Initial commit
This commit is contained in:
Zhongwei Li
872
commands/ansible-project-init.md
Normal file
872
commands/ansible-project-init.md
Normal file
@@ -0,0 +1,872 @@
|
||||
---
|
||||
description: Initialize new Ansible project structure
|
||||
argument-hint: Optional project requirements
|
||||
---
|
||||
|
||||
# Ansible Project Initialization
|
||||
|
||||
You are setting up a new Ansible project with proper structure, configuration, and best practices using the ansible-developer agent.
|
||||
|
||||
## Workflow
|
||||
|
||||
### 1. Gather Project Requirements
|
||||
|
||||
If not specified, ask for:
|
||||
- **Project information**:
|
||||
- Project name and purpose
|
||||
- Team or organization name
|
||||
- Git repository location
|
||||
- **Target infrastructure**:
|
||||
- Target platforms (Linux, Windows, network devices)
|
||||
- Number of environments (dev, staging, production)
|
||||
- Approximate number of hosts per environment
|
||||
- **Initial roles needed**:
|
||||
- Application roles (web server, database, app)
|
||||
- Infrastructure roles (common, security, monitoring)
|
||||
- Third-party roles to include
|
||||
- **Security setup**:
|
||||
- Ansible Vault for secrets (yes/no)
|
||||
- Vault password file location or method
|
||||
- Separate vaults per environment
|
||||
- **Testing setup**:
|
||||
- Include Molecule testing (yes/no)
|
||||
- Testing platforms (Docker, Vagrant, cloud)
|
||||
- CI/CD integration planned
|
||||
- **Standards and requirements**:
|
||||
- ansible-lint configuration
|
||||
- Pre-commit hooks
|
||||
- Documentation requirements
|
||||
|
||||
### 2. Create Directory Structure
|
||||
|
||||
Launch **ansible-developer** to create standard Ansible project structure:
|
||||
|
||||
```
|
||||
project-name/
|
||||
├── ansible.cfg # Ansible configuration
|
||||
├── .gitignore # Git ignore patterns
|
||||
├── .ansible-lint # Lint configuration
|
||||
├── README.md # Project documentation
|
||||
├── requirements.yml # Galaxy role dependencies
|
||||
├── requirements.txt # Python dependencies
|
||||
│
|
||||
├── inventory/
|
||||
│ ├── production/
|
||||
│ │ ├── hosts.yml # Production inventory
|
||||
│ │ └── group_vars/
|
||||
│ │ └── all/
|
||||
│ │ ├── vars.yml # Production variables
|
||||
│ │ └── vault.yml # Encrypted secrets
|
||||
│ ├── staging/
|
||||
│ │ ├── hosts.yml
|
||||
│ │ └── group_vars/
|
||||
│ └── development/
|
||||
│ ├── hosts.yml
|
||||
│ └── group_vars/
|
||||
│
|
||||
├── roles/
|
||||
│ ├── common/ # Common role
|
||||
│ │ ├── README.md
|
||||
│ │ ├── defaults/main.yml
|
||||
│ │ ├── handlers/main.yml
|
||||
│ │ ├── tasks/main.yml
|
||||
│ │ ├── templates/
|
||||
│ │ ├── files/
|
||||
│ │ └── vars/main.yml
|
||||
│ └── .gitkeep
|
||||
│
|
||||
├── playbooks/
|
||||
│ ├── site.yml # Master playbook
|
||||
│ ├── provision.yml # Provisioning playbook
|
||||
│ ├── deploy.yml # Deployment playbook
|
||||
│ └── maintenance.yml # Maintenance playbook
|
||||
│
|
||||
├── group_vars/
|
||||
│ └── all.yml # Global variables
|
||||
│
|
||||
├── host_vars/ # Host-specific variables
|
||||
│ └── .gitkeep
|
||||
│
|
||||
├── files/ # Static files
|
||||
│ └── .gitkeep
|
||||
│
|
||||
