up an IdM server and transferring backup files between servers and your Ansible controller.
This section covers the following topics:
- Preparing your Ansible control node for managing IdM
- Using Ansible to create a backup of an IdM server
- Using Ansible to create a backup of an IdM server on your Ansible controller
- Using Ansible to copy a backup of an IdM server to your Ansible controller
- Using Ansible to copy a backup of an IdM server from your Ansible controller to the IdM server
- Using Ansible to remove a backup from an IdM server
6.1. Preparing your Ansible control node for managing IdM
As a system administrator managing Identity Management (IdM), when working with Red Hat Ansible Engine, it is good practice to do the following:
- Create a subdirectory dedicated to Ansible playbooks in your home directory, for example ~/MyPlaybooks.
-
Copy and adapt sample Ansible playbooks from the
/usr/share/doc/ansible-freeipa/*
and/usr/share/doc/rhel-system-roles/*
directories and subdirectories into your ~/MyPlaybooks directory. - Include your inventory file in your ~/MyPlaybooks directory.
By following this practice, you can find all your playbooks in one place and you can run your playbooks without invoking root privileges.
You only need root
privileges on the managed nodes to execute the ipaserver
, ipareplica
, ipaclient
, ipabackup
, ipasmartcard_server
and ipasmartcard_client
ansible-freeipa
roles. These roles require privileged access to directories and the dnf
software package manager.
Follow this procedure to create the ~/MyPlaybooks directory and configure it so that you can use it to store and run Ansible playbooks.
Prerequisites
- You have installed an IdM server on your managed nodes, server.idm.example.com and replica.idm.example.com.
- You have configured DNS and networking so you can log in to the managed nodes, server.idm.example.com and replica.idm.example.com, directly from the control node.
-
You know the IdM
admin
password.
Procedure
Create a directory for your Ansible configuration and playbooks in your home directory:
$ mkdir ~/MyPlaybooks/
Change into the ~/MyPlaybooks/ directory:
$ cd ~/MyPlaybooks
Create the ~/MyPlaybooks/ansible.cfg file with the following content:
[defaults] inventory = /home/your_username/MyPlaybooks/inventory [privilege_escalation] become=True
Create the ~/MyPlaybooks/inventory file with the following content:
[ipaserver] server.idm.example.com [ipareplicas] replica1.idm.example.com replica2.idm.example.com [ipacluster:children] ipaserver ipareplicas [ipacluster:vars] ipaadmin_password=SomeADMINpassword [ipaclients] ipaclient1.example.com ipaclient2.example.com [ipaclients:vars] ipaadmin_password=SomeADMINpassword
This configuration defines two host groups, eu and us, for hosts in these locations. Additionally, this configuration defines the ipaserver host group, which contains all hosts from the eu and us groups.
Optional: Create an SSH public and private key. To simplify access in your test environment, do not set a password on the private key:
$ ssh-keygen
Copy the SSH public key to the IdM
admin
account on each managed node:$ ssh-copy-id admin@server.idm.example.com $ ssh-copy-id admin@replica.idm.example.com
You must enter the IdM
admin
password when you enter these commands.
Additional resources
6.2. Using Ansible to create a backup of an IdM server
You can use the ipabackup
role in an Ansible playbook to create a backup of an IdM server and store it on the IdM server.
Prerequisites
You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.14 or later.
-
You have installed the
ansible-freeipa
package on the Ansible controller. - The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
-
The example assumes that the secret.yml Ansible vault stores your
ipaadmin_password
.
-
The target node, that is the node on which the
ansible-freeipa
module is executed, is part of the IdM domain as an IdM client, server or replica.
Procedure
Navigate to the
~/MyPlaybooks/
directory:$ cd ~/MyPlaybooks/
Make a copy of the
backup-server.yml
file located in the/usr/share/doc/ansible-freeipa/playbooks
directory:$ cp /usr/share/doc/ansible-freeipa/playbooks/backup-server.yml backup-my-server.yml
-
Open the
backup-my-server.yml
Ansible playbook file for editing. Adapt the file by setting the
hosts
variable to a host group from your inventory file. In this example, set it to theipaserver
host group:--- - name: Playbook to backup IPA server hosts: ipaserver become: true roles: - role: ipabackup state: present
- Save the file.
Run the Ansible playbook, specifying the inventory file and the playbook file:
$ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory backup-my-server.yml
Verification
- Log into the IdM server that you have backed up.
