Red Hat Certified Engineer (RHCE) #19 フルスケール模擬試験: 15 のタスク + 解説

[defaults]
inventory = ./inventory
remote_user = ansible
host_key_checking = False

[privilege_escalation]
become = True
become_method = sudo
become_user = root
become_ask_pass = False

[webservers]
node1
node2

[dbservers]
node3

[balancers]
node4

[prod:children]
webservers
dbservers

ansible-inventory --graph
ansible prod --list-hosts

mkdir -p group_vars host_vars

package_state: present

db_port: 5432

server_role: primary

ansible node1 -m ansible.builtin.debug -a "var=server_role"
ansible node3 -m ansible.builtin.debug -a "var=db_port"
ansible node2 -m ansible.builtin.debug -a "var=package_state"

---
- name: Configure web servers
  hosts: webservers
  tasks:
    - name: Install httpd
      ansible.builtin.dnf:
        name: httpd
        state: present

    - name: Ensure httpd is enabled and started
      ansible.builtin.service:
        name: httpd
        state: started
        enabled: true

    - name: Deploy index page
      ansible.builtin.copy:
        content: "Welcome to {{ inventory_hostname }}\n"
        dest: /var/www/html/index.html
      notify: Restart httpd

  handlers:
    - name: Restart httpd
      ansible.builtin.service:
        name: httpd
        state: restarted

ansible-navigator run -m stdout web.yml
ansible-navigator run -m stdout web.yml   # changed=0

---
- name: Report host facts
  hosts: prod
  tasks:
    - name: Show memory and IP
      ansible.builtin.debug:
        msg: "{{ inventory_hostname }} has {{ ansible_facts['memtotal_mb'] }}MB, IP {{ ansible_facts['default_ipv4']['address'] }}"

    - name: Warn on low memory
      ansible.builtin.debug:
        msg: "WARNING: {{ inventory_hostname }} has only {{ ansible_facts['memtotal_mb'] }}MB"
      when: ansible_facts['memtotal_mb'] | int < 2048

ansible-navigator run -m stdout facts.yml

Welcome to {{ ansible_facts['hostname'] }}
OS: {{ ansible_facts['distribution'] }} {{ ansible_facts['distribution_version'] }}
CPUs: {{ ansible_facts['processor_vcpus'] }}
Managed by Ansible. Do not edit manually.

---
- name: Deploy MOTD from template
  hosts: prod
  tasks:
    - name: Template /etc/motd
      ansible.builtin.template:
        src: motd.j2
        dest: /etc/motd
        owner: root
        group: root
        mode: '0644'

ansible-navigator run -m stdout motd.yml
ansible-navigator run -m stdout motd.yml   # changed=0

---
- name: Create users with loop
  hosts: webservers
  vars:
    app_users:
      - alice
      - bob
      - carol
  tasks:
    - name: Ensure developers group exists
      ansible.builtin.group:
        name: developers
        state: present

    - name: Create application users
      ansible.builtin.user:
        name: "{{ item }}"
        groups: developers
        append: true
        shell: /bin/bash
        state: present
      loop: "{{ app_users }}"

ansible-navigator run -m stdout users_loop.yml
ansible-navigator run -m stdout users_loop.yml   # changed=0

---
- name: Safe deploy with block/rescue/always
  hosts: dbservers
  tasks:
    - name: Deploy database
      block:
        - name: Install mariadb-server
          ansible.builtin.dnf:
            name: mariadb-server
            state: present

        - name: Start mariadb
          ansible.builtin.service:
            name: mariadb
            state: started
            enabled: true

        - name: Check service status
          ansible.builtin.command: systemctl is-active mariadb
          register: svc_status
          changed_when: false
      rescue:
        - name: Record failure
          ansible.builtin.copy:
            content: "mariadb deploy failed on {{ inventory_hostname }}\n"
            dest: /var/log/deploy-failed.log
      always:
        - name: Report disk usage
          ansible.builtin.command: df -h /
          register: disk
          changed_when: false

        - name: Show disk usage
          ansible.builtin.debug:
            var: disk.stdout_lines

ansible-navigator run -m stdout safe_deploy.yml

echo 'changeme' > vault_pass.txt
ansible-vault create --vault-password-file vault_pass.txt secret.yml

db_root_password: "S3cret!"

