030's questions

The aim is to upgrade snap packages, e.g. n3dr and informado, using Ansible. The following task has been created:

- name: Install various snap packages
  snap:
    name:
      - informado
      - n3dr

Attempts to solve the issue

The following websites were consulted:

• https://docs.ansible.com/ansible/latest/modules/snap_module.html
• https://github.com/ansible/ansible/issues/62492
• https://github.com/ansible-collections/community.general/blob/main/plugins/modules/packaging/os/snap.py

There seems to be no option to upgrade snap package using ansible

A GitHub issue has been created.

Workaround

1. remove the to be updated packages

    user@host:~$ sudo snap remove informado n3dr
    2020-07-15T10:21:18+02:00 INFO Waiting for
    conflicting change in progress...
    informado removed
    n3dr removed
   

2. run ansible again

3. the newest version of the n3dr and informado have been installed

Question

How to upgrade snap packages without removing them first, using ansible?

Aim: to enable Identity Aware Proxy (IAP) in conjunction with Kubernetes (k8s).

Methods:

• Two apps were deployed
• A SSL load balancer was put in front
• When one navigates to domain/app1, app1 is shown
• This tutorial was followed to enable IAP for k8s https://cloud.google.com/iap/docs/enabling-kubernetes-howto

Results

• The Google login screen appears when one navigates to domain/app1
• When the login succeeds a ‘default gateway - 404’ is shown instead of the app when IAP is disabled

Discussion

• Should a redirect not be configured somewhere? When the authentication and authorization succeeds a URI _gcp_gatekeeper/authenticate was added and a 404 was returned, while a redirect to the app should be done right?
• When an App engine is deployed, IAP is enable the IAP works out of the box. What makes this deploy different? Perhaps App Engine contains some elements that are omitted in k8s.

Current problem

When the authentication succeeds the following error is shown:

There was a problem with your request. Error code 11

If firewall_allowed_ports in:

- name: port {{ item }} allowed in firewall
  ufw:
    rule: allow
    port: "{{ item }}"
    proto: tcp
  with_items: 
    - 22
    - "{{ firewall_allowed_ports }}"

is undefined, then this error occurs:

fatal: [host.example.com]: FAILED! => {"failed": true, "msg": "the field 'args' 
has an invalid value, which appears to include a variable that is undefined.

Attempt to solve the issue

"{{ firewall_allowed_ports | }}"

results in:

fatal: [host.example.com]: FAILED! => {"failed": true, "msg": "template error
while templating string: expected token 'name', got 'end of print statement'. 
String: {{ firewall_allowed_ports | }}"}

Based on this example:

- lineinfile: dest=/opt/jboss-as/bin/standalone.conf regexp='^(.*)Xms(\d+)m(.*)$' line='\1Xms${xms}m\3' backrefs=yes

from this documentation, it was tried to do a regex-replace in Ansible.

Ansible version

user@server:/home$ ansible --version
ansible 2.1.1.0

/path/to/file:

helloworld

Ansible snippets:

- lineinfile:
  dest: /path/to/file
  regexp='^(hello)world$'
  line='\1030'

attempt 2

- lineinfile:
  dest: /path/to/file
  regexp='^(hello)world$'
  line="\1030"

Expected outcome:

hello030

Current outcome:

\1030

Questions

1. Why is the outcome \1030 instead of hello030?
2. How to solve it?

Is there a module that is able to install gulp files, like is possible for npm:

description: Install "coffee-script" node.js package.
- npm: name=coffee-script path=/app/location

description: Install "coffee-script" node.js package on version 1.6.1.
- npm: name=coffee-script version=1.6.1 path=/app/location

description: Install "coffee-script" node.js package globally.
- npm: name=coffee-script global=yes

description: Remove the globally package "coffee-script".
- npm: name=coffee-script global=yes state=absent

description: Install "coffee-script" node.js package from custom registry.
- npm: name=coffee-script registry=http://registry.mysite.com

description: Install packages based on package.json.
- npm: path=/app/location

description: Update packages based on package.json to their latest version.
- npm: path=/app/location state=latest

description: Install packages based on package.json using the npm installed with nvm v0.10.1.
- npm: path=/app/location executable=/opt/nvm/v0.10.1/bin/npm state=present

At the moment the following snippet:

- command: /usr/local/lib/npm/bin/gulp
  args:
    chdir: "{{ project_dir }}"

is used to install gulp packages, but is it possible to do it as follows?

description: Install packages based on package.json.
- gulp: path=/app/location

meta/main.yml

dependencies:
  - { role: 030.sensu-install }

results in:

[DEPRECATION WARNING]: The comma separated role spec format, use the
yaml/explicit format instead..
This feature will be removed in a future release. 
Deprecation warnings can be disabled by setting deprecation_warnings=False in 
ansible.cfg.

when sudo ansible-galaxy install -r requirements/development.yml is issued.