├── templates/ # Global templates
|
||||
│ └── .gitkeep
|
||||
│
|
||||
├── filter_plugins/ # Custom filters
|
||||
│ └── .gitkeep
|
||||
│
|
||||
├── library/ # Custom modules
|
||||
│ └── .gitkeep
|
||||
│
|
||||
└── molecule/ # Testing (optional)
|
||||
└── default/
|
||||
├── molecule.yml
|
||||
├── converge.yml
|
||||
└── verify.yml
|
||||
```
|
||||
|
||||
### 3. Configure ansible.cfg
|
||||
|
||||
Create optimized ansible.cfg:
|
||||
|
||||
```ini
|
||||
[defaults]
|
||||
# Inventory
|
||||
inventory = ./inventory/development
|
||||
|
||||
# Connection
|
||||
host_key_checking = False
|
||||
timeout = 30
|
||||
forks = 20
|
||||
|
||||
# Output
|
||||
stdout_callback = yaml
|
||||
callbacks_enabled = profile_tasks, timer
|
||||
display_skipped_hosts = False
|
||||
|
||||
# Roles
|
||||
roles_path = ./roles:~/.ansible/roles:/usr/share/ansible/roles
|
||||
|
||||
# Collections
|
||||
collections_paths = ./collections:~/.ansible/collections:/usr/share/ansible/collections
|
||||
|
||||
# Logs
|
||||
log_path = ./ansible.log
|
||||
|
||||
# Vault
|
||||
vault_password_file = ./.vault-pass # Do not commit this file!
|
||||
|
||||
# Retry
|
||||
retry_files_enabled = False
|
||||
|
||||
[privilege_escalation]
|
||||
become = True
|
||||
become_method = sudo
|
||||
become_user = root
|
||||
become_ask_pass = False
|
||||
|
||||
[ssh_connection]
|
||||
pipelining = True
|
||||
control_path = /tmp/ansible-ssh-%%h-%%p-%%r
|
||||
ssh_args = -o ControlMaster=auto -o ControlPersist=60s
|
||||
|
||||
[inventory]
|
||||
enable_plugins = yaml, ini, script
|
||||
```
|
||||
|
||||
### 4. Create .gitignore
|
||||
|
||||
Protect sensitive files:
|
||||
|
||||
```gitignore
|
||||
# Ansible
|
||||
*.retry
|
||||
.ansible/
|
||||
.vault-pass
|
||||
vault-pass.txt
|
||||
*.secret
|
||||
*.key
|
||||
|
||||
# Logs
|
||||
*.log
|
||||
ansible.log
|
||||
|
||||
# Python
|
||||
__pycache__/
|
||||
*.py[cod]
|
||||
*$py.class
|
||||
*.so
|
||||
.Python
|
||||
venv/
|
||||
env/
|
||||
ENV/
|
||||
|
||||
# IDE
|
||||
.vscode/
|
||||
.idea/
|
||||
*.swp
|
||||
*.swo
|
||||
*~
|
||||
|
||||
# OS
|
||||
.DS_Store
|
||||
Thumbs.db
|
||||
|
||||
# Molecule
|
||||
.molecule/
|
||||
.cache/
|
||||
|
||||
# Terraform (if using)
|
||||
*.tfstate
|
||||
*.tfstate.backup
|
||||
.terraform/
|
||||
```
|
||||
|
||||
### 5. Setup Ansible Vault
|
||||
|
||||
If vault enabled:
|
||||
|
||||
```bash
|
||||
# Create vault password file (DO NOT COMMIT)
|
||||
echo "your-secure-password" > .vault-pass
|
||||
chmod 600 .vault-pass
|
||||
|
||||
# Create encrypted vault files for each environment
|
||||
ansible-vault create inventory/production/group_vars/all/vault.yml
|
||||
ansible-vault create inventory/staging/group_vars/all/vault.yml
|
||||
ansible-vault create inventory/development/group_vars/all/vault.yml
|
||||
```
|
||||
|
||||
**Vault file template**:
|
||||
```yaml
|
||||
---
|
||||
# Encrypted secrets for [environment]
|
||||
|
||||
# Database credentials
|
||||
vault_db_root_password: "changeme"
|
||||
vault_db_user_password: "changeme"
|
||||
|
||||
# API keys
|
||||
vault_api_key: "changeme"
|
||||
|
||||
# SSH keys
|
||||
vault_deploy_key: |
|
||||
-----BEGIN OPENSSH PRIVATE KEY-----
|
||||
...