---
- name: Use a vaulted variable
  hosts: dbservers
  vars_files:
    - secret.yml
  tasks:
    - name: Write credentials file
      ansible.builtin.copy:
        content: "root_password={{ db_root_password }}\n"
        dest: /root/db_credentials.txt
        owner: root
        group: root
        mode: '0600'

ansible-navigator run -m stdout vault_use.yml --vault-password-file vault_pass.txt

ansible-galaxy init roles/apache

apache_port: 80

---
- name: Install httpd
  ansible.builtin.dnf:
    name: httpd
    state: present

- name: Configure listen port
  ansible.builtin.template:
    src: listen.conf.j2
    dest: /etc/httpd/conf.d/listen.conf
  notify: Restart httpd

- name: Ensure httpd is running
  ansible.builtin.service:
    name: httpd
    state: started
    enabled: true

Listen {{ apache_port }}

---
- name: Restart httpd
  ansible.builtin.service:
    name: httpd
    state: restarted

---
- name: Apply apache role
  hosts: webservers
  roles:
    - role: apache
      apache_port: 8080

ansible-navigator run -m stdout use_role.yml
ansible-navigator run -m stdout use_role.yml   # changed=0

---
collections:
  - name: community.general
  - name: ansible.posix

ansible-galaxy collection install -r collections/requirements.yml -p ./collections

ansible-galaxy collection list
ansible-doc ansible.posix.firewalld

sudo dnf install -y rhel-system-roles
ansible-galaxy collection list | grep rhel_system_roles

---
- name: Configure NTP with timesync system role
  hosts: prod
  vars:
    timesync_ntp_servers:
      - hostname: time.example.com
        iburst: true
  roles:
    - redhat.rhel_system_roles.timesync

ansible-navigator run -m stdout timesync.yml
ansible-navigator run -m stdout timesync.yml   # changed=0

---
- name: Provision accounts
  hosts: prod
  vars:
    srv_users:
      - name: deploy
        uid: 2001
        password: "$6$rounds=656000$abcXYZ$hashedvalue1"
      - name: backup
        uid: 2002
        password: "$6$rounds=656000$abcXYZ$hashedvalue2"
  tasks:
    - name: Create service accounts
      ansible.builtin.user:
        name: "{{ item.name }}"
        uid: "{{ item.uid }}"
        password: "{{ item.password }}"
        state: present
      loop: "{{ srv_users }}"
      loop_control:
        label: "{{ item.name }}"

ansible-navigator run -m stdout accounts.yml
ansible-navigator run -m stdout accounts.yml   # changed=0

---
- name: Configure LVM storage
  hosts: dbservers
  tasks:
    - name: Create volume group
      community.general.lvg:
        vg: vg_data
        pvs: /dev/vdb

    - name: Create logical volume
      community.general.lvol:
        vg: vg_data
        lv: lv_data
        size: 2G

    - name: Create xfs filesystem
      community.general.filesystem:
        fstype: xfs
        dev: /dev/vg_data/lv_data

    - name: Mount the filesystem
      ansible.posix.mount:
        path: /data
        src: /dev/vg_data/lv_data
        fstype: xfs
        state: mounted

ansible-navigator run -m stdout storage.yml
ansible-navigator run -m stdout storage.yml   # changed=0

---
- name: Open port 8080 for httpd
  hosts: webservers
  tasks:
    - name: Allow 8080/tcp in firewalld
      ansible.posix.firewalld:
        port: 8080/tcp
        permanent: true
        immediate: true
        state: enabled

    - name: Add SELinux port label for http
      community.general.seport:
        ports: 8080
        proto: tcp
        setype: http_port_t
        state: present

ansible-navigator run -m stdout firewall_selinux.yml
ansible-navigator run -m stdout firewall_selinux.yml   # changed=0

---
- name: Schedule daily backup
  hosts: prod
  tasks:
    - name: Add daily backup cron job
      ansible.builtin.cron:
        name: daily-backup
        minute: "30"
        hour: "2"
        job: /usr/local/bin/backup.sh
        user: root
        state: present

ansible-navigator run -m stdout cron.yml
ansible-navigator run -m stdout cron.yml   # changed=0