Table des matières
- 2026:
- 2025:
4 billet(s) pour septembre 2026
| Notes HTTP Strict Transport Security - HSTS | 2026/09/18 11:04 | Jean-Baptiste |
| Notes GNU Linux GPU carte graphiques | 2026/09/08 15:49 | Jean-Baptiste |
| Notes GNU Linux graphique | 2026/09/08 15:42 | Jean-Baptiste |
| Notes urlencoding - passer des mots de passe en HTTPS | 2026/09/03 17:58 | Jean-Baptiste |
Architecture CPU Endianness byte order
big-endian, little-endian, byte order, CPU
Source http://serverfault.com/questions/163487/how-to-tell-if-a-linux-system-is-big-endian-or-little-endian
Voir https://fr.wikipedia.org/wiki/Endianness
On a Big Endian-System (Solaris on SPARC)
$ echo -n I | od -to2 | head -n1 | cut -f2 -d" " | cut -c6 0
On a little endian system (Linux on x86)
$ echo -n I | od -to2 | head -n1 | cut -f2 -d" " | cut -c6 1
Notes Ansible Tower - Ansible Automation Platform
Voir aussi :
- event-driven platform for runbook automation / IFTTT (if this, then that)
Vocabulaire / Concepts
Cycle de vie :
Recherche doc RedHat :
Voir :
Ansible Engine
Correspond à Ansible et est installé par :
sudo yum install ansible
Control node
Control node
- control plane
- execution plane
Dans AAP v1 le “control plane” et l'“execution plane” étaient ensemble sur le “control node”
mesh node types : node_type=hybrid par défaut ou node_type=control
node_type :
- control (WebUI & API)
- execution (ansible-playbook)
- hybrid (Execution + control)
- hop (sorte de proxy ssh entre le Controller et les Execution Nodes ; ne peut pas être un Execution Node)
Execution Node (Ansible Automation Engine)
The machine that runs Ansible Linux Mac BSD … Python 3.8 ou +
Hop nodes / Execution nodes
mesh node types node_type=hop ou node_type=execution
Ansible Mesh / Receptor
Voir :
receptor_listener_port
27199/tcp
| Automation Controller | Execution Node |
| ESTABLISHED 27199 | LISTEN 27199 |
work-signing keys
Control node receptor
- work-signing: privatekey: /etc/receptor/work_private_key.pem tokenexpiration: 1m - work-verification: publickey: /etc/receptor/work_public_key.pem
Execution Node
- work-verification: publickey: /etc/receptor/work_public_key.pem
To create the keys, just do openssl commands, you can see them evokes in the plays here https://github.com/ansible/awx/blob/a86740c3c9eaf9a551e850341d8adec5a3962dd5/tools/docker-compose/ansible/roles/sources/tasks/main.yml#L84
Ansible Execution Environment
Sorte de pyenv contenant Ansible, les collections et plugins
Managed host
Les cibles
ansible myhost --become -m raw -a "yum install -y python2"
Prereq Python 2 (version 2.6 or later) or Python 3 (version 3.5 or later)
Automation Hub / Galaxy
jfrog-artifactory :
Hop node
Anciennement “Isolated Nodes”
Voir :
Alternative à ssh-proxy\ The only prerequisite is that there is SSH connectivity from the Tower Cluster to the Isolated Node
Exemple de conf :
[isolated_group_restrictedzone:vars] controller=tower [isolated_group_nc] cary.remote.office controller=tower
Isolated instances are not supported in conjunction with running Ansible Tower in OpenShift.
Ansible Automation Hub
Voir Galaxy NG
(Private) Automation Hub
Config
tower-cli setting modify ALLOW_JINJA_IN_EXTRA_VARS always
Logs
Voir : https://github.com/ansible/awx/issues/11330
extra_vars des jobs dans les logs (à tester)
- hosts: localhost gather_facts: false tasks: - shell: "echo {{ inventory_hostname }}"
ou
The first idea was to add extra_vars to every job events, but it would work just as well to be able to add a short string label (prompt on launch) when launching a job template. This should not cause a performance issue.