Attempts to solve the issue

When

dependencies:
  - role: 030.sensu-install
    version: 0.1.0

is defined, the syntax check succeeds, but the deprecation warning persists.

When

dependencies:
  - src: 030.sensu-install
    version: 0.1.0

is defined, sudo ansible-galaxy install -r requirements/development.yml is run the deprecation warning is solved, but ansible-playbook /etc/ansible/roles/role_under_test/tests/${playbook} --syntax-check results in:

ERROR! role definitions must contain a role name

This documentation explains how to copy files and directories using the copy module in Ansible. How to copy all childs except one?

Discussion

1. The options do not clarify how it could be done.
2. Copying all childs individually is not an option as the parent contains more than 100 childs.

In order to let checks appear in Uchiwa when a new sensu-client is added, the sensu-server and sensu-api need to be restarted. At the moment there are 5 clients and one server. Everytime a new sensu-client is added using ansible the checks do not appear in Uchiwa. At the moment, I need to login to the sensu-server and restart the services. How to automate this using ansible?

According to this documentation there are handlers:

handlers:
    - name: restart memcached
      service: name=memcached state=restarted
      listen: "restart web services"
    - name: restart apache
      service: name=apache state=restarted
      listen: "restart web services" 

that could be called using notify:

tasks:
    - name: restart everything
      command: echo "this task will restart the web services"
      notify: "restart web services"

so that the service will be restarted if a change occurs in for example the config, but how to notify a remote service, e.g. notify service on IP-B from IP-A?

I have seen multiple Ansible examples on github and in the ansible docs, e.g.:

---
# this might be in a file like handlers/handlers.yml
- name: restart apache
  service: name=apache state=restarted

Github example

The following example contains both a comment as a name.

# Make sure Jenkins starts, then configure Jenkins.
- name: Ensure Jenkins is started and runs on startup.
  service: name=jenkins state=started enabled=yes

Discussion

A name would be sufficient right or should a comment be used?

Should it be:

- name: Symlink RabbitMQ bin to sbin
  file: state=link src=/usr/lib/rabbitmq/bin dest=/usr/lib/rabbitmq/sbin

or:

#Symlink RabbitMQ bin to sbin
file: 
  state: link
  src: /usr/lib/rabbitmq/binhttp://docs.ansible.com/ansible/YAMLSyntax.html
  dest: /usr/lib/rabbitmq/sbin

When YAML Lint is consulted as recommended by the Ansible YAML syntax doc both snippets seem to be valid YAML. Although both snippets seem to be valid YAML the visual structure is different.

Questions

1. Should name (name) be used or a comment (#)?
2. Should it be file: state=link src=/usr/lib/rabbitmq/bin dest=/usr/lib/rabbitmq/sbin or should the elemented by split up, e.g. state:

Running:

- name: get vhosts
  command: rabbitmqctl list_vhosts
  register: vhosts
  changed_when: false

by issuing

sudo ansible-playbook file.yml

results in:

TASK [030.sensu : get vhosts] **************************************************
fatal: [IP]: FAILED! => {"changed": false, "cmd": "rabbitmqctl list_vhosts", 
"failed": true, "msg": "[Errno 2] No such file or directory", "rc": 2}

while this error does not occur if ansible is run on the system itself.

Discussion

1. Is the rc command missing?

Issuing rc both locally as remotely results in:

bash: rc: command not found...

If this would be an issue then running the playbook locally would fail as well.

2. Is this a known issue?

Querying "No such file or directory" rc ansible centos on the internet resulted in this Q&A.

According to one of the answers the issue is caused by command. Using shell instead would solve the problem. The solution was tried, but it did not solve the issue.

