济南外贸网站推广_app定制开发网络公司_怎样制作网站教程_web网页制作成品

Last Chapter of this RH 294 Ansible Course

Some comment:

1. This course is from RH partner website(It is kind of company resource)
2. I completed the RH294 course self learning at Oct.11 2024, which started from Jul.19, it is quite a long time, I keep studying it almost every night and off work hours when I am available. (Only After my son went sleeping, LOL)
3. SELF DISCIPLINE is important
4. The Original markdown file contains ALL chapters is available in my github: RH294-RHEL-Automation-with-Ansible
5. If any questions about accessing the files, kindly comment in this article, I will reply when I see it.

---

Chapter 10. Comprehensive Review

Reviewing Red Hat Enterprise Linux Automation with Ansible

Before beginning the comprehensive review for this course, you should be comfortable with the topics covered in each chapter. Do not hesitate to ask the instructor for extra guidance or clarification on these topics.

Summary

Chapter 1, Introducing Ansible

Describe the fundamental concepts of Ansible and how it is used, and install development tools from Red Hat Ansible Automation Platform.

• Describe the motivation for automating Linux administration tasks with Ansible, fundamental Ansible concepts, and the basic architecture of Ansible.
• Install Ansible on a control node and describe the distinction between community Ansible and Red Hat Ansible Automation Platform.

Chapter 2, Implementing an Ansible Playbook

Create an inventory of managed hosts, write a simple Ansible Playbook, and run the playbook to automate tasks on those hosts.

• Describe Ansible inventory concepts and manage a static inventory file.
• Describe where Ansible configuration files are located, how Ansible selects them, and edit them to apply changes to default settings.
• Write a basic Ansible Playbook and run it using the automation content navigator.
• Write a playbook that uses multiple plays with per-play privilege escalation, and effectively use automation content navigator to find new modules in available Ansible Content Collections and use them to implement tasks for a play.

Chapter 3, Managing Variables and Facts

Write playbooks that use variables to simplify management of the playbook and facts to reference information about managed hosts.

• Create and reference variables that affect particular hosts or host groups, the play, or the global environment, and describe how variable precedence works.
• Encrypt sensitive variables using Ansible Vault, and run playbooks that reference Vault-encrypted variable files.
• Reference data about managed hosts using Ansible facts, and configure custom facts on managed hosts.

Chapter 4, Implementing Task Control

Manage task control, handlers, and task errors in Ansible Playbooks.

• Use loops to write efficient tasks and use conditions to control when to run tasks.
• Implement a task that runs only when another task changes the managed host.
• Control what happens when a task fails, and what conditions cause a task to fail.

Chapter 5, Deploying Files to Managed Hosts

Deploy, manage, and adjust files on hosts managed by Ansible.

• Create, install, edit, and remove files on managed hosts, and manage the permissions, ownership, SELinux context, and other characteristics of those files.
• Deploy files to managed hosts that are customized by using Jinja2 templates.

Chapter 6, Managing Complex Plays and Playbooks

Write playbooks for larger, more complex plays and playbooks.

• Write sophisticated host patterns to efficiently select hosts for a play.
• Manage large playbooks by importing or including other playbooks or tasks from external files, either unconditionally or based on a conditional test.

Chapter 7, Simplifying Playbooks with Roles and Ansible Content Collections

Use Ansible Roles and Ansible Content Collections to develop playbooks more quickly and to reuse Ansible code.

• Describe the purpose of an Ansible Role, its structure, and how roles are used in playbooks.
• Create a role in a playbook’s project directory and run it as part of one of the plays in the playbook.
• Select and retrieve roles from external sources such as Git repositories or Ansible Galaxy, and use them in your playbooks.
• Obtain a set of related roles, supplementary modules, and other content from an Ansible Content Collection and use them in a playbook.
• Write playbooks that take advantage of system roles for Red Hat Enterprise Linux to perform standard operations.

Chapter 8, Troubleshooting Ansible

Troubleshoot playbooks and managed hosts.

• Troubleshoot generic issues with a new playbook and repair them.
• Troubleshoot failures on managed hosts when running a playbook.

Chapter 9, Automating Linux Administration Tasks

Automate common Linux system administration tasks with Ansible.

