Collection of Ansible roles to setup and manage components of RHEL like sshd, users, sudo,...
The goal is to help system administrators install and configure their RHEL servers.
You are welcome to suggest improvements either by opening a issue or via a pull request.
This collection was created before we came across https://github.com/linux-system-roles. We will periodically evaluate their progress and eventually use some of their roles.
In your playbook repository, add this to the collections/requirements.yml file:
---
collections:
- name: epfl_si.rhel
version: 2.1.2
Be sure to add the path you want to download collections to is present in your ansible.cfg file:
[defaults]
collections_path = ./collections:~/.ansible/collections/ansible_collections
Then run:
ansible-galaxy collection install -r collections/requirements.yml --collections-path ./collections
Each role has it's own README.md
On the controller node, we prefer to use a virtualenv:
sudo yum install python3.8 python3-virtualenv
mkdir -p ~/python-venv/ansible-8.1.0
virtualenv --python=python3.8 ~/python-venv/ansible-8.1.0
source ~/python-venv/ansible-8.1.0/bin/activate
python -m pip install --upgrade pip
pip install \
ansible==8.1.0 \
ansible-lint \
antsibull-changelog \
molecule \
molecule-podman \
yamllint \
selinux \
psutil \
argcomplete \
boto3
Tests are done using Molecule with the Podman driver. Because we wants to test communications between containers using IP address, we must use rootfull containers.
When writing this, Ansible collections are fairly new and the question about how to update and test roles inside a collection is still discussed by the community. Also, this repository is hosted on GitHub but we only have experience with Gitlab CI. So adaptations could be necessary in the future.
In order to run Systemd services inside Podman, we must mount various volumes, disabling Selinux labeling and add capabilities:
---
platforms:
- name: node1
registry: {url: registry.access.redhat.com}
image: ubi8/ubi-init
tmpfs:
- /run # for SystemD
- /tmp # for SystemD
volumes:
- /sys/fs/cgroup:/sys/fs/cgroup:ro # for SystemD
capabilities:
- SYS_ADMIN # for SystemD
- NET_ADMIN # for FirewallD + VIP testing
command: "/usr/sbin/init"
security_opts:
- label=disable # for SystemD
Each role contains its own tests. To use Molecule:
sudo -i # Remember, we need rootfull containers
source ~/python-venv/ansible-8.1.0/bin/activate
cd roles/<name>
molecule test -s <scenario>
If you want a running environement to debug your changes:
sudo -i
source ~/python-venv/ansible-8.1.0/bin/activate
cd roles/<name>
molecule converge -s <scenario>
molecule login -s <scenario> -h <node-name>
ATM, no automation, everything is done from your computer. To find your token, go to https://galaxy.ansible.com/me/preferences
- Bump the version in
galaxy.yml
source ~/python-venv/ansible-8.1.0/bin/activate
antsibull-changelog lint
antsibull-changelog release --version <ver>
git add .
git commit -m "Release version <ver>"
git tag <ver>
ansible-galaxy collection build
ansible-galaxy collection publish ./epfl_si-rhel-<ver>.tar.gz --token=<token>
rm ./epfl_si-rhel-<ver>.tar.gz
git push --tags
git push