Background: in Puppet it is possible to execute a command unless it has already been executed:

exec { '/bin/echo root >> /usr/lib/cron/cron.allow':
  path   => '/usr/bin:/usr/sbin:/bin',
  unless => 'grep root /usr/lib/cron/cron.allow 2>/dev/null',
}

Aim: to execute a command unless it has already been run in Ansible

Methods

tasks/main.yml

- name: add vhost sensu
  command: rabbitmqctl add_vhost /sensu

Results

TASK [ansible-rabbitmq : add vhost sensu] **************************************
fatal: [111.222.333.444]: FAILED! => {"changed": true, "cmd": ["rabbitmqctl",
"add_vhost", "/sensu"], "delta": "0:00:00.210140", "end": 
"2016-07-29 12:55:19.384455", "failed": true, "rc": 2, "start":
"2016-07-29 12:55:19.174315", "stderr": "Error: vhost_already_exists: /sensu", 
"stdout": "Creating vhost \"/sensu\" ...", "stdout_lines": 
["Creating vhost \"/sensu\" ..."], "warnings": []}

Discussion

Googling unless ansible showed this document about when. Based on that documentation, a when statement was added:

- name: add vhost sensu
  command: rabbitmqctl add_vhost /sensu
  when: rabbitmqctl list_vhosts | grep sensu

running the code resulted in:

fatal: [192.168.0.9]: FAILED! => {"failed": true, "msg": "The conditional
 check 'rabbitmqctl list_vhosts | grep sensu' failed. The error was: template
 error while templating string: expected token 'end of statement block', got
 'list_vhosts'. String: {% if rabbitmqctl list_vhosts | grep sensu %} True {%
 else %} False {% endif %}\n\nThe error appears to have been in '/etc/ansible
/roles/ansible-rabbitmq/tasks/main.yml': line 10, column 3, but may\nbe
 elsewhere in the file depending on the exact syntax problem.\n\nThe
 offending line appears to be:\n\n\n- name: add vhost sensu\n  ^ here\n"}

1. First of all, imagine that when was successful then the command will not run and then it looks more like onlyif in Puppet.
2. Secondly, if the when would be successful should an escalation mark be used in order to simulate an unless?
3. Use of register. What if that file is lost or the vhost has been removed by for example a human? Puppet's unless always executes the commands so that it is clear whether the command needs to be executed.

I use hiera as an External Node Classifier in Puppet in order to avoid that roles are deployed on nodes that are for example incompatible. Now I have two servers that are provisioned using Ansible. I am concerned that when the cluster grows that I have to check what nodes are available and then decide what role should be applied instead of hiera that that is doing automatically. For example, system A is a developer system and deploy development role and systemB is a db system deploy database role.

Puppet modules like the ones from puppetforge could be deployed using r10k.

Question

What is the equivalent of this tool in Ansible?

Attempt to answer the question

This Google Q&A was found that does not answer the question

This post combined with Install Sensu using YUM was used in order to install, configure and start Sensu and related services:

sudo yum install -y erlang && \
sudo rpm -Uvh http://www.rabbitmq.com/releases/rabbitmq-server/v3.5.0/rabbitmq-server-3.5.0-1.noarch.rpm && \
sudo yum install -y redis && \
echo '[sensu]
name=sensu
baseurl=http://sensu.global.ssl.fastly.net/yum/$basearch/
gpgcheck=0
enabled=1' | sudo tee /etc/yum.repos.d/sensu.repo && \
sudo yum install -y sensu && \
sudo yum install -y uchiwa && \
for s in rabbitmq-server redis.service sensu-server sensu-api uchiwa; do sudo systemctl restart $s; done && \
sudo rabbitmqctl add_vhost /sensu && \
sudo rabbitmqctl add_user sensu secret && \
sudo rabbitmqctl set_permissions -p /sensu sensu ".*" ".*" ".*"

Analysis

• Navigating to :3000 shows the uchiwa dashboard and indicates Connection error. Is the Sensu API running?
• /var/log/sensu/sensu-api.log indicates

{"timestamp":"2016-07-03T22:58:58.532905+0000","level":"warn","message":"config file does not exist or is not readable","file":"/etc/sensu/config.json"}
{"timestamp":"2016-07-03T22:58:58.533069+0000","level":"warn","message":"ignoring config file","file":"/etc/sensu/config.json"}
{"timestamp":"2016-07-03T22:58:58.533137+0000","level":"warn","message":"loading config files from directory","directory":"/etc/sensu/conf.d"}
{"timestamp":"2016-07-03T22:58:58.712175+0000","level":"info","message":"api listening","protocol":"http","bind":"0.0.0.0","port":4567}

• The config.json does not seems to exist (/etc/sensu/config.json: No such file or directory)
• Downloading the example config.json and restarting the sensu-api did not solve the issue

