2.2. Using Ansible to ensure replication agreements exist between multiple IdM replicas

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the add-topologysegments.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/topology/add-topologysegments.yml add-topologysegments-copy.yml

3. Open the add-topologysegments-copy.yml file for editing.

4. Adapt the file by setting the following variables in the vars section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • For every topology segment, add a line in the ipatopology_segments section and set the following variables:

     • Set the suffix variable to either domain or ca, depending on what type of segment you want to add.
     • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
     • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.

5. In the tasks section of the add-topologysegments-copy.yml file, ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Add topology segments
     hosts: ipaserver
     gather_facts: false
   
     vars:
       ipaadmin_password: "{{ ipaadmin_password }}"
       ipatopology_segments:
       - {suffix: domain, left: replica1.idm.example.com , right: replica2.idm.example.com }
       - {suffix: domain, left: replica2.idm.example.com , right: replica3.idm.example.com }
       - {suffix: domain, left: replica3.idm.example.com , right: replica4.idm.example.com }
       - {suffix: domain+ca, left: replica4.idm.example.com , right: replica1.idm.example.com }
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Add topology segment
       freeipa.ansible_freeipa.ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: "{{ item.suffix }}"
         name: "{{ item.name | default(omit) }}"
         left: "{{ item.left }}"
         right: "{{ item.right }}"
         state: present
       loop: "{{ ipatopology_segments | default([]) }}"

6. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-topology.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/topology directory on the control node.

7. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory add-topologysegments-copy.yml