Red Hat Enterprise Linux Automation with Ansible

Procedure 2.4. Instructions

1. The /home/student/playbook-multi directory has been created on the workstation machine for your Ansible project. The directory has already been populated with an ansible.cfg configuration file and an inventory file named inventory. The managed host, servera.lab.example.com, is already defined in this inventory file.

   Create a new playbook named /home/student/playbook-multi/intranet.yml and add the lines needed to start the first play. It should target the managed host servera.lab.example.com and enable privilege escalation.

   1. Change into the /home/student/playbook-multi directory.

      [student@workstation ~]$ cd ~/playbook-multi
      [student@workstation playbook-multi]$

   2. Use a text editor to create a new playbook named /home/student/playbook-multi/intranet.yml. Add a line consisting of three dashes to the beginning of the file to indicate the start of the YAML file.

      ---

   3. Add the following line to the /home/student/playbook-multi/intranet.yml file to denote the start of a play named Enable intranet services.

      - name: Enable intranet services

   4. Add the following line to indicate that the play applies to the servera.lab.example.com managed host. Indent the line with two spaces (aligning with the name keyword above it) to indicate that it is part of the first play.

        hosts: servera.lab.example.com

   5. Add the following line to enable privilege escalation. Indent the line with two spaces (aligning with the keywords above it) to indicate it is part of the first play.

        become: true

   6. Add the following line to define the beginning of the tasks list. Indent the line with two spaces (aligning with the keywords above it) to indicate that it is part of the first play.

        tasks:

2. As the first task in the first play, define a task that ensures that the httpd and firewalld packages are up-to-date.

   Indent the first line of the task with four spaces. Under the tasks keyword in the first play, add the following lines:

       - name: Latest version of httpd and firewalld installed 
         ansible.builtin.dnf: 
           name: 
             - httpd
             - firewalld
           state: latest 

   	A descriptive name for the task.
   	Indented six spaces and calls the ansible.builtin.dnf module.
   	The name keyword, which is a parameter of the ansible.builtin.dnf module, and is indented eight spaces. The name keyword specifies which packages the module should ensure are up-to-date. The name keyword (which is different from the task name) can take a list of packages, which are indented ten spaces on the two following lines.
   	After the list of packages, the state keyword specifies that the module should ensure that the latest version of the packages is installed. The state keyword is also a parameter of the ansible.builtin.dnf module, and is indented eight spaces.

3. Add a task to the first play's list that ensures that the correct content is in the /var/www/html/index.html file.

   Add the following lines to define the content for the /var/www/html/index.html file. Indent the first line four spaces.

       - name: Test html page is installed
         ansible.builtin.copy:
           content: "Welcome to the example.com intranet!\n"
           dest: /var/www/html/index.html

   • The first line provides a descriptive name for the task.

   • The second line is indented six spaces and calls the ansible.builtin.copy module.

   • The remaining lines are indented eight spaces and pass the necessary arguments to ensure that the correct content is in the web page.

4. Define two more tasks in the play to ensure that the firewalld service is running and starts on boot, and allows connections to the httpd service.

   1. Add the following lines to ensure that the firewalld service is enabled and running. Indent the first line four spaces.

          - name: Firewall enabled and running
            ansible.builtin.service:
              name: firewalld
              enabled: true
              state: started

      • The first line provides a descriptive name for the task.

      • The second line is indented eight spaces and calls the ansible.builtin.service module.

      • The remaining lines are indented ten spaces and pass the necessary arguments to ensure that the firewalld service is enabled and started.

   2. Add the following lines to ensure that firewalld allows HTTP connections from remote systems. Indent the first line four spaces.

          - name: Firewall permits access to httpd service
            ansible.posix.firewalld:
              service: http
              permanent: true
              state: enabled
              immediate: yes

      • The first line provides a descriptive name for the task.

      • The second line is indented six spaces and calls the ansible.posix.firewalld module.

      • The remaining lines are indented eight spaces and pass the necessary arguments to ensure that remote HTTP connections are permanently allowed.

5. Add a final task to the first play that ensures that the httpd service is running and starts at boot.

   Add the following lines to ensure that the httpd service is enabled and running. Indent the first line four spaces.

       - name: Web server enabled and running
         ansible.builtin.service:
           name: httpd
           enabled: true
           state: started

   • The first line provides a descriptive name for the task.

   • The second line is indented six spaces and calls the ansible.builtin.service module.

   • The remaining lines are indented eight spaces and pass the necessary arguments to ensure that the httpd service is enabled and running.