Verify that the backup is in the
/var/lib/ipa/backup
directory.[root@server ~]# ls /var/lib/ipa/backup/ ipa-full-2021-04-30-13-12-00
Additional resources
For more sample Ansible playbooks that use the
ipabackup
role, see:-
The
README.md
file in the/usr/share/doc/ansible-freeipa/roles/ipabackup
directory. -
The
/usr/share/doc/ansible-freeipa/playbooks/
directory.
-
The
6.3. Using Ansible to create a backup of an IdM server on your Ansible controller
You can use the ipabackup
role in an Ansible playbook to create a backup of an IdM server and automatically transfer it on your Ansible controller. Your backup file name begins with the host name of the IdM server.
Prerequisites
You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.14 or later.
-
You have installed the
ansible-freeipa
package on the Ansible controller. - The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
-
The example assumes that the secret.yml Ansible vault stores your
ipaadmin_password
.
-
The target node, that is the node on which the
ansible-freeipa
module is executed, is part of the IdM domain as an IdM client, server or replica.
Procedure
To store the backups, create a subdirectory in your home directory on the Ansible controller.
$ mkdir ~/ipabackups
Navigate to the
~/MyPlaybooks/
directory:$ cd ~/MyPlaybooks/
Make a copy of the
backup-server-to-controller.yml
file located in the/usr/share/doc/ansible-freeipa/playbooks
directory:$ cp /usr/share/doc/ansible-freeipa/playbooks/backup-server-to-controller.yml backup-my-server-to-my-controller.yml
-
Open the
backup-my-server-to-my-controller.yml
file for editing. Adapt the file by setting the following variables:
-
Set the
hosts
variable to a host group from your inventory file. In this example, set it to theipaserver
host group. Optional: To maintain a copy of the backup on the IdM server, uncomment the following line:
# ipabackup_keep_on_server: true
-
Set the
By default, backups are stored in the present working directory of the Ansible controller. To specify the backup directory you created in Step 1, add the
ipabackup_controller_path
variable and set it to the/home/user/ipabackups
directory.--- - name: Playbook to backup IPA server to controller hosts: ipaserver become: true vars: ipabackup_to_controller: true # ipabackup_keep_on_server: true ipabackup_controller_path: /home/user/ipabackups roles: - role: ipabackup state: present
- Save the file.
Run the Ansible playbook, specifying the inventory file and the playbook file:
$ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory backup-my-server-to-my-controller.yml
Verification
Verify that the backup is in the
/home/user/ipabackups
directory of your Ansible controller:[user@controller ~]$ ls /home/user/ipabackups server.idm.example.com_ipa-full-2021-04-30-13-12-00
Additional resources
For more sample Ansible playbooks that use the
ipabackup
role, see:-
The
README.md
file in the/usr/share/doc/ansible-freeipa/roles/ipabackup
directory. -
The
/usr/share/doc/ansible-freeipa/playbooks/
directory.
-
The
6.4. Using Ansible to copy a backup of an IdM server to your Ansible controller
You can use an Ansible playbook to copy a backup of an IdM server from the IdM server to your Ansible controller.
Prerequisites
You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.14 or later.
-
You have installed the
ansible-freeipa
package on the Ansible controller. - The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
-
The example assumes that the secret.yml Ansible vault stores your
ipaadmin_password
.
-
The target node, that is the node on which the
ansible-freeipa
module is executed, is part of the IdM domain as an IdM client, server or replica.
Procedure
To store the backups, create a subdirectory in your home directory on the Ansible controller.
$ mkdir ~/ipabackups
Navigate to the
~/MyPlaybooks/
directory:$ cd ~/MyPlaybooks/
Make a copy of the
copy-backup-from-server.yml
file located in the/usr/share/doc/ansible-freeipa/playbooks
directory:$ cp /usr/share/doc/ansible-freeipa/playbooks/copy-backup-from-server.yml copy-backup-from-my-server-to-my-controller.yml
-
Open the
copy-my-backup-from-my-server-to-my-controller.yml
file for editing. Adapt the file by setting the following variables:
-
Set the
hosts
variable to a host group from your inventory file. In this example, set it to theipaserver
host group. -
Set the
ipabackup_name
variable to the name of theipabackup
on your IdM server to copy to your Ansible controller. By default, backups are stored in the present working directory of the Ansible controller. To specify the directory you created in Step 1, add the
ipabackup_controller_path
variable and set it to the/home/user/ipabackups
directory.--- - name: Playbook to copy backup from IPA server hosts: ipaserver become: true vars: ipabackup_name: ipa-full-2021-04-30-13-12-00 ipabackup_to_controller: true ipabackup_controller_path: /home/user/ipabackups roles: - role: ipabackup state: present
-
Set the
- Save the file.