Add extra_vars to every job event sent over job_events #11330
Rechercher par date / heures
GT
env TZ=Europe/Paris date --rfc-3339=second -d '2023-08-23 21:50' 2023-08-23 21:50:00+02:00
LT
env TZ=Europe/Paris date --rfc-3339=second -d '2023-08-24 00:20' 2023-08-24 00:20:00+02:00
Développement / Intégration
Ansible Navigator
- TUI or CLI to execute playbook
- Supports Execution Environments
Ansible Builder
- creates Execution Environment
- takes in input text/yaml files describing the EE to produce
Voir :
Autres
GPG Signing
Connaitre la version
cat /etc/ansible-automation-platform/VERSION
La config de la connexion à la DB est ici : \ /etc/tower/conf.d/postgres.py
Autres
#ansible-config init --disabled -t all > ansible.cfg ansible-navigator config init --disabled -t all > ansible.cfg
Voir la configuration
ansible-config dump --only-changed -t all
#ansible-config view | grep -B 2 -A 2 'inventory plugins' ansible-navigator config view | grep -B 2 -A 2 'inventory plugins'
[root@ansible-1 ~]# awx-manage list_instances
[tower capacity=51]
ansible-1 capacity=17 version=3.7.1 heartbeat="2020-08-27 09:06:21"
ansible-2 capacity=17 version=3.7.1 heartbeat="2020-08-27 09:05:58"
ansible-3 capacity=17 version=3.7.1 heartbeat="2020-08-27 09:06:00"
https://goetzrieger.github.io/ansible-tower-advanced/2-clustering/
#!/bin/bash awx -f human inventory create --name "Example Inventory" --organization "Default" awx -f human host create --name "node1" \ --inventory "Example Inventory" awx -f human host create --name "node2" \ --inventory "Example Inventory" awx -f human credential create --name "Example Credentials" \ --organization "Default" \ --credential_type "Machine" \ --inputs '{"username": "ec2-user", "ssh_key_data": "@~/.ssh/aws-private.pem"}' awx -f human project create --name="Apache" \ --scm_type=git \ --scm_url="https://github.com/goetzrieger/ansible-labs-playbooks.git" \ --organization "Default" \ --scm_clean=true --scm_delete_on_update=true --scm_update_on_launch=true \ --wait awx -f human job_templates create \ --name="Install Apache" \ --inventory="Example Inventory" \ --project=Apache \ --playbook=apache_install.yml \ --become_enabled="yes" awx -f human job_template associate --name "Install Apache" \ --credential "Example Credentials"
Source : https://goetzrieger.github.io/ansible-tower-advanced/4-awx-cli-exercises/
Autres
Credentials
sudo awx-python -m pip install safeguardcredentialtype sudo awx-manage setup_managed_credential_types sudo automation-controller-service restart
Source : https://pypi.org/project/safeguardcredentialtype/
Voir aussi : M(awx.awx.credential_input_source)
Notes Ansible plugins
Créer ses plugins
Voir :
Hello world
Plugin simple en bash et dans un rôle
play-test-plugin.yml
#! /usr/bin/env ansible-playbook - name: test plugin hosts: localhost roles: - plugin - hello
roles/plugin/library/plug1
#! /bin/bash display="This is a simple bash module.." echo -e "{\"Message\":\""$display"\"}"
roles/hello/tasks/main.yml
--- - name: test plugin plug1 plug1:
./play-test-plugin.yml -v
Tester un module
echo -e '{ "ANSIBLE_MODULE_ARGS": { "database": "hosts"} }' | python3.6 /usr/lib/python3.6/site-packages/ansible/modules/system/getent.py | jq . echo -e '{ "ANSIBLE_MODULE_ARGS": {} }' | python3 roles/plop/library/plop_check
Notes Ansible module set_stats
Voir :
env ANSIBLE_SHOW_CUSTOM_STATS=yes ./playbook.yml -i test-ansible,test-ansible2,
Pour ne pas systématiquement devoir mettre ANSIBLE_SHOW_CUSTOM_STATS=yes il est possible de mettre ce fichier ansible.cfg à la racine du projet (même arborescence que le playbook)
ansible.cfg
[defaults] show_custom_stats = True
playbook.yml
#!/usr/bin/ansible-playbook --- - name: play hosts: all tasks: - name: set stats set_stats: data: var1: plop
CUSTOM STATS: ***********************************************************************************************************************************************
RUN: { "var1": "plopplop"}
playbook.yml
#!/usr/bin/ansible-playbook --- - name: play hosts: all tasks: - name: set stats set_stats: data: var1: plop aggregate: no
CUSTOM STATS: ***********************************************************************************************************************************************
RUN: { "var1": "plop"}
Si aggregate: no sur plusieurs machines, la variable est écrasée, c'est la dernière valeur qui l'emporte.
