Joe Doss jdoss

Working with ansible-vault

I've been using a lot of Ansible lately and while almost everything has been great, finding a clean way to implement ansible-vault wasn't immediately apparent.

What I decided on was the following: put your secret information into a vars file, reference that vars file from your task, and encrypt the whole vars file using ansible-vault encrypt.

Let's use an example: You're writing an Ansible role and want to encrypt the spoiler for the movie Aliens.

etcd dynamic inventory script

Generarates inventory for ansible from etcd using python-etcd library.

The script assumes etcd.ini to be present alongside it. To choose a different path, set the ETCD_INI_PATH environment variable:

export ETCD_INI_PATH=/path/to/etcd.ini

openssl

Install

Install the OpenSSL on Debian based systems

sudo apt-get install openssl

	events {
	worker_connections 1024;
	}

	http {
	default_type text/html;
	access_log /dev/stdout;
	sendfile on;
	keepalive_timeout 65;

	<source>
	type tail
	format apache
	path /var/log/httpd/access_log
	pos_file /var/log/td-agent/access_log.pos
	tag geo.apache.log
	</source>

	<match geo.apache.log>
	type geoip

	# Output json-esque output for logstash to parse easily.

	http {
	# ...

	log_format logstash_json '{"@timestamp": "$time_iso8601", '
	'"remote_addr": "$remote_addr", '
	'"remote_user": "$remote_user", '
	'"body_bytes_sent": "$body_bytes_sent", '
	'"request_time": "$request_time", '

	#!/bin/bash
	#
	# consul Manage the consul agent
	#
	# chkconfig: 2345 95 95
	# description: Consul is a tool for service discovery and configuration
	# processname: consul
	# config: /etc/consul.conf
	# pidfile: /var/run/consul.pid

	resource "aws_instance" "web" {
	ami = "ami-7f89a64f"
	instance_type = "t1.micro"
	ebs_block_device {
	device_name = "/dev/sdg"
	volume_size = 5
	volume_type = "gp2"
	delete_on_termination = false
	}
	}

	input {
	elasticsearch {
	hosts => [ "HOSTNAME_HERE" ]
	port => "9200"
	index => "INDEXNAME_HERE"
	size => 1000
	scroll => "5m"
	docinfo => true
	scan => true
	}

	Floating serenely through a peaceful abyss, a sigh escapes; content.
	A siren wails, you're jolted from your respite
	/dev/xsdb1 is at 100%

	A cacophony of alerts screech from the phone.
	Upset is the fragile balance, failure cascades.
	Was only a matter of time.
	Get some coffee.

	All you ping seems to crumble, machine after machine fall; a massacre of uptime.