Managing Enterprise Automation with Red Hat Ansible Automation Platform

Procedure 6.1. Instructions

1. Review the following automation controller resources created by the lab command for this exercise.

   • The Git project that contains the playbooks used by several job templates that set up secure web servers and populate them with content

   • The job templates for those playbooks, as well as another playbook that restores the web servers to a basic configuration if the workflow fails

   • The Dev inventory for the job templates, and an Email AAP Admins notification template that can be used to report on the status of job completion

   In this exercise, you take these components and use them to create a workflow job template.

   1. Navigate to https://controller.lab.example.com and log in as the admin user with redhat as the password.

   2. Navigate to Resources → Projects and then click the link for the DEV - Secure Webservers project. This is the Git project that contains the playbooks to set up the secure web servers.

   3. Navigate to Resources → Templates and then click the link for the DEV - Deploy HTTPS job template. This job template deploys secure web servers on the hosts.

   4. Navigate to Resources → Templates and then click the link for the DEV - Populate Webservers job template. This job template populates the web servers with content pulled from a Git repository.

   5. Navigate to Resources → Templates and then click the link for the DEV - Revert HTTPS job template. In case of failure, this job template restores the web servers to a basic web server configuration.

   6. Navigate to Resources → Inventories and then click the link for the Dev inventory. This is the inventory for the secure web servers.

   7. Navigate to Administration → Notifications and then click the link for the Email AAP Admins notification template. This notification template sends emails to report the status of jobs.

2. Create a new workflow job template named DEV - Deploy HTTPS and Populate Webservers that uses the Dev inventory to deploy the secure web servers to managed hosts.

   1. Navigate to Resources → Templates and then click Add → Add workflow template.

   2. On the next page, fill in the details as follows:

      Field	Value
      Name	DEV - Deploy HTTPS and Populate Webservers
      Organization	Default
      Inventory	Dev

   3. Click Save.

3. Add a Project Sync node named Synchronize Project to synchronize the DEV - Secure Webservers project.

   1. On the workflow visualizer page, click Start.

   2. On the Add Node page, select Project Sync in the Node Type list.

   3. Select the DEV - Secure Webservers project, scroll down to view the Node Alias field, and enter Synchronize Project in that field.

   4. Click Save. On the workflow visualizer page under Synchronize Project, notice the P symbol that indicates it is a project sync node.

      Figure 6.9: Project synchronization node

4. Add a Job Template node that launches the DEV - Deploy HTTPS job template to deploy the secure web servers if the Synchronize Project node succeeds.

   1. In the workflow visualizer, click the Synchronize Project node and click the + icon to add a new node.

   2. On the Run type page, select the On Success condition and then click Next.

   3. Select the DEV - Deploy HTTPS job template, scroll down to view the Node Alias field, and enter Deploy HTTPS in that field.

   4. Click Save. Notice the JT symbol, which indicates it is a job template node.

      Note

      You might need to increase the display resolution on the workstation machine, decrease the web browser zoom, or both, in order to see the entire visualizer display screen.

      Additionally, if your mouse has a scroll wheel, then you can use the scroll wheel to zoom in and out of the visualizer.

5. Add a job template node that launches the DEV - Populate Webservers job template to populate the secure web servers with content if the Deploy HTTPS node succeeds.

   1. In the workflow visualizer, click the Deploy HTTPS node and then click the + icon to add a new node.

   2. On the Run type page, select the On Success condition and then click Next.

   3. Select the DEV - Populate Webservers job template, scroll down to view the Node Alias field, and enter Populate Webservers in that field.

   4. Click Save.

6. Add a job template node that launches the DEV - Revert HTTPS job template to revert the configuration of the secure web servers if the Deploy HTTPS node fails.

   1. In the workflow visualizer, click the Deploy HTTPS node and then click the + icon to add a new node.

   2. On the Run type page, select the On Failure condition and then click Next.

   3. Select the DEV - Revert HTTPS job template, scroll down to view the Node Alias field, and enter Revert HTTPS in that field.

      Note

      You might need to go to page 2 to look for the DEV - Revert HTTPS job template. Alternatively, you can search for "Revert" to see the job template.

   4. Click Save.

   5. Click Save again in the upper-right corner to save this workflow template.

      Figure 6.10: Workflow job template

7. Launch the workflow job template and observe the result. The Deploy HTTPS job template fails and triggers the Revert HTTPS job template.

   1. Navigate to Resources → Templates.

   2. Click the Launch Template icon for the DEV - Deploy HTTPS and Populate Webservers.

   3. Observe that the Deploy HTTPS job template fails and triggers the Revert HTTPS job template.

   4. Click the Deploy HTTPS node and then click the Output tab to determine the cause of the failure.

      The output indicates that the playbook successfully started and enabled the httpd service on the servera.lab.example.com host, but that the playbook failed to start the httpd service on the serverb.lab.example.com host.