• Subscribe systems, configure software channels and repositories, enable module streams, and manage RPM packages on managed hosts.
• Manage Linux users and groups, configure SSH, and modify Sudo configuration on managed hosts.
• Manage service startup, schedule processes with at, cron, and systemd, reboot managed hosts with reboot, and control the default boot target on managed hosts.
• Partition storage devices, configure LVM, format partitions or logical volumes, mount file systems, and add swap spaces.
• Configure network settings and name resolution on managed hosts, and collect network-related Ansible facts.

LABs

Lab: Deploying Ansible

Specifications

• Install the automation content navigator on workstation so that it can serve as the control node. The Yum repository containing the package has been configured on workstation for you.
• Your Ansible project directory is /home/student/review-cr1.
• On the control node, create the /home/student/review-cr1/inventory inventory file. The inventory must contain a group called dev that consists of the servera.lab.example.com and serverb.lab.example.com managed hosts.
• Create an Ansible configuration file named /home/student/review-cr1/ansible.cfg. This configuration file must use the /home/student/review-cr1/inventory file as the project inventory file.
• Log in to your private automation hub at utility.lab.example.com from the command line before attempting to run automation content navigator, so that you can pull automation execution environment images from its container registry. Your username is admin and your password is redhat.
• Create a configuration file for automation content navigator named /home/student/review-cr1/ansible-navigator.yml. This configuration file must set the default automation execution environment image to utility.lab.example.com/ee-supported-rhel8:latest, and automation content navigator must only pull this image from the container repository if the image is missing on your control node.
• Create a playbook named users.yml in the project directory. It must contain one play that runs on managed hosts in the dev group. Its play must use one task to add the users joe and sam to all managed hosts in the dev group. Run the users.yml playbook and confirm that it works.
• Inspect the existing packages.yml playbook. In the play in that playbook, define a play variable named packages with a list of two packages as its value: httpd and mariadb-server. Run the packages.yml playbook and confirm that both of those packages are installed on the managed hosts on which the playbook ran.
• Add a task to the packages.yml playbook that installs the redis package if the total swap space on the managed host is greater than 10 MB. Run the packages.yml playbook again after adding this task.
• Troubleshoot the existing verify_user.yml playbook. It is supposed to verify that the sam user was created successfully, and it is not supposed to create the sam user if it is missing. Run the playbook with the --check option and resolve any errors. Repeat this process until you can run the playbook with the --check option and it passes, and then run the verify_user.yml playbook normally.

[student@workstation review-cr1]$ cat ansible.cfg 
[defaults]
inventory = ./inventory[privilege_escalation]
become = true
become_method = sudo
become_user = root[student@workstation review-cr1]$ cat ansible-navigator.yml 
---
ansible-navigator:execution-environment:image: utility.lab.example.com/ee-supported-rhel8:latestpull:policy: missingplaybook-artifact:enable: truemode: stdout[student@workstation review-cr1]$ cat inventory 
[dev]
servera.lab.example.com
serverb.lab.example.com

# packages.yml 
---
- name: Install packageshosts: devvars:packages:- httpd- mariadb-servertasks:- name: show the ansible_factsansible.builtin.debug:var: ansible_facts['swaptotal_mb']- name: Install redis if swap space lowansible.builtin.dnf:name: redisstate: presentwhen: ansible_facts['swaptotal_mb'] > 10- name: Install the required packagesansible.builtin.dnf:name: "{{ packages }}"state: latest

# users.yml
---
- name: Add usershosts: devtasks:- name: Add the users joe and samansible.builtin.user:name: "{{ item }}"loop:- joe- sam

# verify_user.yml 
---
- name: Verify the sam user was createdhosts: devtasks:- name: Verify the sam user existsansible.builtin.user:name: samcheck_mode: trueregister: sam_check- name: Sam was createdansible.builtin.debug:msg: "Sam was created"when: sam_check['changed'] == false- name: Output sam user status to fileansible.builtin.lineinfile:path: /home/student/verify.txtline: "Sam was created"create: truewhen: sam_check['changed'] == false

