Ansible Cheat Sheet

Ansible
------------------------------------------------------------------------------------------------------------
Playbook Format
------------------------------------------------------------------------------------------------------------
- name: play1
  hosts: class
  become: true
  tasks:
  - name: Adding user
    user:
      name: ansible
      comment: "GECOS VALUE"
      groups: wheel
      password:changeme
      generate_ssh_key: yes
      createhome: yes
    tags:
      - useradd
  - name: Deleting user
    user:
      name: ansible
      state: absent
    tags:
      - userdel
------------------------------------------------------------------------------------------------------------------------
Basic Commands
------------------------------------------------------------------------------------------------------------------------
Running ansible playbook
# ansible-playbook playbook.yml

Running commands using ssh and sudo password
# ansible-playbook user.yaml -u username --ask-pass --ask-su-pass

Dry run
ansible-playbook -C user.yaml

Syntax Check
# ansible-playbook --syntax-check user.yaml

To enter encrypted password in palybbok
# openssl passwd -1 "plaintextpassword"

To set password of vault:
# ansible-vault encrypt playbook.yml

To edit encrypted yml file:
# ansible-vault edit playbook.yml

To decrypt password:
# ansible-vault decrypt playbook.yml

To run encrypted playbook:
# ansible-vault playbook.yml --ask-vault-pass

To run playbook using tags:
# ansible-playbook playbook.yml --tags tag-name

Creating roles
# ansible-galaxy init users
-----------------------------------------------------------------------------------------------------------------------------
Roles directory structure
-----------------------------------------------------------------------------------------------------------------------------
defaults: default variables used by a role
vars: vars and defaults house variables, but variables in vars have a higher priority
files: where you put files that need to be added to the machine being provisioned
handlers: contain targets for notify directives, and are almost always associated with services
meta: metadata of an Ansible role consists of attributes such as author, supported platforms, and dependencies
tasks: houses a series of Ansible plays to install, configure, and run software
templates: similar to files except that templates support modification as they’re added to the machine being provisioned
-----------------------------------------------------------------------------------------------------------------------------
Configuration file
-----------------------------------------------------------------------------------------------------------------------------
[defaults]
inventory=/home/ansible/inventory                      -- location of inventory file
remote_user=username                                            -- User used to execute tasks
forks=5          -- Tasks will be executed on 5 hosts in parallel
[priviledge_escalation]   
become=True                                                       -- To activate priviledges escalation
become_method=sudo                                                -- Method used for root priviledges
become_ask_pass=True                                              -- Ask for sudo password
become_user=username        -- the user you become, NOT the user you login as
-----------------------------------------------------------------------------------------------------------------------------
delegate_to keyword
-----------------------------------------------------------------------------------------------------------------------------
If you want to perform a task on one host with reference to other hosts

- name: take out of load balancer pool
    command: /usr/bin/take_out_of_pool {{ inventory_hostname }}
    delegate_to: 127.0.0.1
-----------------------------------------------------------------------------------------------------------------------------
Register variable
-----------------------------------------------------------------------------------------------------------------------------
It will store the output in variable and we can use output later

- name: Ansible register with_items example
    shell: "find *.txt"
    args:
      chdir: "/Users/mdtutorials2/Documents/Ansible"
    register: with_output

  - shell: "cp {{ item }} {{item}}_bkp"
    with_items:
      - "{{ with_output.stdout_lines }}"

  - name: User creation and deletion evidence
    shell: "echo On {{inventory_hostname}} && getent passwd testing"
    tags:
      - evidence
    register: output
  - name: local file
    copy:
       content: "{{ output.stdout }}"
       dest: "evidence.txt"
    delegate_to: localhost
    tags:
    - fetch
-----------------------------------------------------------------------------------------------------------------------------
Command Line options
-----------------------------------------------------------------------------------------------------------------------------
--ask-su-pass
ask for su password (deprecated, use become)

--ask-sudo-pass
ask for sudo password (deprecated, use become)

--ask-vault-pass
ask for vault password

--become-method <BECOME_METHOD>
privilege escalation method to use (default=sudo), valid choices: [ sudo | su | pbrun | pfexec | doas | dzdo | ksu | runas | pmrun | enable ]

--become-user <BECOME_USER>
run operations as this user (default=root)

--list-hosts
outputs a list of matching hosts; does not execute anything else

--playbook-dir <BASEDIR>
Since this tool does not use playbooks, use this as a subsitute playbook directory.This sets the relative path for many features including roles/ group_vars/ etc.

--syntax-check
perform a syntax check on the playbook, but do not execute it

-C, --check
don’t make any changes; instead, try to predict some of the changes that may occur

-K, --ask-become-pass
ask for privilege escalation password

-f <FORKS>, --forks <FORKS>
specify number of parallel processes to use (default=5)

-i, --inventory, --inventory-file
specify inventory host path or comma separated host list. –inventory-file is deprecated

-k, --ask-pass
ask for connection password

-t <TREE>, --tree <TREE>
log output to this directory

run_once: true --  means to run the task for exactly one host in the list of hosts. 
-----------------------------------------------------------------------------------------------------------------------------------
Modules
------------------------------------------------------------------------------------------------------------------------------------
yum:
    name: "httpd", "*", "@Development tools"
    state: present, absent, latest
    security: yes
    enablerepo: "epel,ol7_latest"
    disablerepo: "epel,ol7_latest"
    update_cache: yes, no
    exclude: kernel*,foo*

apt:
    name: foo, "*"
    update_cache: yes
    state: present, absent, latest
    upgrade: dist
    autoclean: yes
    autoremove: yes

user:
    name: johnd
    comment: John Doe
    uid: 1040
    group: admin
    shell: /bin/bash
    groups: admins,developers
    append: yes
    generate_ssh_key: yes
    ssh_key_bits: 2048
    ssh_key_file: .ssh/id_rsa
    expires: 1422403387
    state: absent, present
    update_password: on_create 

lvol:
    vg: firefly
    lv: test
    size: 512, 100%FREE, +100%FREE, 80%VG
    pvs: /dev/sda,/dev/sdb
    resizefs: true
    state: absent
    force: yes
    snapshot: snap1
   

#!/bin/sh
free -m | awk 'NR==2{printf "Memory Usage: %s/%sMB (%.2f%%)\n", $3,$2,$3*100/$2 }'
df -h | awk '$NF=="/"{printf "Disk Usage: %d/%dGB (%s)\n", $3,$2,$5}'
top -bn1 | grep load | awk '{printf "CPU Load: %.2f\n", $(NF-2)}'

setup variables:
"ansible_system_vendor": "VMware, Inc.",
"ansible_swapfree_mb": 1999,
"ansible_swaptotal_mb": 1999,
"ansible_system": "Linux",
"ansible_processor_cores": 1,
"ansible_processor_count": 1,
"ansible_processor_threads_per_core": 1,
"ansible_nodename": "mbunixlmc801",
"ansible_os_family": "Debian",
"ansible_memtotal_mb": 2000,
"ansible_mounts":
"ansible_memfree_mb": 924,
"ansible_memory_mb": 
"ansible_lsb": 
"ansible_kernel":
"ansible_fqdn": "mbunixlmc801.ucsfmedicalcenter.org",
"ansible_hostname": "mbunixlmc801",
"ansible_interfaces": 
"ansible_domain": "ucsfmedicalcenter.org",
"ansible_distribution": "Ubuntu",
"ansible_distribution_version": "16.04",
"ansible_dns": 
"ansible_devices.sda.partitions": 
"ansible_default_ipv4":
"ansible_bios_date": "09/21/2015",
"ansible_bios_version": "6.00",