Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende ÜberarbeitungLetzte ÜberarbeitungBeide Seiten der Revision | ||
centos:ansible:pxe [21.06.2020 08:29. ] – [SSH-Schlüsselmaterial] django | centos:ansible:pxe [21.06.2020 10:35. ] – [Installation eines Ansible-Orchestrator-Management-Hosts mit Hilfe eines Kickstartfiles für CentOS 8.x (PXE-Server)] django | ||
---|---|---|---|
Zeile 1: | Zeile 1: | ||
====== Installation eines Ansible-Orchestrator-Management-Hosts mit Hilfe eines Kickstartfiles für CentOS 8.x (PXE-Server) ====== | ====== Installation eines Ansible-Orchestrator-Management-Hosts mit Hilfe eines Kickstartfiles für CentOS 8.x (PXE-Server) ====== | ||
- | <WRAP center round todo 55%> | ||
- | **Seite in der Entstehung, noch nicht aktuell! Wird laufend aktualisiert!** | ||
- | </ | ||
- | |||
Kurz mal einen Rechner zu installieren, | Kurz mal einen Rechner zu installieren, | ||
Zeile 59: | Zeile 55: | ||
===== Ansible-Orchestrator-Management-Host ===== | ===== Ansible-Orchestrator-Management-Host ===== | ||
+ | ==== Aufgabenstellung ==== | ||
+ | Wie Eingangs schon angesprochen, | ||
- | FIXME **//do geds weida ...//** | + | Folgende Aufgaben wird unser Script für uns reproduzierbar künftig erledigen: |
- | + | - **[[centos: | |
- | In aller Regel werden wir eine Gruppe von zu installierenden Hosts immer nach dem gleichen Grundschema aufbauen, konfigurieren und auch härten wollen. Was liegt also näher, als diese Aufgaben zu standardisieren und automatisch abarbeiten zu lassen. | + | |
- | + | ||
- | Neben der Grundinstallation | + | |
- **IP-Adresse und Hostname** Durch Angabe des Hostnamens beim Booten des Installationsimages wollen wir diesen setzen und auch die zugehörige IP-Adresse übernehmen lassen. (Der Hostname wir so z.B. auch bei der Definition der VolumeGroup eines LVMs verwendet.) | - **IP-Adresse und Hostname** Durch Angabe des Hostnamens beim Booten des Installationsimages wollen wir diesen setzen und auch die zugehörige IP-Adresse übernehmen lassen. (Der Hostname wir so z.B. auch bei der Definition der VolumeGroup eines LVMs verwendet.) | ||
+ | - **Installations-Logfile** zum Nachvollziehen der erfolgten INstallation unter **''/ | ||
- **[[centos: | - **[[centos: | ||
- **[[centos: | - **[[centos: | ||
- **[[centos: | - **[[centos: | ||
- **[[centos: | - **[[centos: | ||
- | - **[[wiki: | + | - **[[wiki: |
+ | - Zusätzlich zum Standard soll auch noch das Repository **[[centos: | ||
- **Update** Zum Schluss stellen wir noch sicher dass alle installierten Pakete in der aktuellsten Version vorliegen und lassen dann das System neu starten. | - **Update** Zum Schluss stellen wir noch sicher dass alle installierten Pakete in der aktuellsten Version vorliegen und lassen dann das System neu starten. | ||
+ | - **NFS-Client zur Verbindung NAS einrichten**, | ||
+ | - **[[centos: | ||
+ | - **Ansible System-User** erstellen und zuvor erstelltes **[[# | ||
+ | - **[[centos: | ||
+ | - **[[centos: | ||
- | Hierzu erweitern | + | ==== Kickstartdatei anlegen ==== |
- | # vim / | + | Zur automatischen Installation und Konfiguration unseres Ansible-Orchestrator-Management-Hosts verwenden |
+ | # vim / | ||
- | <file bash / | + | <file bash / |
# Version=CentOS 8 (RHEL 8) | # Version=CentOS 8 (RHEL 8) | ||
+ | |||
+ | # 1) Grundinstallation ########################################################################################## | ||
# Tastaturlayout definieren | # Tastaturlayout definieren | ||
Zeile 88: | Zeile 93: | ||
# die aus dem Preinstall-Script beim PXE-Boot übernommen wurden. | # die aus dem Preinstall-Script beim PXE-Boot übernommen wurden. | ||
%include / | %include / | ||
+ | network | ||
# Zeitzone setzen | # Zeitzone setzen | ||
- | timezone Europe/ | + | timezone Europe/ |
services --enabled=" | services --enabled=" | ||
# Netzwerkinstallation aus dem eigenen Repository mit den aktuellen Paketen | # Netzwerkinstallation aus dem eigenen Repository mit den aktuellen Paketen | ||
- | url --url=" | + | url --url=" |
- | repo --name=" | + | repo --name=" |
# Root-Passwort verschlüsselt vorgeben | # Root-Passwort verschlüsselt vorgeben | ||
Zeile 104: | Zeile 110: | ||
# vorhandene Partitionen löschen | # vorhandene Partitionen löschen | ||
- | ignoredisk --only-use=vda | + | #ignoredisk --only-use=vda |
- | clearpart --all --initlabel --drives=vda | + | #clearpart --all --initlabel --drives=vda |
# autopart --type=lvm | # autopart --type=lvm | ||
Zeile 128: | Zeile 134: | ||
net-tools | net-tools | ||
lsof | lsof | ||
+ | tree | ||
%end | %end | ||
Zeile 144: | Zeile 151: | ||
%end | %end | ||
+ | ################################################################################################################# | ||
- | # Preinstall-Anweisungen | + | # 2) Preinstall-Anweisungen: IP-Adresse und Hostname ermitteln und setzen |
%pre | %pre | ||
#!/bin/bash | #!/bin/bash | ||
Zeile 167: | Zeile 175: | ||
done | done | ||
%end | %end | ||