|
||||
-----END OPENSSH PRIVATE KEY-----
|
||||
|
||||
# SSL certificates
|
||||
vault_ssl_key: |
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
...
|
||||
-----END PRIVATE KEY-----
|
||||
```
|
||||
|
||||
### 6. Create requirements.yml
|
||||
|
||||
Define Galaxy role dependencies:
|
||||
|
||||
```yaml
|
||||
---
|
||||
# Ansible Galaxy roles
|
||||
|
||||
roles:
|
||||
# Community roles
|
||||
- name: geerlingguy.docker
|
||||
version: "6.1.0"
|
||||
|
||||
- name: geerlingguy.nginx
|
||||
version: "3.1.4"
|
||||
|
||||
collections:
|
||||
# Community collections
|
||||
- name: community.general
|
||||
version: ">=7.0.0"
|
||||
|
||||
- name: ansible.posix
|
||||
version: ">=1.5.0"
|
||||
|
||||
- name: community.postgresql
|
||||
version: ">=3.0.0"
|
||||
```
|
||||
|
||||
**Install dependencies**:
|
||||
```bash
|
||||
ansible-galaxy install -r requirements.yml
|
||||
```
|
||||
|
||||
### 7. Create Example Inventory
|
||||
|
||||
**inventory/development/hosts.yml**:
|
||||
```yaml
|
||||
---
|
||||
all:
|
||||
children:
|
||||
webservers:
|
||||
hosts:
|
||||
web01:
|
||||
ansible_host: 192.168.1.10
|
||||
ansible_user: ansible
|
||||
web02:
|
||||
ansible_host: 192.168.1.11
|
||||
ansible_user: ansible
|
||||
vars:
|
||||
nginx_port: 80
|
||||
app_environment: development
|
||||
|
||||
databases:
|
||||
hosts:
|
||||
db01:
|
||||
ansible_host: 192.168.1.20
|
||||
ansible_user: ansible
|
||||
vars:
|
||||
postgresql_version: "15"
|
||||
db_environment: development
|
||||
|
||||
loadbalancers:
|
||||
hosts:
|
||||
lb01:
|
||||
ansible_host: 192.168.1.30
|
||||
ansible_user: ansible
|
||||
|
||||
vars:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
ansible_become: yes
|
||||
```
|
||||
|
||||
### 8. Create Master Playbook
|
||||
|
||||
**playbooks/site.yml**:
|
||||
```yaml
|
||||
---
|
||||
- name: Configure all servers
|
||||
hosts: all
|
||||
gather_facts: yes
|
||||
become: yes
|
||||
|
||||
pre_tasks:
|
||||
- name: Update apt cache (Debian/Ubuntu)
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
when: ansible_os_family == "Debian"
|
||||
tags: always
|
||||
|
||||
- name: Display environment
|
||||
ansible.builtin.debug:
|
||||
msg: "Configuring {{ inventory_hostname }} in {{ app_environment | default('unknown') }} environment"
|
||||
tags: always
|
||||
|
||||
roles:
|
||||
- role: common
|
||||
tags: common
|
||||
|
||||
- name: Configure web servers
|
||||
hosts: webservers
|
||||
become: yes
|
||||
|
||||
roles:
|
||||
- role: nginx
|
||||
tags: nginx
|
||||
- role: application
|
||||
tags: app
|
||||
|
||||
- name: Configure database servers
|
||||
hosts: databases
|
||||
become: yes
|
||||
|
||||
roles:
|
||||
- role: postgresql
|
||||
tags: database
|
||||
|
||||
- name: Configure load balancers
|
||||
hosts: loadbalancers
|
||||
become: yes
|
||||
|
||||
roles:
|
||||
- role: haproxy
|
||||
tags: loadbalancer
|
||||
```
|
||||
|
||||
### 9. Create Example Role
|
||||
|
||||
Create a common role:
|
||||
|
||||
```bash
|
||||
ansible-galaxy role init roles/common
|
||||
```
|
||||
|
||||
**roles/common/tasks/main.yml**:
|