8. Review the httpd logs on serverb.lab.example.com to identify the problem.

   [student@workstation ~]$ ssh serverb journalctl -u httpd | grep error -A4
   Jun 01 09:29:57 serverb.lab.example.com httpd[3983]: AH00526: Syntax error on line 86 of /etc/httpd/conf.d/ssl.conf:
   Jun 01 09:29:57 serverb.lab.example.com httpd[3983]: SSLCertificateFile: file '/etc/pki/tls/certs/servera.lab.example.com.crt' does not exist or is empty
   Jun 01 09:29:57 serverb.lab.example.com systemd[1]: httpd.service: Main process exited, code=exited, status=1/FAILURE
   Jun 01 09:29:57 serverb.lab.example.com systemd[1]: httpd.service: Failed with result 'exit-code'.
   Jun 01 09:29:57 serverb.lab.example.com systemd[1]: Failed to start The Apache HTTP Server.

   • The problem is that the ssl.conf configuration file incorrectly specifies servera.lab.example.com in the file paths for the HTTPS certificate file and the associated key file.

   • For serverb.lab.example.com, the certificate file should be /etc/pki/tls/certs/serverb.lab.example.com.crt.

   • The ssl.conf configuration file should be deployed as a Jinja2 template that uses the ansible_facts['fqdn'] fact to generate the correct path for the certificate and key files for each server.

9. Repair the issue with the playbook.

   Clone the Git repository for the project, convert the affected file into a Jinja2 template, make the change, and update the deploy_https.yml playbook so that it correctly deploys the template to the managed hosts being provisioned. Commit your changes to your local Git repository and push them to the remote GitLab server.

   1. From a terminal, create the /home/student/git-repos directory if it does not already exist, and then change into it.

      [student@workstation ~]$ mkdir -p ~/git-repos/
      [student@workstation ~]$ cd ~/git-repos/

   2. Clone the https://git.lab.example.com/git/secure_webservers_DEV.git Git repository into the /home/student/git-repos directory.

      [student@workstation git-repos]$ git clone \
      > https://git.lab.example.com/git/secure_webservers_DEV.git
      Cloning into 'secure_webservers_DEV'...
      ...output omitted...
      [student@workstation git-repos]$ cd secure_webservers_DEV

   3. Look for lines starting with the SSLCertificate pattern in the files/ssl.conf file. Notice how the configuration file uses the certificate and key for the servera.lab.example.com host.

      [student@workstation secure_web servers_DEV]$ grep ^SSLCertificate files/ssl.conf
      SSLCertificateFile /etc/pki/tls/certs/servera.lab.example.com.crt
      SSLCertificateKeyFile /etc/pki/tls/private/servera.lab.example.com.key

   4. Modify the files/ssl.conf file to replace both instances of servera.lab.example.com with the ansible_facts['fqdn'] variable. The modified lines should have the following content:

      SSLCertificateFile /etc/pki/tls/certs/{{ ansible_facts['fqdn'] }}.crt
      SSLCertificateKeyFile /etc/pki/tls/private/{{ ansible_facts['fqdn'] }}.key

   5. Rename the files directory to templates and the ssl.conf file to ssl.conf.j2

      [student@workstation secure_webservers_DEV]$ mv files/ templates
      [student@workstation secure_webservers_DEV]$ mv templates/ssl.conf \
      > templates/ssl.conf.j2

   6. Update the deploy_https.yml file to use the template module instead of the copy module and change the src option to reference the new templates/ssl.conf.j2 file. The Configure Apache for HTTPS task should have the following content:

      - name: Configure Apache for HTTPS
        template:
          src: templates/ssl.conf.j2
          dest: /etc/httpd/conf.d/ssl.conf
        notify: restart_apache

   7. Commit and push the changes to the Git repository.

      [student@workstation secure_webservers_DEV]$ git add deploy_https.yml \
      > files templates/
      
      [student@workstation secure_web servers_DEV]$ git commit -m \
      > "Fix Deploy HTTPS playbook"
      [main 94dd74c] Fix Deploy HTTPS playbook
       2 files changed, 4 insertions(+), 4 deletions(-)
       rename files/ssl.conf => templates/ssl.conf.j2 (98%)
      
      [student@workstation secure_web servers_DEV]$ git push -u origin
      Enumerating objects: 7, done.
      ...output omitted...
      Branch 'main' set up to track remote branch 'main' from 'origin'.

10. Launch the template through the automation controller web UI. The Deploy HTTPS job template completes successfully and launches the Populate Webservers job template.

    1. Navigate to Resources → Templates.

    2. Click the Launch Template icon for the DEV - Deploy HTTPS and Populate Webservers workflow job template.

    3. The first step updates the project with the changes you have committed.

    4. Observe that this time the Deploy HTTPS job template completes successfully and as a result the Populate Webservers job template is launched.

11. Verify that the secure web servers are configured and the slides are populated.

    1. Navigate to https://servera.lab.example.com and confirm that you see slides from DO467.

    2. Navigate to https://serverb.lab.example.com and confirm that you see slides from DO467.