+ | ################################################################################################################# | ||
- | # Postinstall-Anweisungen | + | # 3) Postinstall-Anweisungen: Installations-Log erzeugen und VVariablen setzen ################################## |
%post --log=/ | %post --log=/ | ||
#!/bin/bash | #!/bin/bash | ||
Zeile 175: | Zeile 184: | ||
case $x in SERVERNAME*) | case $x in SERVERNAME*) | ||
eval $x | eval $x | ||
+ | ################################################################################################################# | ||
- | ############ | + | # 4) Bootloader anpassen, rhgb bei den Bootoptionen entfernen ############################ |
sed -i ' | sed -i ' | ||
grub2-mkconfig -o / | grub2-mkconfig -o / | ||
- | ################################################################################# | + | ################################ |
- | ######################## | + | # 5) MOTD und ISSUE.NET individualisieren ############################ |
# / | # / | ||
cat << | cat << | ||
Zeile 196: | Zeile 206: | ||
ISSUE.NET | ISSUE.NET | ||
- | chown root:root / | + | chown root: / |
chmod 644 / | chmod 644 / | ||
Zeile 215: | Zeile 225: | ||
MOTD | MOTD | ||
- | chown root:root /etc/motd | + | chown root: /etc/motd |
chmod 644 /etc/motd | chmod 644 /etc/motd | ||
- | ################################################################################# | + | ################################ |
- | ########################### | + | # 6) SSH-Daemon konfigurieren ############################ |
cp -a / | cp -a / | ||
cat << | cat << | ||
Zeile 341: | Zeile 351: | ||
# allow/deny directives are processed in the following order: | # allow/deny directives are processed in the following order: | ||
# DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups. | # DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups. | ||
- | AllowUsers django | + | AllowUsers django |
# Specifies whether sshd(8) should check file modes and ownership of the | # Specifies whether sshd(8) should check file modes and ownership of the | ||
Zeile 541: | Zeile 551: | ||
# | # | ||
SSHD_CONFIG | SSHD_CONFIG | ||
- | chown root:root / | + | chown root: / |
chmod 600 / | chmod 600 / | ||
- | ################################################################################# | + | ################################ |
- | ####################### | + | # 7) SSH-Publickey des Admin-Accounts hinterlegen ############### |
mkdir / | mkdir / | ||
chmod 700 / | chmod 700 / | ||
- | chown django:django | + | chown django: / |
cat << | cat << | ||
- | ssh-ed25519 | + | ssh-ed25519 |
AUTHORIZED_KEYS | AUTHORIZED_KEYS | ||
chmod 644 / | chmod 644 / | ||
- | chown django:django | + | chown django: / |
- | ################################################################################# | + | ################################ |
- | ############### | + | # 8) lokal gespiegeltes CentOS-Repository benutzen ############################## |
cp -a / | cp -a / | ||
cat << | cat << | ||
Zeile 573: | Zeile 583: | ||
[AppStream] | [AppStream] | ||
name=CentOS-\$releasever - AppStream | name=CentOS-\$releasever - AppStream | ||
- | baseurl=http:// | + | baseurl=http:// |
gpgcheck=1 | gpgcheck=1 | ||
enabled=1 | enabled=1 | ||
gpgkey=file:/// | gpgkey=file:/// | ||
CENTOS-APPSTREAM | CENTOS-APPSTREAM | ||
- | chown root:root / | + | chown root: / |
chmod 644 / | chmod 644 / | ||
Zeile 597: | Zeile 607: | ||
[BaseOS] | [BaseOS] | ||
name=CentOS-\$releasever - Base | name=CentOS-\$releasever - Base | ||
- | baseurl=http:// | + | baseurl=http:// |
gpgcheck=1 | gpgcheck=1 | ||
enabled=1 | enabled=1 | ||
gpgkey=file:/// | gpgkey=file:/// | ||
CENTOS-BASE | CENTOS-BASE | ||
- | chown root:root / | + | chown root: / |
chmod 644 / | chmod 644 / | ||
Zeile 622: | Zeile 632: | ||
[extras] | [extras] | ||
name=CentOS-\$releasever - Extras | name=CentOS-\$releasever - Extras | ||
- | baseurl=http:// | + | baseurl=http:// |
gpgcheck=1 | gpgcheck=1 | ||
enabled=1 | enabled=1 | ||
gpgkey=file:/// | gpgkey=file:/// | ||
CENTOS-EXTRAS | CENTOS-EXTRAS | ||
- | chown root:root / | + | chown root: / |
chmod 644 / | chmod 644 / | ||
- | ################################################################################# | + | ################################ |
- | ###### EPEL installieren und lokales gespiegeltes EPEL-Repository benutzen ###### | + | # 9) EPEL installieren und lokales gespiegeltes EPEL-Repository benutzen |
dnf install epel-release -y | dnf install epel-release -y | ||
rpm --import https:// | rpm --import https:// | ||
Zeile 639: | Zeile 649: | ||
[epel-modular] | [epel-modular] | ||
name=Extra Packages for Enterprise Linux Modular \$releasever - \$basearch | name=Extra Packages for Enterprise Linux Modular \$releasever - \$basearch | ||
- | baseurl=http:// | + | baseurl=http:// |
enabled=1 | enabled=1 | ||
gpgcheck=1 | gpgcheck=1 | ||
Zeile 646: | Zeile 656: | ||
[epel-modular-debuginfo] | [epel-modular-debuginfo] | ||