{
  "rabbitmq": {
    "host": "localhost",
    "vhost": "/sensu",
    "user": "sensu",
    "password": "secret"
  },
  "redis": {
    "host": "localhost",
    "port": 6379,
    "password": "secret"
  }
}

• the redis port is listening:

LISTEN     0      128    127.0.0.1:6379                     *:*

• the rabbitmq port as well:

LISTEN     0      100          *:4567                     *:* 

• Uchiwa cannot connect to the datacenters

{
  "sensu": [
    {
      "name": "Site 1",
      "host": "localhost",
      "port": 4567,
      "timeout": 10
    },
    {
      "name": "Site 2",
      "host": "localhost",
      "port": 4567,
      "ssl": false,
      "path": "",
      "user": "",
      "pass": "",
      "timeout": 10
    }
  ],
  "uchiwa": {
    "host": "0.0.0.0",
    "port": 3000,
    "refresh": 10
  }
}

{"timestamp":"2016-07-03T23:34:32.990067621Z","level":"warn","message":"GET http://localhost:4567/stashes returned: 500 Internal Server Error"}
{"timestamp":"2016-07-03T23:34:32.990102095Z","level":"warn","message":"Connection failed to the datacenter Site 1"}
{"timestamp":"2016-07-03T23:34:32.990115588Z","level":"info","message":"Updating the datacenter Site 2"}
{"timestamp":"2016-07-03T23:34:32.991462585Z","level":"warn","message":"GET http://localhost:4567/stashes returned: 500 Internal Server Error"}
{"timestamp":"2016-07-03T23:34:32.991492978Z","level":"warn","message":"Connection failed to the datacenter Site 2"}

• navigating to <IPADDRESS>:4567 results in:

{"error":"redis and transport connections not initialized"}

• redis replies

sudo redis-cli ping
PONG

• redis password was set, but the issue persists

sudo redis-cli
127.0.0.1:6379> auth secret
OK

In order to debug why this issue occurs the following command is run on a container:

docker run -it <dockerImageName> dmesg

results in:

dmesg: read kernel buffer failed: Permission denied

Attempts

1. Running docker run -it <dockerImageName> sudo dmesg returns the same issue

Add a user

user.ldif

dn: uid=sampleuser,ou=people,dc=my-domain,dc=com
objectClass: top
objectClass: inetOrgPerson
cn: sample user
uid: sampleuser

Problem

[root@host ~]# ldapadd -x -W -D "cn=Manager,dc=my-domain,dc=com" -f user.ldif
Enter LDAP Password:
adding new entry "uid=sampleuser,ou=people,dc=my-domain,dc=com"
ldap_add: Invalid syntax (21)
        additional info: objectClass: value #1 invalid per syntax

Attempt to solve the issue

Changing inetOrgPerson to uidObject and creating the user again:

[root@controller ~]# ldapadd -x -W -D "cn=Manager,dc=my-domain,dc=com" -f user.ldif
Enter LDAP Password:
adding new entry "uid=sampleuser,ou=people,dc=my-domain,dc=com"
ldap_add: Object class violation (65)
        additional info: no structural object class provided

Attempt 2 to solve the issue

ObjectClass inetOrgPerson not found:

Attempt 3 to solve the issue

Unable to add the inetOrgPerson schema:

[root@controller ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"
ldap_add: Other (e.g., implementation specific) error (80)
        additional info: olcObjectClasses: AttributeType not found: "audio"

Sources that already have been read and do not contain a solution that solves the issue

http://docs.adaptivecomputing.com/viewpoint/hpc/Content/topics/1-setup/installSetup/settingUpOpenLDAPOnCentos6.htm

http://www.zytrax.com/books/ldap/ch3/

https://stackoverflow.com/questions/28938957/openldap-structural-objectclass-not-found

http://www.openldap.org/doc/admin24/schema.html

http://www.openldap.org/lists/openldap-software/200503/msg00640.html

http://www.openldap.org/lists/openldap-technical/201002/msg00147.html

http://www.openldap.org/lists/openldap-technical/201002/msg00139.html

Aim

The aim is to disable automatic Puppet-agent runs that occur every 30 minutes. It is possible to change the interval, but the automatic Puppet-agent runs should be disabled completely.

Attempt one

According to this documentation it should be possible to disable automatic Puppet-agent runs by configuring the following:

/etc/puppet/puppet.conf

[agent]
daemonize=false

results in

Notice: Run of Puppet configuration client already in progress; 
skipping  (/var/lib/puppet/state/agent_catalog_run.lock exists)

if puppet is run manually at the default run interval of 30minutes.