||||
```yaml
|
||||
---
|
||||
- name: Ensure common packages are installed
|
||||
ansible.builtin.package:
|
||||
name:
|
||||
- curl
|
||||
- wget
|
||||
- git
|
||||
- vim
|
||||
- htop
|
||||
- net-tools
|
||||
state: present
|
||||
tags: packages
|
||||
|
||||
- name: Configure timezone
|
||||
community.general.timezone:
|
||||
name: "{{ timezone | default('UTC') }}"
|
||||
tags: timezone
|
||||
|
||||
- name: Configure NTP
|
||||
ansible.builtin.include_tasks: ntp.yml
|
||||
when: configure_ntp | default(true)
|
||||
tags: ntp
|
||||
|
||||
- name: Harden SSH configuration
|
||||
ansible.builtin.include_tasks: ssh.yml
|
||||
tags: ssh
|
||||
|
||||
- name: Configure firewall
|
||||
ansible.builtin.include_tasks: firewall.yml
|
||||
when: configure_firewall | default(true)
|
||||
tags: firewall
|
||||
```
|
||||
|
||||
### 10. Setup Molecule Testing (Optional)
|
||||
|
||||
If testing enabled:
|
||||
|
||||
```bash
|
||||
# Install molecule
|
||||
pip install molecule molecule-plugins[docker] ansible-lint
|
||||
|
||||
# Initialize molecule for a role
|
||||
cd roles/common
|
||||
molecule init scenario default --driver-name docker
|
||||
```
|
||||
|
||||
**molecule/default/molecule.yml**:
|
||||
```yaml
|
||||
---
|
||||
dependency:
|
||||
name: galaxy
|
||||
options:
|
||||
requirements-file: requirements.yml
|
||||
|
||||
driver:
|
||||
name: docker
|
||||
|
||||
platforms:
|
||||
- name: ubuntu-20.04
|
||||
image: geerlingguy/docker-ubuntu2004-ansible
|
||||
privileged: true
|
||||
pre_build_image: true
|
||||
|
||||
- name: ubuntu-22.04
|
||||
image: geerlingguy/docker-ubuntu2204-ansible
|
||||
privileged: true
|
||||
pre_build_image: true
|
||||
|
||||
provisioner:
|
||||
name: ansible
|
||||
config_options:
|
||||
defaults:
|
||||
callbacks_enabled: profile_tasks
|
||||
inventory:
|
||||
host_vars:
|
||||
ubuntu-20.04:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
ubuntu-22.04:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
|
||||
verifier:
|
||||
name: ansible
|
||||
|
||||
lint: |
|
||||
set -e
|
||||
ansible-lint
|
||||
yamllint .
|
||||
```
|
||||
|
||||
### 11. Create ansible-lint Configuration
|
||||
|
||||
**.ansible-lint**:
|
||||
```yaml
|
||||
---
|
||||
# Ansible-lint configuration
|
||||
|
||||
# Exclude paths
|
||||
exclude_paths:
|
||||
- .github/
|
||||
- molecule/
|
||||
- .molecule/
|
||||
- venv/
|
||||
|
||||
# Enable specific rules
|
||||
enable_list:
|
||||
- yaml
|
||||
- no-changed-when
|
||||
- no-handler
|
||||
|
||||
# Skip specific rules for entire project
|
||||
skip_list:
|
||||
- experimental
|
||||
- role-name # If using non-standard role names
|
||||
|
||||
# Profile to use (min, basic, moderate, safety, shared, production)
|
||||
profile: production
|
||||
|
||||
# Offline mode (no internet required)
|
||||
offline: false
|
||||
|
||||
# Use colors in output
|
||||
use_color: true
|
||||
```
|
||||
|
||||
### 12. Create README.md
|
||||
|
||||
**README.md**:
|
||||
```markdown
|
||||
# Project Name
|
||||
|
||||
Brief description of the Ansible project and its purpose.