name=Extra Packages for Enterprise Linux Modular \$releasever - \$basearch - Debug | name=Extra Packages for Enterprise Linux Modular \$releasever - \$basearch - Debug | ||
- | baseurl=http:// | + | baseurl=http:// |
enabled=0 | enabled=0 | ||
gpgkey=file:/// | gpgkey=file:/// | ||
Zeile 653: | Zeile 663: | ||
[epel-modular-source] | [epel-modular-source] | ||
name=Extra Packages for Enterprise Linux Modular \$releasever - \$basearch - Source | name=Extra Packages for Enterprise Linux Modular \$releasever - \$basearch - Source | ||
- | baseurl=http:// | + | baseurl=http:// |
enabled=0 | enabled=0 | ||
gpgkey=file:/// | gpgkey=file:/// | ||
Zeile 659: | Zeile 669: | ||
EPEL-MODULAR | EPEL-MODULAR | ||
- | chown root:root / | + | chown root: / |
chmod 644 / | chmod 644 / | ||
Zeile 666: | Zeile 676: | ||
[epel] | [epel] | ||
name=Extra Packages for Enterprise Linux \$releasever - \$basearch | name=Extra Packages for Enterprise Linux \$releasever - \$basearch | ||
- | baseurl=http:// | + | baseurl=http:// |
enabled=1 | enabled=1 | ||
gpgcheck=1 | gpgcheck=1 | ||
Zeile 673: | Zeile 683: | ||
[epel-debuginfo] | [epel-debuginfo] | ||
name=Extra Packages for Enterprise Linux \$releasever - \$basearch - Debug | name=Extra Packages for Enterprise Linux \$releasever - \$basearch - Debug | ||
- | baseurl=http:// | + | baseurl=http:// |
enabled=0 | enabled=0 | ||
gpgkey=file:/// | gpgkey=file:/// | ||
Zeile 680: | Zeile 690: | ||
[epel-source] | [epel-source] | ||
name=Extra Packages for Enterprise Linux \$releasever - \$basearch - Source | name=Extra Packages for Enterprise Linux \$releasever - \$basearch - Source | ||
- | baseurl=http:// | + | baseurl=http:// |
enabled=0 | enabled=0 | ||
gpgkey=file:/// | gpgkey=file:/// | ||
gpgcheck=1 | gpgcheck=1 | ||
EPEL | EPEL | ||
- | chown root:root / | + | chown root: / |
chmod 644 / | chmod 644 / | ||
- | ################################################################################# | + | ################################ |
- | ############################ | + | # 10) System Updaten ########################### |
dnf update -y | dnf update -y | ||
- | ################################################################################# | + | ################################################################################# |
+ | |||
+ | # 11) NFS-Client zur Verbindung NAS einrichten ################################################################## | ||
+ | dnf install nfs-utils -y | ||
+ | mkdir / | ||
+ | cp -a /etc/fstab / | ||
+ | cat << | ||
+ | 10.20.30.10:/ | ||
+ | FSTAB | ||
+ | mount / | ||
+ | ################################################################################################################# | ||
+ | |||
+ | # 12) Ansible installieren ###################################################################################### | ||
+ | dnf install ansible-doc ansible -y | ||
+ | ################################################################################################################# | ||
+ | |||
+ | # 13) Ansible System-User erstellen und zuvor erstelltes Schlüsselmaterial hinterlegen ########################## | ||
+ | groupadd --gid 65533 ansible && useradd ansible --create-home --home-dir / | ||
+ | mkdir / | ||
+ | chmod 700 / | ||
+ | chown ansible: / | ||
+ | cat <<KEY > / | ||
+ | -----BEGIN OPENSSH PRIVATE KEY----- | ||
+ | QyNTUxOQAAACC7YuO2mTknrX7zRcVVapCQH0il48r3pgd5EWREOav5HwAAAJhJEdo0SRHa | ||
+ | b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW | ||
+ | AAAEBTt8W5ylj51xHums6dfdjpPM5qpgCVHIGJV8W5leF5Brti47aZOSetfvNFxVVqkJAf | ||
+ | SKXjyvemB3kRZEQ5q/ | ||
+ | -----END OPENSSH PRIVATE KEY----- | ||
+ | KEY | ||
+ | chmod 400 / | ||
+ | chown ansible: | ||
+ | cat << | ||
+ | ssh-ed25519 AAAAC3NzaC1lZDemB3kRZEQI1NTE5A7aZOSetfvNFxVVqkJAfSKXjAAAILti4yv5q/ | ||
+ | KEY_PUB | ||
+ | chmod 644 / | ||
+ | chown ansible: | ||
+ | cp / | ||
+ | chmod 644 / | ||
+ | chown ansible: | ||
+ | usermod -aG wheel ansible | ||
+ | ################################################################################################################# | ||
+ | |||
+ | # 14) Ansible: Directory Layout - Verzeichnisstruktur anlegen #################################################### | ||
+ | mkdir -p / | ||
+ | mkdir -p / | ||
+ | touch / | ||
+ | mkdir -p / | ||
+ | touch / | ||
+ | chown -R ansible: / | ||
+ | cat << | ||
+ | --- #YAML start syntax (optional) | ||
+ | centos8: | ||
+ | hosts: | ||
+ | ansible: | ||
+ | ansible_ssh_host: | ||
+ | #demo: | ||
+ | # ansible_ssh_host: | ||
+ | # ansible_ssh_port: | ||
+ | ... #YAML ende syntax (optional) | ||
+ | HOSTS | ||
+ | chmod 644 / | ||
+ | chown ansible: / | ||
+ | ################################################################################################################# | ||
+ | |||
+ | # 15) Ansible konfigurieren ##################################################################################### | ||
+ | cat << | ||
+ | # config file for ansible -- https:// | ||
+ | # =============================================== | ||