6. In the /home/student/playbook-multi/intranet.yml file, define a second play that targets localhost and tests the intranet web server. (Plays that run on localhost are run inside the automation execution environment by ansible-navigator, and not directly on your control node.) It does not need privilege escalation.

   1. Add the following line to define the start of a second play. Note that there is no indentation.

      - name: Test intranet web server

   2. Add the following line to indicate that the play runs on the automation execution environment, localhost. Indent the line two spaces to indicate that it is contained by the second play.

        hosts: localhost

   3. Add the following line to disable privilege escalation. Align the indentation with the hosts keyword above it.

        become: false

   4. Add the following line to the /home/student/playbook-multi/intranet.yml file to define the beginning of the tasks list. Indent the line two spaces to indicate that it is contained by the second play.

        tasks:

7. Add a single task to the second play, and use the ansible.builtin.uri module to request content from http://servera.lab.example.com. The task should verify a return HTTP status code of 200. Configure the task to place the returned content in the task results variable.

   Add the following lines to create the task for verifying the web service from the control node. Indent the first line four spaces.

       - name: Connect to intranet web server
         ansible.builtin.uri:
           url: http://servera.lab.example.com
           return_content: yes
           status_code: 200

   • The first line provides a descriptive name for the task.

   • The second line is indented with six spaces and calls the ansible.builtin.uri module.

   • The remaining lines are indented with eight spaces and pass the necessary arguments to execute a query for web content from the control node to the managed host and verify the status code received.

   • The return_content keyword ensures that the server's response is added to the task results.

8. Verify that the final /home/student/playbook-multi/intranet.yml playbook reflects the following structured content, and then save and close the file.

   ---
   - name: Enable intranet services
     hosts: servera.lab.example.com
     become: true
     tasks:
       - name: Latest version of httpd and firewalld installed
         ansible.builtin.dnf:
           name:
             - httpd
             - firewalld
           state: latest
   
       - name: Test html page is installed
         ansible.builtin.copy:
           content: "Welcome to the example.com intranet!\n"
           dest: /var/www/html/index.html
   
       - name: Firewall enabled and running
         ansible.builtin.service:
           name: firewalld
           enabled: true
           state: started
   
       - name: Firewall permits access to httpd service
         ansible.posix.firewalld:
           service: http
           permanent: true
           state: enabled
           immediate: yes
   
       - name: Web server enabled and running
         ansible.builtin.service:
           name: httpd
           enabled: true
           state: started
   
   - name: Test intranet web server
     hosts: localhost
     become: false
     tasks:
       - name: Connect to intranet web server
         ansible.builtin.uri:
           url: http://servera.lab.example.com
           return_content: yes
           status_code: 200

9. Run the ansible-navigator run --syntax-check command to validate the syntax of the /home/student/playbook-multi/intranet.yml playbook.

   [student@workstation playbook-multi]$ ansible-navigator run \
   > -m stdout intranet.yml --syntax-check
   playbook: /home/student/playbook-multi/intranet.yml

10. Run the playbook using the ansible-navigator run command. Read through the generated output to ensure that all tasks completed successfully. Verify that an HTTP GET request to http://servera.lab.example.com provides the correct content.

    1. Run the playbook using the ansible-navigator run command.

       [student@workstation playbook-multi]$ ansible-navigator run \
       > -m stdout intranet.yml
       
       PLAY [Enable intranet services] ************************************************
       
       TASK [Gathering Facts] *********************************************************
       ok: [servera.lab.example.com]
       
       TASK [Latest version of httpd and firewalld installed] *************************
       changed: [servera.lab.example.com]
       
       TASK [Test html page is installed] *********************************************
       changed: [servera.lab.example.com]
       
       TASK [Firewall enabled and running] ********************************************
       changed: [servera.lab.example.com]
       
       TASK [Firewall permits access to httpd service] ********************************
       changed: [servera.lab.example.com]
       
       TASK [Web server enabled and running] ******************************************
       changed: [servera.lab.example.com]
       
       PLAY [Test intranet web server] ************************************************
       
       TASK [Gathering Facts] *********************************************************
       ok: [localhost]
       
       TASK [Connect to intranet web server] ******************************************
       ok: [localhost]
       
       PLAY RECAP *********************************************************************
       localhost                  : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
       servera.lab.example.com    : ok=6    changed=5    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

    2. Use the curl command to verify that an HTTP GET request to http://servera.lab.example.com provides the correct content.

       [student@workstation playbook-multi]$ curl http://servera.lab.example.com
       Welcome to the example.com intranet!