Ansible

CMP keeps an inventory file on the management server, adds each new server to the Ansible groups it was ordered with, and runs the playbooks mapped to those groups. Playbooks and ad hoc commands can also be run against a server or a group later.

Prerequisites

Build the management server first, following Ansible’s documentation. The integration then expects the following.

• SSH on port 22 from the CMP appliance to the management server, and from the management server to the servers it manages.
• A username on the management server, with either a password or an SSH key stored in CMP.
• sshd installed on the Linux servers being built, started on boot.
• Credentials in CMP for the servers being built. See Authentication requirements.
• A writable directory on the management server. CMP runs Ansible by copying and executing a script there, so the connected account must be able to write to and run scripts from the named directory in Admin > Miscellaneous Settings > Resource management tab > *nix Temporary Directory for Remote Scripts, or /tmp when empty.
• The SSH host key of each managed server in the management server’s known_hosts. Ansible will not connect until it is present, unless host key checking is disabled on the management server.
• A user for Ansible to connect as. If your playbooks do not name one, set remote_user in the management server’s Ansible configuration file.

Password-less SSH and sudo

Playbooks run without a terminal, so the user Ansible connects as needs a public key on every managed server, with the matching private key on the management server. Configure the key in one of two ways: include it in the image or template the servers are built from, or run the built-in SSH Public Key action, a shared remote script that adds a public key to a Linux server. That action is disabled by default, so enable and attach it where you want it to run, such as a blueprint’s build item.

A playbook that uses sudo needs password-less sudo for that user on the managed server, or it must connect as root. Configure that in the image or with a remote script that runs after provisioning. If you can run the playbook manually on the management server without being prompted, then CMP can run it too.

Connect to a management server

1. Go to Admin > Configuration Managers, then select Add.

2. Select the Ansible tile.

3. Complete the form:

   Field	Description
   Name	Required. Label for the configuration.
   Environments	The environments this manager serves. Set this now or later from the configuration manager or the environment.
   Inventory path	Where CMP writes the inventory file on the management server. Defaults to /home/ansible/cloudbolt.ini.
   Extra vars	Optional variables passed to Ansible’s --extra-vars flag on every run.
   IP or hostname of management server and Username for management server	Required.
   Password for management server or SSH Key for management server	One is required.

4. Select Create. CMP opens an SSH connection to the management server before saving and reports a failure if it cannot connect.

Map playbooks and inventory groups

Open the configuration manager, then:

1. On the Playbooks tab, select Add a Playbook and provide the path to a playbook on the management server and a CMP display name.
2. On the Inventory tab, select Add an Inventory Group. Name the group to match a group name your playbooks use, then choose its playbooks:
   • Initialization Playbooks run when a server joins the group.
   • Available Playbooks can be run on the group’s servers at any time.

Each inventory group is a CMP application. A user adds a server to the group by installing that application, either on the order form or later from the servers list or a server’s detail page. Uninstalling the application removes the server from the group and the Ansible inventory.

CMP writes the inventory to the path set in the configuration manager. Each group becomes a section, and each server in it becomes a line holding the server’s IP address followed by hostname= and its hostname.

The Inventory tab also lists each group’s servers and playbooks. From here, you can run a playbook against the group, edit the group, or remove it.

Run playbooks and ad-hoc commands on a server

Two built-in server actions work on a single server, and both ship disabled:

• Ansible: Run Playbook offers the playbooks available for that server and runs the one you choose.
• Ansible: Run Ad-hoc Command takes an Ansible module and its arguments and runs them against the server.

To enable them, go to Admin > Server Actions, search for Ansible, and set each action to Enabled.

Both actions appear on every server unless scoped: expand the server action, open the plugin listed under it, select Edit, and add your Ansible configuration manager to Configuration managers.

Each run stops after 120 seconds unless a script_timeout parameter value, in seconds, is set for the server. Raise it for playbooks that require more time.