|
||||
|
||||
## Requirements
|
||||
|
||||
- Ansible 2.9 or higher
|
||||
- Python 3.8 or higher
|
||||
- Target systems: Ubuntu 20.04+, Debian 11+
|
||||
|
||||
## Project Structure
|
||||
|
||||
- `inventory/` - Inventory files per environment
|
||||
- `roles/` - Custom Ansible roles
|
||||
- `playbooks/` - Ansible playbooks
|
||||
- `group_vars/` - Group variables
|
||||
- `host_vars/` - Host-specific variables
|
||||
|
||||
## Quick Start
|
||||
|
||||
### 1. Install Dependencies
|
||||
|
||||
\`\`\`bash
|
||||
# Install Python dependencies
|
||||
pip install -r requirements.txt
|
||||
|
||||
# Install Ansible Galaxy roles
|
||||
ansible-galaxy install -r requirements.yml
|
||||
\`\`\`
|
||||
|
||||
### 2. Configure Vault
|
||||
|
||||
\`\`\`bash
|
||||
# Create vault password file (DO NOT COMMIT)
|
||||
echo "your-secure-password" > .vault-pass
|
||||
chmod 600 .vault-pass
|
||||
|
||||
# Create vault files
|
||||
ansible-vault create inventory/development/group_vars/all/vault.yml
|
||||
\`\`\`
|
||||
|
||||
### 3. Test Connection
|
||||
|
||||
\`\`\`bash
|
||||
# Ping all hosts
|
||||
ansible all -i inventory/development -m ping
|
||||
|
||||
# Gather facts
|
||||
ansible all -i inventory/development -m setup
|
||||
\`\`\`
|
||||
|
||||
### 4. Run Playbooks
|
||||
|
||||
\`\`\`bash
|
||||
# Dry run (check mode)
|
||||
ansible-playbook playbooks/site.yml -i inventory/development --check
|
||||
|
||||
# Run playbook
|
||||
ansible-playbook playbooks/site.yml -i inventory/development
|
||||
|
||||
# Run specific tags
|
||||
ansible-playbook playbooks/site.yml -i inventory/development --tags "common,nginx"
|
||||
|
||||
# Limit to specific hosts
|
||||
ansible-playbook playbooks/site.yml -i inventory/development --limit "webservers"
|
||||
\`\`\`
|
||||
|
||||
## Environments
|
||||
|
||||
- **development**: `inventory/development/`
|
||||
- **staging**: `inventory/staging/`
|
||||
- **production**: `inventory/production/`
|
||||
|
||||
Switch environments by changing the inventory path:
|
||||
\`\`\`bash
|
||||
ansible-playbook playbooks/site.yml -i inventory/production
|
||||
\`\`\`
|
||||
|
||||
## Ansible Vault
|
||||
|
||||
### Encrypt/Decrypt Files
|
||||
|
||||
\`\`\`bash
|
||||
# Encrypt a file
|
||||
ansible-vault encrypt inventory/production/group_vars/all/vault.yml
|
||||
|
||||
# Decrypt a file (temporary)
|
||||
ansible-vault decrypt inventory/production/group_vars/all/vault.yml
|
||||
|
||||
# Edit encrypted file
|
||||
ansible-vault edit inventory/production/group_vars/all/vault.yml
|
||||
|
||||
# View encrypted file
|
||||
ansible-vault view inventory/production/group_vars/all/vault.yml
|
||||
|
||||
# Change vault password
|
||||
ansible-vault rekey inventory/production/group_vars/all/vault.yml
|
||||
\`\`\`
|
||||
|
||||
### Encrypt Variables
|
||||
|
||||
\`\`\`bash
|
||||
# Encrypt a string
|
||||
ansible-vault encrypt_string 'secret_password' --name 'db_password'
|
||||
\`\`\`
|
||||
|
||||
## Testing
|
||||
|
||||
### Syntax Check
|
||||
|
||||
\`\`\`bash
|
||||
ansible-playbook playbooks/site.yml --syntax-check
|
||||
\`\`\`
|
||||
|
||||
### Lint
|
||||
|
||||
\`\`\`bash
|
||||
ansible-lint roles/
|
||||
ansible-lint playbooks/
|
||||
\`\`\`
|
||||
|
||||
### Molecule (Role Testing)
|
||||
|
||||
\`\`\`bash
|
||||
cd roles/common
|
||||
|
||||