+ | |||
+ | # nearly all parameters can be overridden in ansible-playbook | ||
+ | # or with command line flags. ansible will read ANSIBLE_CONFIG, | ||
+ | # ansible.cfg in the current working directory, .ansible.cfg in | ||
+ | # the home directory or / | ||
+ | # finds first | ||
+ | |||
+ | [defaults] | ||
+ | |||
+ | # some basic default values... | ||
+ | |||
+ | # Django : 2020-06-19 | ||
+ | # default: # | ||
+ | inventory = / | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | |||
+ | # plays will gather facts by default, which contain information about | ||
+ | # the remote system. | ||
+ | # | ||
+ | # smart - gather by default, but don't regather if already gathered | ||
+ | # implicit - gather by default, turn off with gather_facts: | ||
+ | # explicit - do not gather by default, must say gather_facts: | ||
+ | #gathering = implicit | ||
+ | |||
+ | # This only affects the gathering done by a play's gather_facts directive, | ||
+ | # by default gathering retrieves all facts subsets | ||
+ | # all - gather all subsets | ||
+ | # network - gather min and network facts | ||
+ | # hardware - gather hardware facts (longest facts to retrieve) | ||
+ | # virtual - gather min and virtual facts | ||
+ | # facter - import facts from facter | ||
+ | # ohai - import facts from ohai | ||
+ | # You can combine them using comma (ex: network, | ||
+ | # You can negate them using ! (ex: !hardware, | ||
+ | # A minimal set of facts is always gathered. | ||
+ | # | ||
+ | |||
+ | # some hardware related facts are collected | ||
+ | # with a maximum timeout of 10 seconds. This | ||
+ | # option lets you increase or decrease that | ||
+ | # timeout to something more suitable for the | ||
+ | # environment. | ||
+ | # gather_timeout = 10 | ||
+ | |||
+ | # Ansible facts are available inside the ansible_facts.* dictionary | ||
+ | # namespace. This setting maintains the behaviour which was the default prior | ||
+ | # to 2.5, duplicating these variables into the main namespace, each with a | ||
+ | # prefix of ' | ||
+ | # This variable is set to True by default for backwards compatibility. It | ||
+ | # will be changed to a default of ' | ||
+ | # ansible_facts. | ||
+ | # inject_facts_as_vars = True | ||
+ | |||
+ | # additional paths to search for roles in, colon separated | ||
+ | # | ||
+ | |||
+ | # uncomment this to disable SSH key host checking | ||
+ | # | ||
+ | |||
+ | # change the default callback, you can only have one ' | ||
+ | # | ||
+ | |||
+ | |||
+ | ## Ansible ships with some plugins that require whitelisting, | ||
+ | ## this is done to avoid running all of a type by default. | ||
+ | ## These setting lists those that you want enabled for your system. | ||
+ | ## Custom plugins should not need this unless plugin author specifies it. | ||
+ | |||
+ | # enable callback plugins, they can output to stdout but cannot be ' | ||
+ | # | ||
+ | |||
+ | # Determine whether includes in tasks and handlers are " | ||
+ | # default. As of 2.0, includes are dynamic by default. Setting these | ||
+ | # values to True will make includes behave more like they did in the | ||
+ | # 1.x versions. | ||
+ | # | ||
+ | # | ||
+ | |||
+ | # Controls if a missing handler for a notification event is an error or a warning | ||
+ | # | ||
+ | |||
+ | # change this for alternative sudo implementations | ||
+ | #sudo_exe = sudo | ||
+ | |||
+ | # What flags to pass to sudo | ||
+ | # WARNING: leaving out the defaults might create unexpected behaviours | ||
+ | #sudo_flags = -H -S -n | ||
+ | |||
+ | # SSH timeout | ||
+ | #timeout = 10 | ||
+ | |||
+ | # default user to use for playbooks if user is not specified | ||
+ | # (/ | ||
+ | # | ||
+ | # Django : 2020-06-19 | ||
+ | # default: unset | ||
+ | remote_user = ansible | ||
+ | |||
+ | # logging is off by default unless this path is defined | ||
+ | # if so defined, consider logrotate | ||
+ | #log_path = / | ||
+ | |||
+ | # default module name for / | ||
+ | # | ||
+ | |||
+ | # use this shell for commands executed under sudo | ||
+ | # you may need to change this to bin/bash in rare instances | ||
+ | # if sudo is constrained | ||
+ | #executable = /bin/sh | ||
+ | |||
+ | # if inventory variables overlap, does the higher precedence one win | ||
+ | # or are hash values merged together? | ||
+ | # this can also be set to ' | ||
+ | # | ||
+ | |||
+ | # by default, variables from roles will be visible in the global variable | ||
+ | # scope. To prevent this, the following option can be enabled, and only | ||
+ | # tasks and handlers within the role will see the variables there | ||
+ | # | ||
+ | |||
+ | # list any Jinja2 extensions to enable here: | ||
+ | # | ||
+ | |||
+ | # if set, always use this private key file for authentication, | ||
+ | # if passing --private-key to ansible or ansible-playbook | ||
+ | # | ||
+ | # Django : 2020-06-19 | ||
+ | # default: unset | ||
+ | private_key_file = / | ||
+ | |||
