{"id":20968,"date":"2022-12-07T22:10:35","date_gmt":"2022-12-07T21:10:35","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/?p=20968"},"modified":"2022-12-07T22:18:34","modified_gmt":"2022-12-07T21:18:34","slug":"cloud-init-native-ansible-support","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/cloud-init-native-ansible-support\/","title":{"rendered":"cloud-init native Ansible support"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

Cloud-init is a software developed to setup automatically a cloud virtual machine using metadata ingested and applied at the first boot or at a chosen frequency. All the magic happens through a #cloud-config YAML file.<\/p>\n\n\n\n

#cloud-config already supports Ansible execution since ages<\/h2>\n\n\n\n

Yes, true ! But only through cc_runcmd module as follows<\/p>\n\n\n\n

#cloud-config\n\npackages:\n  - git\n  - ansible\n\nruncmd:\n  - [ git, clone, <some magic repo URL> ]\n  - [ ansible-playbook, <magic playbook> ]<\/code><\/pre>\n\n\n\n
Alternatively, you can install Ansible through Python package manager (aka. pip)<\/p>\n\n\n\n
#cloud-config\n\npackages: \n  - git\n  - ansible\n\nruncmd:\n  - [ python3, -m, pip, install, ansible ]\n  - [ git, clone, <some magic repo URL> ]\n  - [ ansible-playbook, <magic playbook> ]<\/code><\/pre>\n\n\n\n
Both methods work perfectly fine \ud83d\ude42 <\/p>\n\n\n\n
New #cloud-config Ansible module: cc_ansible<\/h2>\n\n\n\n
Native cloud-init Ansible support offers not only better readability for our YAML file but also a huge operative advantage. As we can now execute, test, validate the execution of the Ansible playbooks in an isolated manner by executing the Ansible playbook as a standalone module:<\/p>\n\n\n\n
[root@bastion-openvpn ~]# cloud-init single --name cc_ansible\nCloud-init v. 22.4.2 running 'single' at Wed, 07 Dec 2022 20:48:32 +0000. Up 2457.30 seconds.\nStarting Ansible Pull at 2022-12-07 21:48:35\n\/usr\/bin\/ansible-pull --url=https:\/\/oauth2:<GitHub access token>@github.com\/jewdba\/Ansible_OpenVPN-server.git playbooks\/cloud-init_openvpn-server_setup.yml\n\nPLAY [OpenVPN setup] ********************\n\nTASK [Gathering Facts] *********************************************************\nok: [localhost]\n\nTASK [Install eady-rsa package] ************************************************\nchanged: [localhost]\n...<\/code><\/pre>\n\n\n\n
Indeed, the cc_ansible module is now available since the release 22.3.x  and it goes even beyond a simple Ansible playbook execution. <\/p>\n\n\n\n
<\/p>\n\n\n\n
Please refer to the documentation for details <\/p>\n\n\n\n
https:\/\/cloudinit.readthedocs.io\/en\/latest\/topics\/modules.html#module-cloudinit.config.cc_ansib<\/a><\/p>\n\n\n\n
#cloud-config an Ansible Control node<\/h3>\n\n\n\n
# cloud-config\n\nansible:\n  install_method: pip\n  package_name: ansible\n  run_user: ansible\n  setup_controller:\n    repositories:\n      - path: \/home\/ansible\/\n       source: <some magic repo URL>\n    run_ansible:\n      - playbook_dir: \/home\/ansible\/<magit Ansible project>\n        playbook_name: <magic playbook><\/code><\/pre>\n\n\n\n
Looks promising isn’t it?  <\/p>\n\n\n\n
Hint<\/strong>: Checkout the documentation as you might misinterpret some parameters like run_user which works only in case Ansible has been installed with pip (install_method). <\/p>\n\n\n\n
#cloud-config an Ansible managed node (ansible-pull)<\/h3>\n\n\n\n
This paragraph is probably the most interesting as you may want to cloud-init a machine with ansible-pull.<\/p>\n\n\n\n
Let’s cloud-init an OpenVPN Rocky Linux 8 server:<\/p>\n\n\n\n
#cloud-config\n\nusers:\n  - name: ansible\n    homedir: \/home\/ansible\n    shell: \/bin\/bash\n    sudo: 'ALL=(ALL) NOPASSWD:ALL'\n    ssh_authorized_keys:\n      - <SSH plubic key to connect from your laptop>\n\npackages:\n  - unzip\n  - epel-release\n  - git\n\nruncmd:\n# fail2ban part of epel-release repo.\n  - [\/usr\/bin\/dnf, -y, install, fail2ban]\n  - [\/usr\/bin\/dnf, -y, update, google-osconfig-agent]\n  - [\/usr\/bin\/dnf, -y, update, google-guest-agent]\n  - [\/usr\/bin\/systemctl, restart, fail2ban]\n\nwrite_files:\n  - path: \/etc\/fail2ban\/jail.d\/sshd.conf\n    permissions: '0640'\n    owner: root\n    content: |\n      [sshd]\n      enabled=true\n      # don't block localhost, local machines\n      ignoreip=127.0.0.1\/8 192.168.0.1\/16\n\nansible:\n  install_method: distro\n  package_name: ansible.noarch\n  pull:\n   #accept_host_key: true\n    url: \"https:\/\/oauth2:<GitHub access token>@github.com\/jewdba\/Ansible_OpenVPN-server.git\"\n    playbook_name: \"playbooks\/cloud-init_openvpn-server_setup.yml\"<\/code><\/pre>\n\n\n\n
Quite clear isn’t it?<\/p>\n\n\n\n
Almost the perfect combo<\/h1>\n\n\n\n
It’s definitively worth to invest some time of debugging in order to get everything done by cloud-init and the new cc_ansible module  \ud83d\ude42 <\/p>\n\n\n\n
Hereby some learnings which may help you to gain\/save time:<\/p>\n\n\n\n