Run the Ansible playbook, specifying the inventory file and the playbook file:
$ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory copy-backup-from-my-server-to-my-controller.yml
To copy all IdM backups to your controller, set the ipabackup_name
variable in the Ansible playbook to all
:
vars:
ipabackup_name: all
ipabackup_to_controller: true
For an example, see the copy-all-backups-from-server.yml
Ansible playbook in the /usr/share/doc/ansible-freeipa/playbooks
directory.
Verification
Verify your backup is in the
/home/user/ipabackups
directory on your Ansible controller:[user@controller ~]$ ls /home/user/ipabackups server.idm.example.com_ipa-full-2021-04-30-13-12-00
Additional resources
-
The
README.md
file in the/usr/share/doc/ansible-freeipa/roles/ipabackup
directory. -
The
/usr/share/doc/ansible-freeipa/playbooks/
directory.
6.5. Using Ansible to copy a backup of an IdM server from your Ansible controller to the IdM server
You can use an Ansible playbook to copy a backup of an IdM server from your Ansible controller to the IdM server.
Prerequisites
You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.14 or later.
-
You have installed the
ansible-freeipa
package on the Ansible controller. - The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
-
The example assumes that the secret.yml Ansible vault stores your
ipaadmin_password
.
-
The target node, that is the node on which the
ansible-freeipa
module is executed, is part of the IdM domain as an IdM client, server or replica.
Procedure
Navigate to the
~/MyPlaybooks/
directory:$ cd ~/MyPlaybooks/
Make a copy of the
copy-backup-from-controller.yml
file located in the/usr/share/doc/ansible-freeipa/playbooks
directory:$ cp /usr/share/doc/ansible-freeipa/playbooks/copy-backup-from-controller.yml copy-backup-from-my-controller-to-my-server.yml
-
Open the
copy-my-backup-from-my-controller-to-my-server.yml
file for editing. Adapt the file by setting the following variables:
-
Set the
hosts
variable to a host group from your inventory file. In this example, set it to theipaserver
host group. Set the
ipabackup_name
variable to the name of theipabackup
on your Ansible controller to copy to the IdM server.--- - name: Playbook to copy a backup from controller to the IPA server hosts: ipaserver become: true vars: ipabackup_name: server.idm.example.com_ipa-full-2021-04-30-13-12-00 ipabackup_from_controller: true roles: - role: ipabackup state: copied
-
Set the
- Save the file.
Run the Ansible playbook, specifying the inventory file and the playbook file:
$ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory copy-backup-from-my-controller-to-my-server.yml
Additional resources
-
The
README.md
file in the/usr/share/doc/ansible-freeipa/roles/ipabackup
directory. -
The
/usr/share/doc/ansible-freeipa/playbooks/
directory.
6.6. Using Ansible to remove a backup from an IdM server
You can use an Ansible playbook to remove a backup from an IdM server.
Prerequisites
You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.14 or later.
-
You have installed the
ansible-freeipa
package on the Ansible controller. - The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
-
The example assumes that the secret.yml Ansible vault stores your
ipaadmin_password
.
-
The target node, that is the node on which the
ansible-freeipa
module is executed, is part of the IdM domain as an IdM client, server or replica.
Procedure
Navigate to the ~/MyPlaybooks/ directory:
$ cd ~/MyPlaybooks/
Make a copy of the
remove-backup-from-server.yml
file located in the/usr/share/doc/ansible-freeipa/playbooks
directory:$ cp /usr/share/doc/ansible-freeipa/playbooks/remove-backup-from-server.yml remove-backup-from-my-server.yml
-
Open the
remove-backup-from-my-server.yml
file for editing. Adapt the file by setting the following variables:
-
Set the
hosts
variable to a host group from your inventory file. In this example, set it to theipaserver
host group. Set the
ipabackup_name
variable to the name of theipabackup
to remove from your IdM server.--- - name: Playbook to remove backup from IPA server hosts: ipaserver become: true vars: ipabackup_name: ipa-full-2021-04-30-13-12-00 roles: - role: ipabackup state: absent
-
Set the
- Save the file.
Run the Ansible playbook, specifying the inventory file and the playbook file:
$ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory remove-backup-from-my-server.yml
To remove all IdM backups from the IdM server, set the ipabackup_name
variable in the Ansible playbook to all
:
vars:
ipabackup_name: all
For an example, see the remove-all-backups-from-server.yml
Ansible playbook in the /usr/share/doc/ansible-freeipa/playbooks
directory.
Additional resources
-
The
README.md
file in the/usr/share/doc/ansible-freeipa/roles/ipabackup
directory. -
The
/usr/share/doc/ansible-freeipa/playbooks/
directory.