The goal of this document is to provide an understanding of the possibilities and functionality of Rundeck and how Ansible got integrated.
A RH294 (Ansible + RHCE) and practical experience with Rundeck are assumed as the basis for administration.
Rundeck Website
RH294 (Ansible + RHCE)
Rundeck is used to automate recurring tasks.
This brings the following advantages:
Honestly, creating jobs with Rundeck is very easy and pleasant.
However, administering Rundeck is not; it is complex and has many dependencies.
Rundeck should only be configured and maintained by someone who has experience and expertise.
Inventory Script Config File: rundeck@rundeck1:/etc/ansible/inventory/svvcenter1.vmware.yml
Goals
ignore_tag groupmaintenance_tag groupGeneral
filters:
- runtime.powerState == "poweredOn"
- not (
config.name.lower().startswith('lab_') or
config.name.lower().startswith('lab-') or
config.name.lower().endswith('-lab') or
config.name.lower().endswith('_lab')
)
svvcenter_NN: |
not config.guestId.startswith('DoMatchAllOs')
linux: |
config.guestId.lower().startswith('alma') or
config.guestId.lower().startswith('rocky') or
config.guestId.lower().startswith('ubuntu') or
config.guestId.lower().startswith('rhel')
windows: | 'windows' in config.guestId.lower()
no_update_tag: | 'no_update' in tag_category.Ansible
ignore group and is not used directly.
maintenance_tag: | 'maintenance' in tag_category.Ansible
ignore group and is not used directly.
ignore_tag: | 'ignore' in tag_category.Ansible
ignore: |
not ( config.guestId.lower().startswith('alma') or
config.guestId.lower().startswith('rocky') or
config.guestId.lower().startswith('ubuntu') or
config.guestId.lower().startswith('rhel') or
'windows' in config.guestId.lower()) or
config.name.lower().startswith('svvprx-') or
'ignore' in tag_category.Ansible or
'maintenance' in tag_category.Ansible
netscaler: |
config.name.lower().startswith('svcns-')
ntp_server: |
config.name.lower().startswith('svtime-')
probe: |
config.name.lower().startswith('svnprobe-')
This section describes where passwords are stored and how they are
protected.
Rundeck has a password vault. The passwords cannot be read by users,
but they can be referenced in jobs.
Ansible Vault is a mechanism in which sensitive data can be stored in
encrypted files.
When these encrypted files are used by Ansible, a password hidden at
runtime is used. This prevents the passwords from being exposed in a
backup.
Therefore, this "Vault-Unlock Password" must be entered after every
startup.
This is described in the Operations section.
What Ansible Vault is and how it works is described here
described,
the protected data is mainly stored here:
/etc/ansible/inventory/group_vars/
If the server is restarted, the Vault password must be entered via SSH:
ssh -l admin_XXXX svrundeck1.domain.tld
sudo su -
init-rundeck-and-ansible.sh
vim /usr/local/sbin/init-rundeck-and-ansible.sh#!/bin/bash
echo
echo Feed the ssh private key passphrase for rundeck
echo "Bitwarden > vault@rundeck1"
echo "Link to Secret"
echo "https://v.domain.tld/#/vault?itemId=blub"
sudo -u rundeck --login echo
echo
echo INFO: re/starting rundeck + nginx service
systemctl restart rundeckd nginx
echo
echo
echo All done
echo Now login to rundeck webUI:
echo .Test the inventory
echo .Test AdHoc command
After that, the "Ansible Vault" is unlocked and the Rundeck service is
started.
After Unlocking, it is recomended to verify access to target nodes once
ansible -m ping all