Ir al contenido principal

Managing dynamic inventory in private subnets using bastion jump box

Managing dynamic inventory in private subnets using bastion jump box
The title of post is quite large, but is something I encountered issues in the last weeks. I had a VPC in AWS, creating x amount of instances in a private network, and was quite complex to manage this instance using static inventory files. So I will explain you how to manage this problem with Ansible.
Before continue, I want to say these articles are really good and can help you with this issues.
So you will be asking, if these articles are so good, why are you writing them again? Easy, I’m doing this in Gitlab CI, and I suppose other CI will encounter similar issues. It’s not possible to connect to the instances using the instructions above.

First Step

We get our inventory in a dynamic way. For this we will use the inventory scripts.
We need to modify the ec2.ini file with uncommenting the vpc_destination_variable and set the value to private_ip_address
An example
# For server inside a VPC, using DNS names may not make sense. When an instance
# has 'subnet_id' set, this variable is used. If the subnet is public, setting
# this to 'ip_address' will return the public IP address. For instances in a
# private subnet, this should be set to 'private_ip_address', and Ansible must
# be run from within EC2. The key of an EC2 tag may optionally be used; however
# the boto instance variables hold precedence in the event of a collision.
# WARNING: - instances that are in the private vpc, _without_ public ip address
# will not be listed in the inventory until You set:
vpc_destination_variable = private_ip_address
#vpc_destination_variable = ip_address
Be sure to have your ansible.cfg, with the following line.
host_key_checking = False
This is useful, as we’re running this in a CI, we can’t hit enter to accept the connection in the terminal.
Then we begin working with our yml file. As I’m running this on a container, I need to create the .ssh directory and the config file. Here it’s important to add StrictHostKeyChecking=no If we don’t do this, this will fail in our CI, as we can’t hit enter. If you don’t included it and run it locally, it will work.
---
- name: Creates ssh directory
  file:
    path: ~/.ssh/
    state: directory


- name: Create ssh config file in local computer
  copy:
    dest: ~/.ssh/config
    content: |
       Host 10.*.*.*
       User ubuntu
       IdentityFile XXXXX.pem
       StrictHostKeyChecking=no
       ProxyCommand ssh -q -W %h:%p {{ lookup('env', 'IP') }}
       Host {{ lookup('env', 'IP') }}
       User ubuntu
       StrictHostKeyChecking=no
       IdentityFile XXXXX.pem
       ForwardAgent yes

And finally we test it running the ping command.
---
- name: test connection
  ping:

In case you need the code : https://github.com/DiegoTc/bastionansible

Comentarios

Entradas populares de este blog

Que buscaron los hondureños en Google en el 2017

Se han preguntando que buscan los catrachos en Internet? Les traemos un resumen de las busquedas de este 2017 en Honduras.

Actualizar de Ubuntu 14.04 a 16.04

Ya ha pasado vario tiempo, desde que estoy trabajando con la versión LTS Ubuntu 14.04, pero creo que ha llegado el tiempo de actualizar a la nueva versión LTS 16.04. Las principales razones, son que necesito trabajar con el nuevo kit de desarrollo de java 1.8 y no hay soporte oficial para la versión open source en 14.04. Aparte que nunca me sentí muy conforme con dicha versión, considero que hubieron anteriores mejores. Esta es una guía, que les permitirá migrar de Ubuntu 14.04 a 16.04. Paso 1: Aseguremos que estemos con las ultimas actualizaciones instaladas. Si tenemos una versión en español, saldría algo parecido a la imagen siguiente. Paso 2:  Abrimos la terminal, e insertamos el siguiente comando: sudo update-manager -d Saldra algo parecido a esta imagen. Le damos click al botón de actualizar. Nos aparecerá una ventana titulada "Notas de la versión" Despues de eso le damos click en actualizar. Después del botón de actualizar, nos aparecerá u

Pre order your Super Smash Bros. Ultimate for Nintendo Switch

Are you fan of Super Smash Bros! Don't wait until the last minute, you can pre order you Super Smash Bros Ultimate here This new game has stages and fighters are joined by the combined rosters of every past Super Smash Bros game. If you buy it, you will be enjoying this Limited Time Offer: Piranha Plant Playable Fighter. Buy Super Smash Bros. Ultimate and register your game with My Nintendo by 11:59 PM on Jan. 31, 2019 and get Piranha Plant in your game for free.