+ | # If set, configures the path to the Vault password file as an alternative to | ||
+ | # specifying --vault-password-file on the command line. | ||
+ | # | ||
+ | |||
+ | # format of string {{ ansible_managed }} available within Jinja2 | ||
+ | # templates indicates to users editing templates files will be replaced. | ||
+ | # replacing {file}, {host} and {uid} and strftime codes with proper values. | ||
+ | # | ||
+ | # {file}, {host}, {uid}, and the timestamp can all interfere with idempotence | ||
+ | # in some situations so the default is a static string: | ||
+ | # | ||
+ | |||
+ | # by default, ansible-playbook will display " | ||
+ | # should not be run on a host. Set this to " | ||
+ | # messages. NOTE: the task header will still be shown regardless of whether or not the | ||
+ | # task is skipped. | ||
+ | # | ||
+ | |||
+ | # by default, if a task in a playbook does not include a name: field then | ||
+ | # ansible-playbook will construct a header that includes the task's action but | ||
+ | # not the task's args. This is a security feature because ansible cannot know | ||
+ | # if the *module* considers an argument to be no_log at the time that the | ||
+ | # header is printed. | ||
+ | # stdout from ansible-playbook (or you have manually specified no_log in your | ||
+ | # playbook on all of the tasks where you have secret information) then you can | ||
+ | # safely set this to True to get more informative messages. | ||
+ | # | ||
+ | |||
+ | # by default (as of 1.3), Ansible will raise errors when attempting to dereference | ||
+ | # Jinja2 variables that are not set in templates or action lines. Uncomment this line | ||
+ | # to revert the behavior to pre-1.3. | ||
+ | # | ||
+ | |||
+ | # by default (as of 1.6), Ansible may display warnings based on the configuration of the | ||
+ | # system running ansible itself. This may include warnings about 3rd party packages or | ||
+ | # other conditions that should be resolved if possible. | ||
+ | # to disable these warnings, set the following value to False: | ||
+ | # | ||
+ | |||
+ | # by default (as of 1.4), Ansible may display deprecation warnings for language | ||
+ | # features that should no longer be used and will be removed in future versions. | ||
+ | # to disable these warnings, set the following value to False: | ||
+ | # | ||
+ | |||
+ | # (as of 1.8), Ansible can optionally warn when usage of the shell and | ||
+ | # command module appear to be simplified by using a default Ansible module | ||
+ | # instead. | ||
+ | # setting or adding warn=yes or warn=no to the end of the command line | ||
+ | # parameter string. | ||
+ | # instead of shelling out to the git command. | ||
+ | # command_warnings = False | ||
+ | |||
+ | |||
+ | # set plugin path directories here, separate with colons | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | |||
+ | |||
+ | # by default, ansible will use the ' | ||
+ | # another one | ||
+ | #strategy = free | ||
+ | |||
+ | # by default callbacks are not loaded for / | ||
+ | # want, for example, a notification or logging callback to also apply to | ||
+ | # / | ||
+ | # | ||
+ | |||
+ | |||
+ | # don't like cows? that's unfortunate. | ||
+ | # set to 1 if you don't want cowsay support or export ANSIBLE_NOCOWS=1 | ||
+ | #nocows = 1 | ||
+ | |||
+ | # set which cowsay stencil you'd like to use by default. When set to ' | ||
+ | # a random stencil will be selected for each task. The selection will be filtered | ||
+ | # against the option below. | ||
+ | # | ||
+ | # | ||
+ | |||
+ | # when using the ' | ||
+ | # it should be formatted as a comma-separated list with no spaces between names. | ||
+ | # NOTE: line continuations here are for formatting purposes only, as the INI parser | ||
+ | # in python does not support them. | ||
+ | # | ||
+ | |||
+ | # don't like colors either? | ||
+ | # set to 1 if you don't want colors, or export ANSIBLE_NOCOLOR=1 | ||
+ | #nocolor = 1 | ||
+ | |||
+ | # if set to a persistent type (not ' | ||
+ | # from previous runs in Ansible will be stored. | ||
+ | # wanting to use, for example, IP information from one group of servers | ||
+ | # without having to talk to them in the same playbook run to get their | ||
+ | # current IP information. | ||
+ | # | ||
+ | |||
+ | #This option tells Ansible where to cache facts. The value is plugin dependent. | ||
+ | #For the jsonfile plugin, it should be a path to a local directory. | ||
+ | #For the redis plugin, the value is a host: | ||
+ | |||
+ | # | ||
+ | |||
+ | |||
+ | |||
+ | # retry files | ||
+ | # When a playbook fails a .retry file can be created that will be placed in ~/ | ||
+ | # You can enable this feature by setting retry_files_enabled to True | ||
+ | # and you can change the location of the files by setting retry_files_save_path | ||
+ | |||
+ | # | ||
+ | # | ||
+ | |||
+ | # squash actions | ||
+ | # Ansible can optimise actions that call modules with list parameters | ||
