Ansible: Server and Network Device Automation

Transcription

1 Ansible: Server and Network Device Automation Klaus Mueller & Ian Logan June 8, 2018

2 Who we are Klaus Mueller Senior Solutions Architect, ANM Route/Switch CCIE # years experience in IT 20 years experience working with State/Local, Healthcare, Education, and Commercial in New Mexico Specialize in campus and data center networks Ian Logan Senior Solutions Architect, ANM 20 years at NMSU Data center architecture Private networks for energy management systems Unix & Linux systems administration Specialize in data center virtualization and automation

3 ANM is headquartered in Albuquerque, NM and operates in Colorado, Texas and New Mexico. In addition to Albuquerque, ANM has offices in Denver (CO), Colorado Springs (CO) and El Paso (TX).

4 Evolution of Network Configuration First Cisco Router 1986 CLI via console and Telnet Latest Cisco Router 2018 CLI via console and SSH

5 There are tools but they are costly and frustrating and often go un-/under-used

6 and old habits die hard Copy & Paste Notepad

7 Cloud Server Virtualization Open Source Linux Meanwhile in Servers Chef/Puppet vra PowerShell DevOps Tools Methodologies Technologies

8 To be fair Software Defined Networks Cisco ACI VMware NSX Data Center Network Fabrics Network Function Virtualization (NFV) Network Programmability APIs and Standards NetDevOps Infrastructure as Code

9 More on Software Defined Software Defined Networks Many approaches: Controller-based, centralized data plane (e.g. OpenFlow) Central policy engine (e.g. Cisco ACI) Focus has been on data center ACI, Vmware NSX Evolving to WAN (SD-WAN e.g. Viptela, Riverbed), and Access (SD-Access e.g. Cisco Digital Network Architecture, aka DNA) Very promising, still early in adoption in most orgs.

10 The Holy Grail Be like Facebook Or somewhere in between Standardized configs Automated deployment Push changes quickly Automate repetitive tasks Automatically deploy a fully populated rack of servers and network gear with minimal intervention.

11 Network Engineers need new skills

12 Network Engineers need new skills Python Scripting Linux (or Mac OS X) Using open-source tools Templating Jinja Programmability REST APIs YAML, JSON, XML NETCONF Data Models YANG

13 DevOps Tools can help bridge the gap Chef and Puppet Agent-based Ansible and Salt Agent-less Automation Configuration deployment and management Open Source Community Driven Many learning resources

14 Ansible The Easier Button Agent-less Works well for both network and servers Idempotent configuration management Modular framework Supported by Red Hat Works with templates and variables Communicates over SSH Simple templating language (Playbooks = YAML)

15 Ansible Deep Dive

16 How would you describe Ansible in one sentence? A tool for expressing the desired state of a system at a high level.

17 Ansible plays nicely with just about everyone!

18 Requirements for installing Ansible Python 2.6/2.7 or 3.5 and newer A Unix like system to act as the control machine

19 Playbook Ansible Engine SSH Managed Node A YAML doc Living MOP Inventory Host File API Modules Password Vault Unix/Linux/Windows Cisco IOS/NXOS/ACI vsphere And many more

20 Choices on installing Ansible Vendor packages or Python pip Packages might be a little stale but ease of maintenance is probably worth it.

21 We ll use CENTOS 7.5 for our examples. Its that easy.

22 Ansible s master config file ansible.cfg ANSIBLE_CONFIG Env. variable ansible.cfg In current directory $HOME/.ansible.cfg /etc/ansible/ansible.cfg The first one found wins

23 We ll take all the defaults except for 2 lines

24 Ansible s inventory system: A simple text file. Dynamic inventory from AWS, OpenStack, etc. You can use both simultaneously.

25 Ansible host file: INI style formatting Group names are in [] Hosts can belong to multiple groups Groups can be nested Ansible Deep dive

26 Linux demo environment: Precreated a user named ansible on each machine SSH authorized_keys configuration Added sudo configuration for the ansible user These steps are all optional, but they make the demo easier.

27 Ansible one liners for Linux:

28 Ansible facts & variables: Facts are variables that describe the system being managed Facts can be automatically gathered You reference a variable with {{ variable }}

29 Ansible facts & variables: You can get all of the facts for a device with a one liner ansible ios-devices -c network_cli -m ios_facts ansible linux -m setup

30 Gathering facts takes a while On a Linux host it there are over 100 facts Output from many one liners will be in JSON

31 Ansible playbooks: Playbooks are our tool for automating complex tasks. Playbooks also allow us to express orchestration across multiple managed nodes. They re written as YAML documents.

32 YAML: Indentation matters!! Indent to group related items # begins a comment begins a YAML document - to denote list elements

33 A sample playbook: Hosts: the target nodes Become* do we need elevated privileges? Tasks: list of things to do We call these plays Yum is an ansible module Name: httpd a RPM name State: present or absent

34 Running a playbook:

35 Playbooks can be executable scripts: Add a #!/usr/bin/ansible-playbook as the first line Make the file executable

36 Lets get rid of Apache:

37 One more Linux playbook: One play with two tasks

38

39 Lets look at a Network playbook: Inventory_hostname is a builtin variable

40 {{ inventory_hostname }} is replaced with the name of the current node

41 We can iterate across lists with items Parents are how we change the config context for IOS

42

43 Make sure you write the entire command! Ios_config module makes comparisons between the playbook and the running config. If its not an exact match, the command is executed at every run.

44 We re not using SSH keys to login to the router, where s the password? We can store the password in a variable. Variables can be stored in encrypted files called vaults.

45 How do we organize per host or group variables? We can put them in the playbook itself. We can create host/group variables in the host_vars/group_vars directory. One file for each host/group.

46 Host variables for an IOS device Ansible_connection: network_cli optimizes Ansibles interaction with CLI style devices Ansible_network_os: ios, vyos, junos, etc. Ansible_ssh_pass: the login password

47 Choosing What to Automate

48 DevOps: The 3 Ways via Gene Kim, et al see The Phoenix Project and The DevOps Handbook

49 E.g. Use Cases Regular, repetitive tasks Large-scale infrequent tasks pushing config changes to large number of devices In-frequent tasks that require consistency e.g. device deployment Building Flow: Theory of Constraints manual tasks that take a long time that can be automated Pushing configs to multiple device Templatizing config changes Automating config changes Automating deployments Reporting and compliance

50 What Next? Resources

51 Books

52 Websites Ansible Website: Documentation, Quick Start videos, Tutorials Cisco DevNet: developer.cisco.com Free login Free training "Network Programmability for Network Engineers Ansible videos and learning labs

53 Links Ansible.com Documentation and Quick Start videos: docs.ansible.com Developer.cisco.com Introduction to Ansible NetDevOps videos Ansible for Cisco configuration management Getting Hands on with Ansible Learning Lab

54 Contact Us See us at ANM table in the Vendor Fair Demo capability us: