Using Ansible to Manage install and update Apple OSX DHCP clients

stacksofplates

@Obsolesce said in Using Ansible to Manage install and update Apple OSX DHCP clients:

So you are going to have SSH open on everything while allowing root and/or password login?

TF?

Maybe tone it down a tad since you apparently don't understand what's happening. We are recommending using keys for authentication. Using the password only to set that up. Second where did the allowing root come from? That never came up. Third I know you're on the Salt is the savior of everything train, but SSH is just as secure as ZeroMQ. If you limit where SSH access can come from to a subnet (like @IRJ mentioned) or a single machine it's pretty much exactly what you have with ZeroMQ but just not a message bus.

Plus this is ignoring the fact that when you get to fully immutable infrastructure (I realize the Macs aren't that) you can leverage Ansible through tools like Packer to build your image and never need SSH after the fact because you don't ever log in again at all.

Obsolesce

@stacksofplates said in Using Ansible to Manage install and update Apple OSX DHCP clients:

Maybe tone it down a tad since you apparently don't understand what's happening. We are recommending using keys for authentication.

Yeah, I didn't read all the way down before I wrote that. I don't always have time to read past the first few, and it wasn't mentioned in what I did read. My bad there.

Obsolesce

@stacksofplates said in Using Ansible to Manage install and update Apple OSX DHCP clients:

Third I know you're on the Salt is the savior of everything train, but SSH is just as secure as ZeroMQ.

No, it's a preference, and for some things Salt works better, nothing more. Just like Fedora is a preference, but I use Ubuntu and others as well where they work better.

At work, we use Ansible, and it works well for that case. There may be a secondary need for config management in the immediate area I work with, and for that SaltStack will work better naturally vs Ansible.

Just FYI, I take every technology case by case. Just because I show a preference, does not EVER mean I choose that by default. I always use the best option for that specific case, regardless of my preference, so long as I have a say.

stacksofplates

@Obsolesce said in Using Ansible to Manage install and update Apple OSX DHCP clients:

@stacksofplates said in Using Ansible to Manage install and update Apple OSX DHCP clients:

Third I know you're on the Salt is the savior of everything train, but SSH is just as secure as ZeroMQ.

No, it's a preference, and for some things Salt works better, nothing more. Just like Fedora is a preference, but I use Ubuntu and others as well where they work better.

At work, we use Ansible, and it works well for that case. There may be a secondary need for config management in the immediate area I work with, and for that SaltStack will work better naturally vs Ansible.

Just FYI, I take every technology case by case. Just because I show a preference, does not EVER mean I choose that by default. I always use the best option for that specific case, regardless of my preference, so long as I have a say.

I agree. Ansible isn't the best use case for laptop management unless you're using an SD-WAN or you are really immutable with them (kind of like what Google does with their Chromebooks).

I mean there's "workarounds" to do remote callbacks to your config management platform (like remote triggers with Jenkins and provisioning callbacks in Tower or ansible-pull) but they are a little more advanced and aren't for everyone.

DustinB3403

Okay so I'm just now getting back to this after the break and the Monday rush.

I'm having an issue that doesn't make sense to me.

I can't use ansible to ping any of my hosts (the one of interest is everything dbeue) but I can ssh in without having to enter a password so keyauth is working.

What am I missing or have misconfigured here?

IRJ

@DustinB3403 said in Using Ansible to Manage install and update Apple OSX DHCP clients:

Okay so I'm just now getting back to this after the break and the Monday rush.

I'm having an issue that doesn't make sense to me.

I can't use ansible to ping any of my hosts (the one of interest is everything dbeue) but I can ssh in without having to enter a password so keyauth is working.

What am I missing or have misconfigured here?

That looks like a DNS issue.

DustinB3403

@IRJ will add the IP and test again, but I'm pretty certain I was unable to ping even by IP address.

DustinB3403

I got it, the config file was set to use root for the remote user, updated my config file and now I can at least access the client via IP address.

IRJ

@DustinB3403 how are you liking ansible so far?

DustinB3403

@IRJ said in Using Ansible to Manage install and update Apple OSX DHCP clients:

@DustinB3403 how are you liking ansible so far?

I'm still just getting into it. I'm not sure how playbooks work or how to confirm that the formatting is correct.

IRJ

@DustinB3403 said in Using Ansible to Manage install and update Apple OSX DHCP clients:

@IRJ said in Using Ansible to Manage install and update Apple OSX DHCP clients:

@DustinB3403 how are you liking ansible so far?

I'm still just getting into it. I'm not sure how playbooks work or how to confirm that the formatting is correct.

DustinB3403

So this is where I'm at currently with a playbook I wrote out by hand (not at all sure if it's correct).

ansible-playbook apple.yml --check
ERROR! the role 'geerlineguy.homebrew' was not found in /etc/ansible/roles:/root/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:/etc/ansible

The error appears to be in '/etc/ansible/apple.yml': line 11, column 7, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:

  roles:
	- geerlineguy.homebrew
	  ^ here

Apple yaml file

---

- name: Installing 1Password
  connection: network_cli
  gather_facts: false
  hosts: apple_workstations
  vars:
	homebrew_installed_packages:
	  - 1password
  roles:
	- geerlineguy.homebrew
~

So I guess I need to add something into the roles folder under /etc/anisble/roles

IRJ

@DustinB3403 said in Using Ansible to Manage install and update Apple OSX DHCP clients:

ERROR! the role 'geerlineguy.homebrew' was not found in /etc/ansible/roles:/root/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:/etc/ansible

You need to install the role

IRJ

sudo ansible-galaxy install

DustinB3403

@IRJ said in Using Ansible to Manage install and update Apple OSX DHCP clients:

sudo ansible-galaxy install

sudo ansible-galaxy install geerlingguy.homebrew
 [WARNING]: - geerlingguy.homebrew (2.9.0) is already installed - use --force to change version to unspecified

DustinB3403

This is the galaxy page https://galaxy.ansible.com/geerlingguy/homebrew

IRJ

Are you running this from /etc/ansible/ ?

DustinB3403

@IRJ yes.

IRJ

Ok let's try this. Is your playbook only one file?

#***********************************************************
# Create or append ansible requirements file
#***********************************************************


sudo sh -c "echo '- src: /etc/ansible/apple.yml' >> /etc/ansible/requirements.yml"

#***********************************************************
# Install the role
#***********************************************************

cd /etc/ansible/
sudo ansible-galaxy install -p roles -r /etc/ansible/requirements.yml

#***********************************************************
# Run ansible playbook file
#***********************************************************

sudo ansible-playbook /etc/ansible/apple.yml

DustinB3403

By default it installs to /root/.ansible/roles/geerlingguy.homebrew/ rather than into /etc/ansible/roles

So I copied the file to /etc/ansible/roles

When running the playbook I get

ERROR! the playbook: apple.yml could not be found