+ | # when looping. Instead of calling the module once per with_ item, the | ||
+ | # module is called once with all items at once. Currently this only works | ||
+ | # under limited circumstances, | ||
+ | # | ||
+ | |||
+ | # prevents logging of task data, off by default | ||
+ | #no_log = False | ||
+ | |||
+ | # prevents logging of tasks, but only on the targets, data is still logged on the master/ | ||
+ | # | ||
+ | |||
+ | # controls whether Ansible will raise an error or warning if a task has no | ||
+ | # choice but to create world readable temporary files to execute a module on | ||
+ | # the remote machine. | ||
+ | # turn this on to have behaviour more like Ansible prior to 2.1.x. | ||
+ | # https:// | ||
+ | # for more secure ways to fix this than enabling this option. | ||
+ | # | ||
+ | |||
+ | # controls the compression level of variables sent to | ||
+ | # worker processes. At the default of 0, no compression | ||
+ | # is used. This value must be an integer from 0 to 9. | ||
+ | # | ||
+ | |||
+ | # controls what compression method is used for new-style ansible modules when | ||
+ | # they are sent to the remote system. | ||
+ | # support compiled into both the controller' | ||
+ | # The names should match with the python Zipfile compression types: | ||
+ | # * ZIP_STORED (no compression. available everywhere) | ||
+ | # * ZIP_DEFLATED (uses zlib, the default) | ||
+ | # These values may be set per host via the ansible_module_compression inventory | ||
+ | # variable | ||
+ | # | ||
+ | |||
+ | # This controls the cutoff point (in bytes) on --diff for files | ||
+ | # set to 0 for unlimited (RAM may suffer!). | ||
+ | # | ||
+ | |||
+ | # This controls how ansible handles multiple --tags and --skip-tags arguments | ||
+ | # on the CLI. If this is True then multiple arguments are merged together. | ||
+ | # it is False, then the last specified argument is used and the others are ignored. | ||
+ | # This option will be removed in 2.8. | ||
+ | # | ||
+ | |||
+ | # Controls showing custom stats at the end, off by default | ||
+ | # | ||
+ | |||
+ | # Controls which files to ignore when using a directory as inventory with | ||
+ | # possibly multiple sources (both static and dynamic) | ||
+ | # | ||
+ | |||
+ | # This family of modules use an alternative execution path optimized for network appliances | ||
+ | # only update this setting if you know how this works, otherwise it can break module execution | ||
+ | # | ||
+ | |||
+ | # When enabled, this option allows lookups (via variables like {{lookup(' | ||
+ | # a loop with ) to return data that is not marked " | ||
+ | # jinja2 templating language which will be run through the templating engine. | ||
+ | # ENABLING THIS COULD BE A SECURITY RISK | ||
+ | # | ||
+ | |||
+ | # set default errors for all plays | ||
+ | # | ||
+ | |||
+ | [inventory] | ||
+ | # enable inventory plugins, default: ' | ||
+ | # | ||
+ | |||
+ | # ignore these extensions when parsing a directory as inventory source | ||
+ | # | ||
+ | |||
+ | # ignore files matching these patterns when parsing a directory as inventory source | ||
+ | # | ||
+ | |||
+ | # If ' | ||
+ | # | ||
+ | |||
+ | [privilege_escalation] | ||
+ | # Django : 2020-06-19 | ||
+ | # default: # | ||
+ | # # | ||
+ | # # | ||
+ | # # | ||
+ | become=True | ||
+ | become_method=sudo | ||
+ | become_user=root | ||
+ | become_ask_pass=True | ||
+ | |||
+ | [paramiko_connection] | ||
+ | |||
+ | # uncomment this line to cause the paramiko connection plugin to not record new host | ||
+ | # keys encountered. | ||
+ | # host key checking setting above. | ||
+ | # | ||
+ | |||
+ | # by default, Ansible requests a pseudo-terminal for commands executed under sudo. Uncomment this | ||
+ | # line to disable this behaviour. | ||
+ | # | ||
+ | |||
+ | # paramiko will default to looking for SSH keys initially when trying to | ||
+ | # authenticate to remote devices. | ||
+ | # that close the connection after a key failure. | ||
+ | # disable the Paramiko look for keys function | ||
+ | # | ||
+ | |||
+ | # When using persistent connections with Paramiko, the connection runs in a | ||
+ | # background process. | ||
+ | # default Ansible will prompt to add the host key. This will cause connections | ||
+ | # running in background processes to fail. Uncomment this line to have | ||
+ | # Paramiko automatically add host keys. | ||
+ | # | ||
+ | |||
+ | [ssh_connection] | ||
+ | |||
+ | # ssh arguments to use | ||
+ | # Leaving off ControlPersist will result in poor performance, | ||
+ | # paramiko on older platforms rather than removing it, -C controls compression use | ||
+ | #ssh_args = -C -o ControlMaster=auto -o ControlPersist=60s | ||
+ | |||
+ | # The base directory for the ControlPath sockets. | ||
+ | # This is the " | ||
+ | # | ||
+ | # Example: | ||
+ | # control_path_dir = / | ||
+ | # | ||
+ | |||
+ | # The path to use for the ControlPath sockets. This defaults to a hashed string of the hostname, | ||