Lab: Creating Playbooks

Specifications

• Create the playbooks specified by this activity in the /home/student/review-cr2 project directory.
• Create a playbook named dev_deploy.yml with one play that runs on the webservers host group (which contains the servera.lab.example.com and serverb.lab.example.com managed hosts). Enable privilege escalation for the play. Add the following tasks to the play:
  • Install the httpd package.
  • Start the httpd service and enable it to start on boot.
  • Deploy the templates/vhost.conf.j2 template to /etc/httpd/conf.d/vhost.conf on the managed hosts. This task should notify the Restart httpd handler.
  • Copy the files/index.html file to the /var/www/vhosts/*hostname* directory on the managed hosts. Ensure that the destination directory is created if it does not already exist.
  • Configure the firewall to allow the httpd service.
  • Add a Restart httpd handler to the play that restarts the httpd service.
• Create a playbook named get_web_content.yml with one play named Test web content that runs on the workstation managed host. This playbook tests whether the dev_deploy.yml playbook was run successfully and ensures that the web server is serving content. Enable privilege escalation for the play. Structure the play as follows:
  • Create a block and rescue task named Retrieve web content and write to error log on failure.
  • Inside the block, create a task named Retrieve web content that uses the ansible.builtin.uri module to return content from http://serverb.lab.example.com. Register the results in a variable named content.
  • Inside the rescue clause, create a task named Write to error file that writes the value of the content variable to the /home/student/review-cr2/error.log file if the block fails. The task must create the error.log file if it does not already exist.
• Create a new site.yml playbook that imports the plays from both the dev_deploy.yml and the get_web_content.yml playbooks.
• After you have completed the rest of the specifications, run the site.yml playbook. Make sure that all three playbooks run successfully.

[student@workstation review-cr2]$ tree 
.
├── ansible.cfg
├── files
│   └── index.html
├── inventory
└── templates└── vhost.conf.j22 directories, 4 files
[student@workstation review-cr2]$ cat ansible.cfg 
[defaults]
remote_user = devops
inventory = ./inventory[privilege_escalation]
become_user = root
become_method = sudo[student@workstation review-cr2]$ cat files/index.html 
This is a test page.[student@workstation review-cr2]$ cat inventory 
workstation[webservers]
servera.lab.example.com
serverb.lab.example.com[student@workstation review-cr2]$ cat templates/vhost.conf.j2 
# {{ ansible_managed }}<VirtualHost *:80>ServerAdmin webmaster@{{ ansible_fqdn }}ServerName {{ ansible_fqdn }}ErrorLog logs/{{ ansible_hostname }}-error.logCustomLog logs/{{ ansible_hostname }}-common.log commonDocumentRoot /var/www/vhosts/{{ ansible_hostname }}/<Directory /var/www/vhosts/{{ ansible_hostname }}/>Options +Indexes +FollowSymlinks +IncludesOrder allow,denyAllow from all</Directory>
</VirtualHost>

# dev_deploy.yml 
---
- name: Lab deploying playbookhosts: webserversbecome: truetasks:- name: Installing packageansible.builtin.dnf:name: httpd, firewalldstate: present- name: Starting serviceansible.builtin.service:name: httpdstate: startedenabled: true- name: Deploy templateansible.builtin.template:src: templates/vhost.conf.j2dest: '/etc/httpd/conf.d/vhost.conf'owner: rootgroup: rootmode: 0644notify: - Restart httpd- name: Ensure destination web directory is thereansible.builtin.file:name: "/var/www/vhosts/{{ ansible_facts['hostname'] }}"state: directoryowner: rootgroup: rootmode: 0755- name: Copy index fileansible.builtin.copy:src: files/index.htmldest: "/var/www/vhosts/{{ ansible_facts['hostname'] }}"owner: rootgroup: rootmode: 0644- name: Starting firewallansible.builtin.service:name: firewalldstate: started- name: Config firewall for apacheansible.posix.firewalld:service: httppermanent: trueimmediate: truestate: enabledhandlers:- name: Restart httpdansible.builtin.service:name: httpdstate: restarted

# get_web_content.yml 
---
- name: Test web contenthosts: webserversbecome: truetasks:- name: Retrieve web content and write to error log on failureblock:- name: Retrieve web contentansible.builtin.uri:url: http://serverb.lab.example.comreturn_content: trueregister: content- name: Show the contentansible.builtin.debug:var: contentrescue:- name: Write to error fileansible.builtin.lineinfile:path: /home/student/review-cr2/error.logline: "{{ content }}"create: truestate: present