playbook.yml
#!/usr/bin/ansible-playbook --- - name: play hosts: all tasks: - name: set stats set_stats: data: var1: plop per_host: yes
CUSTOM STATS: ***********************************************************************************************************************************************
test-ansible: { "var1": "plop"}
test-ansible2: { "var1": "plop"}
Filtrer le set_stats
env ANSIBLE_SHOW_CUSTOM_STATS=yes ./playbook.yml -i inv.yaml | sed -n -e '/CUSTOM STATS:/,/$/p' | sed -e '/CUSTOM STATS:/d' | sed -e 's/[a-zA-Z0-9]*://' | jq .
Notes Ansible module raw
Le module raw permet de passer des commandes en SSH directement sans avoir besoin de Python installé sur la cible.
En général se module est justement utilisé pour installer Python. Il est aussi utile quand la cible contient une version de Python obsolète.
Exemple de déploiement d'un script shell avec Raw
Sur une vielle RedHat 5 (Python obsolète) les fichiers crées par raw sont systématiquement tronqués à 6258 bytes. De plus certains caractères spéciaux du script shell empêche son déploiement via un heredoc.
Pour contourner ces deux limitations nous allons :
- Découper le fichier en paquets de 6258 bytes
- Encoder le fichier en base64
play-deploy-shell-old-linux.yml
#!/usr/bin/ansible-playbook --- - hosts: all gather_facts: false environment: PATH: /bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/local/cmcluster/bin/ tasks: - name: "Gather facts" ignore_unreachable: true block: - name: "Gather facts for RHEL > 5" ansible.builtin.setup: - name: set_fact python_value ansible.builtin.set_fact: python_value: auto_legacy rescue: - name: set_fact with_raw_module ansible.builtin.set_fact: with_raw_module: true - name: block when with_raw_module when: with_raw_module is defined and with_raw_module block: - name: DEBUG ansible.builtin.debug: var: item with_items: - "{% for host in hostvars %}{{ host }}{% endfor %}" - name: Split file ansible.builtin.shell: | cat script.sh | gzip | openssl base64 | split -b 6258 --additional-suffix .asc - script- args: chdir: files delegate_to: localhost - name: Find ansible.builtin.find: file_type: file paths: files/ patterns: 'script-*' register: f delegate_to: localhost - name: Slurp ansible.builtin.slurp: src: "{{ item }}" register: slurp_shell_code delegate_to: localhost with_items: - "{{ f.files | map(attribute='path') |list }}" - name: Copy shell script ansible.builtin.raw: | cat > script.sh.asc.{{ ansible_loop.index0 }} <<-EOF {{ item.content | b64decode }} EOF args: executable: /bin/bash loop_control: extended: true with_items: - "{{ slurp_shell_code.results }}" - name: Mkdir /usr/local/plop/ ansible.builtin.raw: sudo install -d -m 750 /usr/local/plop/ - name: Merge file ansible.builtin.raw: cat script.sh.asc.* | openssl base64 -d | gzip -d > script.sh - name: Clean temp files ansible.builtin.raw: rm -f script.sh.asc.* - name: Mv shell script ansible.builtin.raw: sudo mv script.sh /usr/local/plop/script.sh - name: Launch script ansible.builtin.raw: sudo bash /usr/local/plop/script.sh