# Run all tests
|
||||
molecule test
|
||||
|
||||
# Create test instance
|
||||
molecule create
|
||||
|
||||
# Run playbook
|
||||
molecule converge
|
||||
|
||||
# Verify tests
|
||||
molecule verify
|
||||
|
||||
# Destroy test instance
|
||||
molecule destroy
|
||||
\`\`\`
|
||||
|
||||
## Development Workflow
|
||||
|
||||
1. Create/modify roles in `roles/`
|
||||
2. Update playbooks in `playbooks/`
|
||||
3. Test with ansible-lint
|
||||
4. Run in check mode first
|
||||
5. Test in development environment
|
||||
6. Review and approve changes
|
||||
7. Deploy to staging
|
||||
8. Deploy to production
|
||||
|
||||
## Common Tasks
|
||||
|
||||
### Add New Server
|
||||
|
||||
1. Add host to inventory: `inventory/<env>/hosts.yml`
|
||||
2. Configure host variables if needed: `host_vars/<hostname>.yml`
|
||||
3. Run provisioning: `ansible-playbook playbooks/provision.yml -i inventory/<env> --limit <hostname>`
|
||||
|
||||
### Add New Role
|
||||
|
||||
\`\`\`bash
|
||||
# Create role structure
|
||||
ansible-galaxy role init roles/<role-name>
|
||||
|
||||
# Add role to requirements.yml if third-party
|
||||
# Include role in appropriate playbook
|
||||
\`\`\`
|
||||
|
||||
### Deploy Application
|
||||
|
||||
\`\`\`bash
|
||||
ansible-playbook playbooks/deploy.yml -i inventory/<env> \
|
||||
--extra-vars "app_version=v1.2.3"
|
||||
\`\`\`
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Connection Issues
|
||||
|
||||
\`\`\`bash
|
||||
# Test SSH connectivity
|
||||
ansible all -i inventory/development -m ping -vvv
|
||||
|
||||
# Check inventory
|
||||
ansible-inventory -i inventory/development --list
|
||||
ansible-inventory -i inventory/development --graph
|
||||
\`\`\`
|
||||
|
||||
### Playbook Failures
|
||||
|
||||
\`\`\`bash
|
||||
# Run with increased verbosity
|
||||
ansible-playbook playbooks/site.yml -vvv
|
||||
|
||||
# Check specific host
|
||||
ansible-playbook playbooks/site.yml --limit <hostname> -vv
|
||||
\`\`\`
|
||||
|
||||
### Vault Issues
|
||||
|
||||
\`\`\`bash
|
||||
# Verify vault password
|
||||
ansible-vault view inventory/development/group_vars/all/vault.yml
|
||||
|
||||
# Check vault password file permissions
|
||||
ls -la .vault-pass # Should be 600
|
||||
\`\`\`
|
||||
|
||||
## Contributing
|
||||
|
||||
1. Follow Ansible best practices
|
||||
2. Test changes with ansible-lint
|
||||
3. Test in development environment first
|
||||
4. Document changes in playbook/role README
|
||||
5. Use meaningful commit messages
|
||||
|
||||
## License
|
||||
|
||||
[Your License]
|
||||
|
||||
## Author
|
||||
|
||||
[Your Name/Team]
|
||||
```
|
||||
|
||||
### 13. Verify Project Setup
|
||||
|
||||
Run validation commands:
|
||||
|
||||
```bash
|
||||
# Check ansible.cfg syntax
|
||||
ansible-config dump
|
||||
|
||||
# Verify inventory structure
|
||||
ansible-inventory -i inventory/development --graph
|
||||
ansible-inventory -i inventory/development --list
|
||||
|
||||
# Test connection to hosts
|
||||
ansible all -i inventory/development -m ping
|
||||
|
||||
# Syntax check playbooks
|
||||
ansible-playbook playbooks/site.yml --syntax-check
|
||||
|
||||
# Lint the project
|
||||
ansible-lint roles/
|
||||
ansible-lint playbooks/
|
||||
|
||||
# Dry run
|
||||
ansible-playbook playbooks/site.yml -i inventory/development --check
|
||||
```