# site.yml 
---
- name: Deploy web serversansible.builtin.import_playbook: dev_deploy.yml- name: Retrieve web contentansible.builtin.import_playbook: get_web_content.yml

Lab: Managing Linux Hosts and Using System Roles

[student@workstation review-cr3]$ ll
total 804
-rw-r--r--. 1 student student    192 Oct 10 23:43 ansible.cfg
drwxrwxr-x. 2 student student     22 Oct 10 23:43 collections
-rw-r--r--. 1 student student     37 Oct 10 23:43 inventory
-rw-r--r--. 1 student student    808 Oct 10 23:43 pass-vault.yml
-rw-r--r--. 1 student student 808333 Oct 10 23:43 redhat-rhel_system_roles-1.19.3.tar.gz
[student@workstation review-cr3]$ cat ansible.cfg 
[defaults]
remote_user=devops
inventory=./inventory
collections_paths=./collections:~/.ansible/collections:/usr/share/ansible/collections[privilege_escalation]
become=yes
become_method=sudo
[student@workstation review-cr3]$ tree collections/
collections/0 directories, 0 files
[student@workstation review-cr3]$ 
[student@workstation review-cr3]$ cat inventory 
[webservers]
servera.lab.example.com
[student@workstation review-cr3]$ 
[student@workstation review-cr3]$ cat pass-vault.yml 
$ANSIBLE_VAULT;1.1;AES256
36343762643130643961343163303465373863653933333231343232663832326263613137383432
6263343264633238383561323863393431376365633634320a336338613362303664323934306662
38383632386633313562623738343764626563326137306235373464626163363436363037666432
3762343461653130310a663061363135383239313465306164626239616431646636316466636630
35663839336131636166306138626430623338663030306232383738386430333262663737353039
35663865343635383831386530383063646630653339373062353439373861613739626533303135
36356536363539376236663962366265663663313064343938326365383166623364646338363865
38623038323262636161393064373536613430613265336634633862323131316636646437396535
66373738343432353036633731636438653263383166616338343137346362646561383930396534
3961393030376565636631333730626666633362366565366438

# storage.yml 
---
- name: Creating LVM via system roleshosts: webserversroles:- name: redhat.rhel_system_roles.storagestorage_pools:- name: vg_webtype: lvmdisks:- /dev/vdbvolumes:- name: lv_contentsize: 128mfs_type: xfsmount_point: '/var/www/html/content'state: present- name: lv_uploadssize: 256mfs_type: xfsmount_point: '/var/www/html/uploads'state: presentpost_tasks:- name: Gather information of LVMansible.builtin.command: cat /etc/fstabregister: result- name: Show the resultdebug:var: result['stdout_lines']# dev-users.yml 
---
- name: user managementhosts: webserversvars_files:- pass-vault.ymltasks:- name: Create group if not existansible.builtin.group:name: webdevstate: present- name: Create the developer if not existansible.builtin.user:name: developerstate: presentgroups: webdevpassword: "{{ pwhash }}"- name: Manage Sudo for the groupansible.builtin.lineinfile:path: /etc/sudoers.d/webdevstate: presentcreate: truemode: 0440line: "%webdev ALL=(ALL) NOPASSWD: ALL"validate: /usr/sbin/visudo -cf %s# network.yml 
---
- name: Config network via system roleshosts: webserversroles: - name: redhat.rhel_system_roles.networknetwork_provider: nmnetwork_connections:- name: eth1type: ethernetip:address:- 172.25.250.45/24# log-rotate.yml 
---
- name: Cron job to rotate logshosts: webserverstasks:- name: creating a cron jobansible.builtin.cron:name: rotating the httpd logsuser: devopsjob: logrotate -f /etc/logrotate.d/httpdcron_file: rotate_webminute: 00hour: 00state: present# site.yml 
---
- name: storage partansible.builtin.import_playbook: storage.yml- name: User partansible.builtin.import_playbook: dev-users.yml- name: network partansible.builtin.import_playbook: network.yml- name: log partansible.builtin.import_playbook: log-rotate.yml

Lab: Creating Roles

• The review-cr4 directory contains your Ansible project for this activity.

