Developing Advanced Automation with Red Hat Ansible Automation Platform

Procedure 6.1. Instructions

1. Clone the https://git.lab.example.com/student/task-escalation.git Git repository into the /home/student/git-repos directory and then create a new branch for this exercise.

   1. From a terminal, create the /home/student/git-repos directory if it does not already exist, and then change into it.

      [student@workstation ~]$ mkdir -p ~/git-repos/
      [student@workstation ~]$ cd ~/git-repos/

   2. Clone the https://git.lab.example.com/student/task-escalation.git repository and then change directory to the cloned repository:

      [student@workstation git-repos]$ git clone \
      > https://git.lab.example.com/student/task-escalation.git
      Cloning into 'task-escalation'...
      ...output omitted...
      [student@workstation git-repos]$ cd task-escalation

   3. Create the exercise branch and check it out.

      [student@workstation task-escalation]$ git checkout -b exercise
      Switched to a new branch 'exercise'

2. Review the global privilege escalation setting in the project ansible.cfg file. Notice that become is set to false so no tasks run with escalated privileges.

   [privilege_escalation]
   become=false
   become_method=sudo
   become_user=root
   become_ask_pass=false

3. Examine the intranet.yml playbook to determine the tasks that require escalation.

   ---
   - name: Enable intranet services
     hosts: servera.lab.example.com
     tasks:
       - name: latest version of httpd and firewalld installed
         ansible.builtin.yum:
           name:
             - httpd
             - firewalld
           state: latest
   
       - name: test html page is installed
         ansible.builtin.copy:
           content: "Welcome to the example.com intranet!\n"
           dest: /var/www/html/index.html
   
       - name: firewalld enabled and running
         ansible.builtin.service:
           name: firewalld
           enabled: true
           state: started
   
       - name: firewalld permits http service
         ansible.posix.firewalld:
           service: http
           permanent: true
           state: enabled
           immediate: true
   
       - name: httpd enabled and running
         ansible.builtin.service:
           name: httpd
           enabled: true
           state: started
   
   - name: Test intranet web server
     hosts: localhost
     tasks:
       - name: connect to intranet web server
         ansible.builtin.uri:
           url: http://servera.lab.example.com
           return_content: true
           status_code: 200

   The tasks from the first play need privilege escalation to run, but the one task from the second play does not. You can use any of the following methods to satisfy those requirements:

   • Add become: true to the top of the first play. This setting causes every task in that play to run with privilege escalation unless otherwise specified.

   • Wrap sequential tasks that need escalation with a block setting, and set privilege escalation for the whole block.

4. Add the privilege escalation to tasks in the first play by using a block statement.

   ---
   - name: Enable intranet services
     hosts: servera.lab.example.com
     tasks:
       - name: Tasks that require privilege escalation
         become: true
         block:
           - name: latest version of httpd and firewalld installed
             ansible.builtin.yum:
               name:
                 - httpd
                 - firewalld
               state: latest
   
           - name: test html page is installed
             ansible.builtin.copy:
               content: "Welcome to the example.com intranet!\n"
               dest: /var/www/html/index.html
   
           - name: firewalld enabled and running
             ansible.builtin.service:
               name: firewalld
               enabled: true
               state: started
   
           - name: firewalld permits http service
             ansible.posix.firewalld:
               service: http
               permanent: true
               state: enabled
               immediate: true
   
           - name: httpd enabled and running
             ansible.builtin.service:
               name: httpd
               enabled: true
               state: started
   
   - name: Test intranet web server
     hosts: localhost
     tasks:
       - name: connect to intranet web server
         ansible.builtin.uri:
           url: http://servera.lab.example.com
           return_content: true
           status_code: 200

5. Use the ansible-navigator command to run the playbook:

   [student@workstation task-escalation]$ ansible-navigator run intranet.yml
   
     Play name                 Ok  Changed  ...  Failed  ...  Task count   Progress
   0│Enable intranet services   6        4  ...       0  ...           6   Complete
   1│Test intranet web server   2        0  ...       0  ...           2   Complete
   
   ^f/PgUp page up     ^b/PgDn page down     ↑↓ scroll    esc back   ... Successful

   Press ESC to exit from the ansible-navigator command.

6. Test that the playbook ran correctly:

   [student@workstation task-escalation]$ curl servera.lab.example.com
   Welcome to the example.com intranet!

7. Remove the block statement from the first play and add the become: true directive. This statement enables privilege escalation for every task in the first play.

   1. Instead of removing the block manually, use the git command to restore the original file.

      [student@workstation task-escalation]$ git restore intranet.yml

   2. Add privilege escalation to tasks in the first play by using a become: true statement. The second play does not require privilege escalation and inherits become: false from the settings defined in the ansible.cfg file.

      ---
      - name: Enable intranet services
        hosts: servera.lab.example.com
        become: true
        tasks:
          - name: latest version of httpd and firewalld installed
            ansible.builtin.yum:
              name:
                - httpd
                - firewalld
              state: latest
      
          - name: test html page is installed
            ansible.builtin.copy:
              content: "Welcome to the example.com intranet!\n"
              dest: /var/www/html/index.html
      
          - name: firewalld enabled and running
            ansible.builtin.service:
              name: firewalld
              enabled: true
              state: started
      
          - name: firewalld permits http service
            ansible.posix.firewalld:
              service: http
              permanent: true
              state: enabled
              immediate: true
      
          - name: httpd enabled and running
            ansible.builtin.service:
              name: httpd
              enabled: true
              state: started
      
      - name: Test intranet web server
        hosts: localhost
        tasks:
          - name: connect to intranet web server
            ansible.builtin.uri:
              url: http://servera.lab.example.com
              return_content: true
              status_code: 200

8. Use the ansible-navigator command to run the playbook:

   [student@workstation task-escalation]$ ansible-navigator run intranet.yml
   
     Play name                 Ok  Changed  ...  Failed  ...  Task count   Progress
   0│Enable intranet services   6        0  ...       0  ...           6   Complete
   1│Test intranet web server   2        0  ...       0  ...           2   Complete
   
   ^f/PgUp page up     ^b/PgDn page down     ↑↓ scroll    esc back   ... Successful

   Press ESC to exit from the ansible-navigator command.

9. Test that the playbook ran correctly:

   [student@workstation task-escalation]$ curl servera.lab.example.com
   Welcome to the example.com intranet!