|
||||
|
||||
## Output Format
|
||||
|
||||
### Project Initialization Summary
|
||||
|
||||
**Project**: [project-name]
|
||||
**Location**: [path]
|
||||
**Environments**: [dev, staging, production]
|
||||
**Initial Roles**: [list of roles created]
|
||||
|
||||
**Directory Structure Created**:
|
||||
```
|
||||
✓ ansible.cfg - Ansible configuration
|
||||
✓ inventory/ - Multi-environment inventory
|
||||
✓ roles/ - Custom roles
|
||||
✓ playbooks/ - Master and environment playbooks
|
||||
✓ group_vars/ - Global variables
|
||||
✓ vault setup - Encrypted secrets per environment
|
||||
✓ requirements.yml - Galaxy dependencies
|
||||
✓ .gitignore - Git exclusions
|
||||
✓ README.md - Project documentation
|
||||
✓ .ansible-lint - Lint configuration
|
||||
✓ molecule/ - Testing framework (optional)
|
||||
```
|
||||
|
||||
### Next Steps
|
||||
|
||||
**1. Configure Inventory**:
|
||||
```bash
|
||||
# Edit inventory file
|
||||
vi inventory/development/hosts.yml
|
||||
|
||||
# Add your hosts and variables
|
||||
```
|
||||
|
||||
**2. Setup Vault**:
|
||||
```bash
|
||||
# Create vault password
|
||||
echo "your-password" > .vault-pass
|
||||
chmod 600 .vault-pass
|
||||
|
||||
# Create encrypted secrets
|
||||
ansible-vault create inventory/development/group_vars/all/vault.yml
|
||||
```
|
||||
|
||||
**3. Install Dependencies**:
|
||||
```bash
|
||||
ansible-galaxy install -r requirements.yml
|
||||
pip install -r requirements.txt
|
||||
```
|
||||
|
||||
**4. Test Connection**:
|
||||
```bash
|
||||
ansible all -i inventory/development -m ping
|
||||
```
|
||||
|
||||
**5. Develop Roles**:
|
||||
```bash
|
||||
# Create new role
|
||||
ansible-galaxy role init roles/myapp
|
||||
|
||||
# Edit role tasks
|
||||
vi roles/myapp/tasks/main.yml
|
||||
```
|
||||
|
||||
**6. Run Playbooks**:
|
||||
```bash
|
||||
# Check mode first
|
||||
ansible-playbook playbooks/site.yml -i inventory/development --check
|
||||
|
||||
# Execute
|
||||
ansible-playbook playbooks/site.yml -i inventory/development
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
**Security**:
|
||||
- Never commit `.vault-pass` or unencrypted secrets
|
||||
- Use Ansible Vault for all sensitive data
|
||||
- Separate vault files per environment
|
||||
- Rotate vault passwords regularly
|
||||
- Use SSH keys, not passwords
|
||||
|
||||
**Organization**:
|
||||
- One role per purpose (single responsibility)
|
||||
- Keep playbooks simple, logic in roles
|
||||
- Use tags for selective execution
|
||||
- Group related tasks in separate files
|
||||
- Follow ansible-galaxy role structure
|
||||
|
||||
**Testing**:
|
||||
- Always run in check mode first (`--check`)
|
||||
- Test in development before production
|
||||
- Use ansible-lint for code quality
|
||||
- Implement Molecule tests for roles
|
||||
- Use CI/CD for automated testing
|
||||
|
||||
**Version Control**:
|
||||
- Commit early and often
|
||||
- Use meaningful commit messages
|
||||
- Tag releases (v1.0.0, v1.1.0, etc.)
|
||||
- Branch for features/fixes
|
||||
- Review changes before production
|
||||
|
||||
**Documentation**:
|
||||
- README in every role
|
||||
- Document all variables
|
||||
- Include example playbooks
|
||||
- Keep documentation up to date
|
||||
- Explain non-obvious decisions
|
||||
Reference in New Issue
Block a user