• Convert the ansible-httpd.yml playbook in the project directory into a new Ansible role named ansible-httpd. The new role must be created in the /home/student/review-cr4/roles/ansible-httpd directory.

• Copy any variables, tasks, templates, files, and handlers that were used in or by the playbook into the appropriate files or directories in the new role. Copy the playbook variables to the roles/ansible-httpd/defaults/main.yml file.

• Update the meta/main.yml file in the role with the following content:

  Variable	Value
  author	Red Hat Training
  description	example role for RH294
  company	Red Hat
  license	BSD

• Edit the roles/ansible-httpd/README.md file so that it provides the following information about the role:

  ansible-httpd
  =========
  Example ansible-httpd role from "Red Hat Enterprise Linux Automation with Ansible" (RH294)Role Variables
  --------------* `web_package`: the RPM package
  * `web_service`: the systemd service
  * `web_config_file`: the path to the main configuration file
  * `web_root`: the path to an index.html file
  * `web_fw_service`: the name of a firewalld serviceDependencies
  ------------None.Example Playbook
  ----------------- hosts: serversroles:- ansible-httpdLicense
  -------BSDAuthor Information
  ------------------Red Hat (training@redhat.com)
  

• Remove any unused directories and files within the role.

• In the project directory, write a site.yml playbook that runs the new ansible-httpd role on the managed hosts in the webdev inventory group.

• Run the site.yml playbook.

[student@workstation review-cr4]$ ll
total 12
-rw-r--r--. 1 student student  147 Oct 11 04:14 ansible.cfg
-rw-r--r--. 1 student student 1256 Oct 11 04:14 ansible-httpd.yml
drwxrwxr-x. 2 student student   24 Oct 11 04:14 files
-rw-r--r--. 1 student student   57 Oct 11 04:14 inventory
drwxrwxr-x. 2 student student   27 Oct 11 04:14 templates[student@workstation review-cr4]$ cat ansible.cfg 
[defaults]
remote_user=devops
inventory=./inventory[privilege_escalation]
become=True
become_method=sudo
become_user=root
become_ask_pass=False[student@workstation review-cr4]$ cat inventory 
[webdev]
serverb.lab.example.com
serverc.lab.example.com[student@workstation review-cr4]$ cat ansible-httpd.yml 
----
---
- name: HTTPD server is installedhosts: webdevvars:web_package: httpdweb_service: httpdweb_config_file: /etc/httpd/conf/httpd.confweb_root: /var/www/html/index.htmlweb_fw_service: httptasks:- name: Packages are installedansible.builtin.dnf:name: "{{ web_package }}"state: present- name: Ensure service is startedansible.builtin.service:name: "{{ web_service }}"state: startedenabled: true- name: Deploy configuration fileansible.builtin.template:src: templates/httpd.conf.j2dest: "{{ web_config_file }}"owner: rootgroup: rootmode: '0644'setype: httpd_config_tnotify: Restart httpd- name: Deploy index.html fileansible.builtin.copy:src: files/index.htmldest: "{{ web_root }}"owner: rootgroup: rootmode: '0644'- name: Web port is openansible.posix.firewalld:service: "{{ web_fw_service }}"permanent: truestate: enabledimmediate: truehandlers:- name: Restart httpdansible.builtin.service:name: "{{ web_service }}"state: restarted[student@workstation review-cr4]$ tree files/
files/
└── index.html0 directories, 1 file
[student@workstation review-cr4]$ cat files/index.html 
This website was deployed with Ansible[student@workstation review-cr4]$ tree templates/
templates/
└── httpd.conf.j20 directories, 1 file

Creating the roles folder

[student@workstation review-cr4]$ tree roles/
roles/
└── ansible-httpd├── ansible-navigator.log├── defaults│   └── main.yml├── handlers│   └── main.yml├── meta│   └── main.yml├── README.md├── site-artifact-2024-10-11T10:24:41.361686+00:00.json├── tasks│   └── main.yml└── templates└── httpd.conf.j2

# roles/ansible-httpd/defaults/main.yml 
---
# defaults file for ansible-httpd
web_package: httpd
web_service: httpd
web_config_file: /etc/httpd/conf/httpd.conf
web_root: /var/www/html/index.html
web_fw_service: http