Attempt two

user@hostname:~$ sudo puppet agent --disable

results in

user@hostname:~$ sudo puppet agent -t
Notice: Skipping run of Puppet configuration client; 
administratively disabled (Reason: 'reason not specified');
Use 'puppet agent --enable' to re-enable.

Attempt three

This documentation was found after googling the question of this Q&A, but the provided information did not answer the question.

Aim

At the moment there are more than 100 systems in the office and the expectation is that the number will increase. All systems are managed by Puppet. If Puppet code changes on the Puppet Master and needs to be implemented on multiple systems, Puppet is run manually by executing sudo puppet agent -t on every system. Sometimes a change needs to be implemented on more than 10 systems. In order to safe time the idea is to use MCollective, i.e. run puppet one time on all systems instead of running puppet on every system.

Attempt

ActiveMQ, MCollective Server and MCollective Client have been installed on the Puppetmaster. Once mco ping is run the Puppetmaster can be found. After installing MCollective Puppet Agent and running mco rpc puppet runonce Puppet is run on the Puppetmaster.

In order to connect a remote mcollective-client the idea was that activemq and mcollective-client have to be installed and run in order to find the second host by issuing mco ping.

/var/log/mcollective.log

INFO -- : activemq.rb:114:in `on_connecting' TCP Connection attempt 23 to stomp://mcollective@stomp1:6163

/etc/activemq/activemq.xml

    <transportConnectors>
        <transportConnector name="openwire" uri="tcp://0.0.0.0:61616"/>
            <transportConnector name="stomp" uri="stomp://0.0.0.0:61613"/>
        </transportConnectors>
</broker>

/etc/mcollective/server.cfg

connector = activemq
plugin.activemq.pool.size = 1
plugin.activemq.pool.1.host = localhost
plugin.activemq.pool.1.port = 61613
plugin.activemq.pool.1.user = mcollective
plugin.activemq.pool.1.password = helloworld

One of the assumptions was that multiple hosts should be configured in the server.cfg. While trying to make it work it became unclear how the architecture should look like. One ActiveMQ, one MCollective Server and multiple MCollective Clients (one on every node) are required or not?

Expected result

The expected result is that mco ping finds the Puppetmaster and the remote client. Once this works it would be possible to run Puppet on both systems using MCollective. When it is possible to execute Puppet on these two systems using MCollective, multiple nodes will be added and Puppet will run on these systems once mco rpc puppet runonce has been executed.

Current outcome

As it is not possible to find the remote client by executing mco ping it is not possible to run Puppet on both systems using MCollective.

A ZooKeeper Quorum consisting of three ZooKeeper servers has been created.

The zoo.cfg located on all three ZooKeeper servers looks as follows:

maxClientCnxns=50
# The number of milliseconds of each tick
tickTime=2000
# The number of ticks that the initial
# synchronization phase can take
initLimit=10
# The number of ticks that can pass between
# sending a request and getting an acknowledgement
syncLimit=5
# the directory where the snapshot is stored.
dataDir=/var/lib/zookeeper
# the port at which the clients will connect
clientPort=2181

server.1=<ip-address-1>:2888:3888
server.2=<ip-address-2>:2888:3888
server.3=<ip-address-3>:2888:3888

Analysis

It is clear that one of the three ZooKeeper servers will become the Leader and the others Followers. If the Leader ZooKeeper server has been shutdown, the Leader election will start again. The aim is to check if another ZooKeeper server will become the Leader if the Leader server has been shut down.

Problem

The first aim was to run HBase standalone. Navigating to ip:60010/master-status is succesfull once HBase has been started.

The second aim is to run a distinct ZooKeeper quorum. ZooKeeper has been downloaded and has been started:

netstat -nato | grep 2181
tcp        0      0 :::2181                     :::*                        LISTEN      off (0.00/0/0)

The conf/hbase-env.sh was changed as follows:

# Tell HBase whether it should manage it's own instance of Zookeeper or not.
export HBASE_MANAGES_ZK=false

in order to avoid HBase starts ZooKeeper once HBase has been started.

However, the following error occurs once HBase has been started.

Could not start ZK at requested port of 2181.  ZK was started at port: 2182.  
Aborting as clients (e.g. shell) will not be able to find this ZK quorum.

Question

How to disable the startup of ZooKeeper by HBase and run ZooKeeper separately?