vmoravec

up-and-running-ansible-awx

A reference for spinning up Ansible AWX on top of a Kubernetes environment

k3s install

Install k3s with bash script

curl -sfL https://get.k3s.io | sh -

vmoravec

Table of Contents

• 0.1. References
  • 0.2. Other cheatsheets
  • 0.3. Manage multiple gcloud config configurations
    • 0.3.1. Switch gcloud context with gcloud config
  • 0.4. Auth
• 0.5. info

vmoravec

from __future__ import print_function
import boto3
import base64
import json
import logging


logging.basicConfig()
logger = logging.getLogger()
logger.setLevel(logging.DEBUG)

vmoravec

  location ~* ^/s3/(.*) {
    set $bucket           '<REPLACE WITH YOUR S3 BUCKET NAME>';
    set $aws_access       '<REPLACE WITH YOUR AWS ACCESS KEY>';
    set $aws_secret       '<REPLACE WITH YOUR AWS SECRET KEY>';
    set $url_full         "$1";
    set_by_lua $now       "return ngx.cookie_time(ngx.time())";
    set $string_to_sign   "$request_method\n\n\n\nx-amz-date:${now}\n/$bucket/$url_full";
    set_hmac_sha1          $aws_signature $aws_secret $string_to_sign;
    set_encode_base64      $aws_signature $aws_signature;

vmoravec

events {
  worker_connections  1024;
}

http {
  default_type       text/html;
  access_log         /dev/stdout;
  sendfile           on;
  keepalive_timeout  65;

vmoravec

proxy_cache_path /var/nginx/cache/aws/trueniu levels=2:2:2 use_temp_path=off keys_zone=aws_3:500m inactive=30d max_size=10g;

server {
    listen 80;
    server_name trueniu.com www.trueniu.com;

    if ( $scheme = http ) {
		return 301 https://www.trueniu.com$request_uri;
    }
}

vmoravec

server {
	listen 80;
	listen 443 default_server ssl;

	ssl on;
	ssl_certificate /etc/ssl/certs/myssl.crt;
	ssl_certificate_key /etc/ssl/private/myssl.key;

	server_name *.example.com;
	root /var/www/vhosts/website;

vmoravec

Working with ansible-vault

---

I've been using a lot of Ansible lately and while almost everything has been great, finding a clean way to implement ansible-vault wasn't immediately apparent.

What I decided on was the following: put your secret information into a vars file, reference that vars file from your task, and encrypt the whole vars file using ansible-vault encrypt.

Let's use an example: You're writing an Ansible role and want to encrypt the spoiler for the movie Aliens.

vmoravec

---
- hosts: foo
  vars:
    gems:
      libxml-ruby: { version: 2.6.0,  state: present, include_dependencies: yes, user_install: no }
      shenzhen: { version: 0.13.1, state: present, include_dependencies: yes, user_install: no }
    gem_executable: /usr/local/rvm/ruby/blah/blah/1.2/gem
  tasks:
    - name: install a bunch of gems - warning, use the right executable and run as the right user!
      gem:

vmoravec

#!/bin/bash

IPTABLES="/sbin/iptables"
IP6TABLES="/sbin/ip6tables"

# Helper function for confirming allow rules
confirm() {
        while true; do
                read -p "Allow $1? " yn
                case $yn in