# roles/ansible-httpd/handlers/main.yml 
---
# handlers file for ansible-httpd
- name: Restart httpdansible.builtin.service:name: "{{ web_service }}"state: restarted

# roles/ansible-httpd/tasks/main.yml 
---
# tasks file for ansible-httpd- name: Packages are installedansible.builtin.dnf:name: "{{ web_package }}"state: present- name: Ensure service is startedansible.builtin.service:name: "{{ web_service }}"state: startedenabled: true- name: Deploy configuration fileansible.builtin.template:src: templates/httpd.conf.j2dest: "{{ web_config_file }}"owner: rootgroup: rootmode: '0644'setype: httpd_config_tnotify: Restart httpd- name: Deploy index.html fileansible.builtin.copy:src: files/index.htmldest: "{{ web_root }}"owner: rootgroup: rootmode: '0644'- name: Web port is openansible.posix.firewalld:service: "{{ web_fw_service }}"permanent: truestate: enabledimmediate: true

# roles/ansible-httpd/templates/httpd.conf.j2 
# Ansible managed
ServerRoot "/etc/httpd"
Listen 80
Include conf.modules.d/*.conf
User apache
Group apache
ServerAdmin root@localhost
<Directory />AllowOverride noneRequire all denied
</Directory>
DocumentRoot "/var/www/html"
<Directory "/var/www">AllowOverride NoneRequire all granted
</Directory>
<Directory "/var/www/html">Options Indexes FollowSymLinksAllowOverride NoneRequire all granted
</Directory>
<IfModule dir_module>DirectoryIndex index.html
</IfModule>
<Files ".ht*">Require all denied
</Files>
ErrorLog "logs/error_log"
LogLevel warn
<IfModule log_config_module>LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedLogFormat "%h %l %u %t \"%r\" %>s %b" common<IfModule logio_module>LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio</IfModule>CustomLog "logs/access_log" combined
</IfModule>
<IfModule alias_module>ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
</IfModule>
<Directory "/var/www/cgi-bin">AllowOverride NoneOptions NoneRequire all granted
</Directory>
<IfModule mime_module>TypesConfig /etc/mime.typesAddType application/x-compress .ZAddType application/x-gzip .gz .tgzAddType text/html .shtmlAddOutputFilter INCLUDES .shtml
</IfModule>
AddDefaultCharset UTF-8
<IfModule mime_magic_module>MIMEMagicFile conf/magic
</IfModule>
EnableSendfile on
IncludeOptional conf.d/*.conf

# roles/ansible-httpd/meta/main.yml 
galaxy_info:author: Red Hat Trainingdescription: example role for RH294company: Red Hat# If the issue tracker for your role is not on github, uncomment the# next line and provide a value# issue_tracker_url: http://example.com/issue/tracker# Choose a valid license ID from https://spdx.org - some suggested licenses:# - BSD-3-Clause (default)# - MIT# - GPL-2.0-or-later# - GPL-3.0-only# - Apache-2.0# - CC-BY-4.0license: BSD (GPL-2.0-or-later, MIT, etc)min_ansible_version: 2.1# If this a Container Enabled role, provide the minimum Ansible Container version.# min_ansible_container_version:## Provide a list of supported platforms, and for each platform a list of versions.# If you don't wish to enumerate all versions for a particular platform, use 'all'.# To view available platforms and versions (or releases), visit:# https://galaxy.ansible.com/api/v1/platforms/## platforms:# - name: Fedora#   versions:#   - all#   - 25# - name: SomePlatform#   versions:#   - all#   - 1.0#   - 7#   - 99.99galaxy_tags: []# List tags for your role here, one per line. A tag is a keyword that describes# and categorizes the role. Users find roles by searching for tags. Be sure to# remove the '[]' above, if you add tags to this list.## NOTE: A tag is limited to a single word comprised of alphanumeric characters.#       Maximum 20 tags per role.dependencies: []# List your role dependencies here, one per line. Be sure to remove the '[]' above,# if you add dependencies to this list.

# site.yml 
---
- name: Running the roles createdhosts: webdevroles:- name: ansible-httpd

---

Congratulations… Completed at Oct.11 2024