+ | # port and username (empty string in the config). The hash mitigates a common problem users | ||
+ | # found with long hostnames and the conventional %(directory)s/ | ||
+ | # In those cases, a "too long for Unix domain socket" | ||
+ | # | ||
+ | # Example: | ||
+ | # control_path = %(directory)s/ | ||
+ | # | ||
+ | |||
+ | # Enabling pipelining reduces the number of SSH operations required to | ||
+ | # execute a module on the remote server. This can result in a significant | ||
+ | # performance improvement when enabled, however when using " | ||
+ | # first disable ' | ||
+ | # | ||
+ | # By default, this option is disabled to preserve compatibility with | ||
+ | # sudoers configurations that have requiretty (the default on many distros). | ||
+ | # | ||
+ | #pipelining = False | ||
+ | |||
+ | # Control the mechanism for transferring files (old) | ||
+ | # * smart = try sftp and then try scp [default] | ||
+ | # * True = use scp only | ||
+ | # * False = use sftp only | ||
+ | #scp_if_ssh = smart | ||
+ | |||
+ | # Control the mechanism for transferring files (new) | ||
+ | # If set, this will override the scp_if_ssh option | ||
+ | # * sftp = use sftp to transfer files | ||
+ | # * scp = use scp to transfer files | ||
+ | # * piped = use ' | ||
+ | # * smart = try sftp, scp, and piped, in that order [default] | ||
+ | # | ||
+ | |||
+ | # if False, sftp will not use batch mode to transfer files. This may cause some | ||
+ | # types of file transfer failures impossible to catch however, and should | ||
+ | # only be disabled if your sftp version has problems with batch mode | ||
+ | # | ||
+ | |||
+ | # The -tt argument is passed to ssh when pipelining is not enabled because sudo | ||
+ | # requires a tty by default. | ||
+ | #usetty = True | ||
+ | |||
+ | # Number of times to retry an SSH connection to a host, in case of UNREACHABLE. | ||
+ | # For each retry attempt, there is an exponential backoff, | ||
+ | # so after the first attempt there is 1s wait, then 2s, 4s etc. up to 30s (max). | ||
+ | #retries = 3 | ||
+ | |||
+ | [persistent_connection] | ||
+ | |||
+ | # Configures the persistent connection timeout value in seconds. | ||
+ | # how long the persistent connection will remain idle before it is destroyed. | ||
+ | # If the connection doesn' | ||
+ | # expires, the connection is shutdown. The default value is 30 seconds. | ||
+ | # | ||
+ | |||
+ | # The command timeout value defines the amount of time to wait for a command | ||
+ | # or RPC call before timing out. The value for the command timeout must | ||
+ | # be less than the value of the persistent connection idle timeout (connect_timeout) | ||
+ | # The default value is 30 second. | ||
+ | # | ||
+ | |||
+ | [accelerate] | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | |||
+ | # The daemon timeout is measured in minutes. This time is measured | ||
+ | # from the last activity to the accelerate daemon. | ||
+ | # | ||
+ | |||
+ | # If set to yes, accelerate_multi_key will allow multiple | ||
+ | # private keys to be uploaded to it, though each user must | ||
+ | # have access to the system via SSH to add a new key. The default | ||
+ | # is " | ||
+ | # | ||
+ | |||
+ | [selinux] | ||
+ | # file systems that require special treatment when dealing with security context | ||
+ | # the default behaviour that copies the existing context or uses the user default | ||
+ | # needs to be changed to use the file system dependent context. | ||
+ | # | ||
+ | |||
+ | # Set this to yes to allow libvirt_lxc connections to work without SELinux. | ||
+ | # | ||
+ | |||
+ | [colors] | ||
+ | #highlight = white | ||
+ | #verbose = blue | ||
+ | #warn = bright purple | ||
+ | #error = red | ||
+ | #debug = dark gray | ||
+ | #deprecate = purple | ||
+ | #skip = cyan | ||
+ | # | ||
+ | #ok = green | ||
+ | #changed = yellow | ||
+ | #diff_add = green | ||
+ | # | ||
+ | #diff_lines = cyan | ||
+ | |||
+ | |||
+ | [diff] | ||
+ | # Always print diff when running ( same as always running with -D/--diff ) | ||
+ | # always = no | ||
+ | |||
+ | # Set how many context lines to show in diff | ||
+ | # context = 3 | ||
+ | ANSIBLE_CFG | ||
+ | chown ansible: / | ||
+ | ################################################################################################################# | ||
;; | ;; | ||
esac; | esac; | ||
done | done | ||
%end | %end | ||
- | |||
</ | </ | ||
- | Damit nun beim Laden der Menüdatei bei PXE-Boot die überarbeitete Kickstart-Datei geladen werden kann, erweitern wir nun die Menü-Datei unseres PXE-Bootservers. | + | ==== PXE-Bootmenü-Datei anpassen ==== |
+ | Damit nun beim Laden der Menüdatei bei PXE-Boot die überarbeitete Kickstart-Datei geladen werden kann, erweitern wir nun die Menü-Datei | ||
+ | # vim / | ||
- | # vim / | + | Dort tragen wir beim betreffenden **LABEL** die Optionen **'' |
- | Dort tragen wir beim betreffenden **LABEL** die Optionen **'' | + | |
< | < | ||
- | MENU LABEL ^3) Installation | + | MENU LABEL ^3) Installation |
| | ||
- | | + | |
- | </ | + | |
- | Anschliessend starten wir wie gewohnt unsere virtuelle Maschine. | + | ==== Installation AOMH via PXE ==== |
+ | Anschliessend starten wir wie gewohnt unsere virtuelle Maschine | ||
- | {{ :centos:pxe_c7:pxe-boot-menue-004.png? | + | {{ :centos:ansible:aomh_01.png? |
- | <WRAP center round tip 80%> | + | Da schon alle relevanten **[[# |
+ | Am Ende des Installationsvorganges werden wir informiert, dass das postinstall-script, | ||
- | Zum Setzen des Hostnamens wählen wir nun wie gewünscht den betreffenden Menüpunkt aus, drücken dann aber **__NICHT__** die **EINGABETASTE**, | + | {{ : |
- | </ | + | |
- | {{ : | + | Ist die Installation abgeschlossen startet unser neuer Host. |
- | + | ||
- | Am Ende des Installationsvorganges werden wir informiert, dass das postinstall-script, | + | |
- | {{ :centos:pxe_c8:pxe-boot-menue-087c.png? | + | {{ :centos:ansible:aomh_03.png? |
Nach kurzer Wartezeit haben wir ein neues, vorkonfiguriertes und vor allem aktuelles System, bei dem wir uns direkt per **'' | Nach kurzer Wartezeit haben wir ein neues, vorkonfiguriertes und vor allem aktuelles System, bei dem wir uns direkt per **'' | ||
- | $ ssh 10.0.0.50 | + | $ ssh 10.0.0.40 |
- | < | + | < |
- | ED25519 key fingerprint is SHA256:JKV0iNvjQGMhkWIGEPC1hQH/ | + | ED25519 key fingerprint is SHA256:ayqTv8KN1YeMpTudnHRuC3jxSzc4Z92TX3wjRcFavsY. |
- | Are you sure you want to continue connecting (yes/no/ | + | Are you sure you want to continue connecting (yes/no)? yes |
- | Warning: Permanently added ' | + | Warning: Permanently added ' |
############################################################################## | ############################################################################## | ||
# # | # # | ||
Zeile 745: | Zeile 1323: | ||
# This is the home server of Michael Nausch. | # This is the home server of Michael Nausch. | ||
# # | # # | ||
- | # | + | # |
# # | # # | ||
# | # | ||
Zeile 752: | Zeile 1330: | ||
# By accessing this system, you consent to this monitoring. | # By accessing this system, you consent to this monitoring. | ||
# # | # # | ||
- | ##############################################################################</ | + | ############################################################################## |
+ | </ | ||
+ | |||
+ | Wir können dann natürlich auch sofort zu unserem Ansible-Administrationsaccount **ansible** wechseln. | ||
+ | $ su - ansible | ||
+ | |||
+ | Nach eingabe des zugehörigen Passwortes befinden wir uns im Homeverzeichnis des Ansible-Administrationsaccounts | ||
+ | Password: | ||
+ | [ansible@vml000040 ~]$ | ||
+ | |||
+ | Dot können wir uns z.B. vergewissern dass das **[[centos: | ||
+ | $ tree ansible/ | ||
+ | |||
+ | < | ||
+ | ├── filter_plugins | ||
+ | ├── inventories | ||
+ | │ ├── production | ||
+ | │ │ ├── group_vars | ||
+ | │ │ ├── hosts.yml | ||
+ | │ │ └── host_vars | ||
+ | │ └── staging | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | ├── library | ||
+ | ├── module_utils | ||
+ | ├── roles | ||
+ | │ └── common | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | │ | ||
+ | └── site.yml | ||
+ | |||
+ | 22 directories, | ||
+ | |||
+ | Zum Schluss lassen wir uns mit Hilfe des Befehls die aktuell installierte CentOS-Version anzeigen. | ||
+ | $ ansible centos8 -m shell -a "/ | ||
+ | |||
+ | Da wir uns das erste mal mit dem Host ansible verbinden werden wir nach der Eingabe des Passwortes gefragt, ob der Fingerprint des ED25519 Schlüssel stimmt. Nachdem wir das gewissenhaft überprüft habenbestätigen wir diese Frage mit einem **'' | ||
+ | < | ||
+ | <font style=" | ||
+ | The authenticity of host ' | ||
+ | ED25519 key fingerprint is SHA256: | ||
+ | Are you sure you want to continue connecting (yes/ | ||
+ | <font style=" | ||
+ | CentOS Linux release 8.2.2004 (Core)</ | ||
+ | </ | ||
+ | |||
+ | <WRAP center round tip 75%> | ||
+ | Wir haben also nunmehr die Möglichkeit stets bei Bedarf immer eine gleiche Installation unseres \\ | ||
+ | **A**nsible-**O**rchestrator-**M**anagement-**H**ost //from the scratch// zu Installieren. \\ | ||
+ | Letztendlich brauchen wir dann nur noch unsere individuellen **playbooks**-, | ||
+ | in die zugehörigen Verzeichnisse zurück sichern! | ||
+ | </ | ||
+ | |||
+ | ====== Links ====== | ||
+ | * **[[centos: | ||
+ | * **=> [[centos: | ||
+ | * **[[centos: | ||
+ | * **[[wiki: | ||
+ | * **[[http:// | ||
- | Die Netzwerkschnittstelle hat entsprechend die gewünschte Bezeichnung erhalten. | ||
- | # ip a | ||
- | < | ||
- | link/ | ||
- | inet 127.0.0.1/8 scope host lo | ||
- | | ||
- | inet6 ::1/128 scope host | ||
- | | ||
- | 2: eth0: < | ||
- | link/ether 52: | ||
- | inet 10.0.0.50/ | ||
- | | ||
- | inet6 fe80:: | ||
- | | ||
- | Das System ist auch mit den aktuellesten Programmpaketen bestückt. | ||
- | # dnf update | ||
- | < | ||
- | Dependencies resolved. | ||
- | Nothing to do. | ||
- | Complete!</ | ||