How to Use Ansible with CML

Similar to Terraform, Ansible is a common, open-source automation tool often used in Continuous Integration/Continuous Deployment DevOps methodologies.
Although overlaps exist in the capabilities of Terraform and Ansible, they are very complementary.
While Terraform is better at the initial deployment and ensuring ongoing consistency of the underlying infrastructure, Ansible is better at the initial configuration and ongoing management of the things that live in that infrastructure, such as systems, network devices, and so on.
Here's where the Ansible CML Collection comes in.
Similar to the CML Terraform integration covered in a previous blog, the Ansible CML Collection can automate the deployment of topologies in CML for testing.
The Ansible CML Collection has modules to create, start, and stop a topology and the hosts within it, but more importantly, it has a dynamic inventory plugin for getting information about the topology.
If your topology uses dynamic host configuration protocol and/or CML's PATty functionality, the information for how Ansible communicates with the nodes needs to be communicated to the playbook.
Let's go over some of the features of the Ansible CML Collection's dynamic inventory plugin.
These two tags tell the Ansible playbook to connect to port 2020 of the CML server to automate the specified host in the topology.
You can use the playbooks provided in the collection to load and start a topology in your CML server.
Build -e wait='yes' -e cml lab file=topology.
If -e startup='host' is specified, the playbook will start each host individually as opposed to starting them all at once.
When cml config file is defined in the host's inventory, it is parsed as a Jinja file and fed into that host as config at startup.
First, WAN-rtr1 is assigned the DHCP address it received for its ansible host value, and ansible port is 22.
If the host running the playbook has IP connectivity, it will be able to reach that host.
The second scenario shows an example of the PATty functionality with the host nso1 in which the dynamic inventory plugin reads those tags to determine that the host is available through the CML server's interface.
It knows that ansible port should be set to the port specified in the tags.
After these values are set, the ansible playbook can reach the host in the topology using the PATty functionality in CML. The last example, site1-host1, shows the scenario in which the CML dynamic inventory script can either find a DHCP allocated address or tags to specify to what ansible host should be set, so it uses the node name.
These built-in playbooks show examples of how to use the functionality in the CML Ansible Collection to build your own playbooks, but you can also use them directly as part of your pipeline.
If you want to learn more about the CML Ansible Collection, you can find it in Ansible Galaxy as well as on Github.


This Cyber News was published on feedpress.me. Publication date: Wed, 17 Jan 2024 20:13:04 +0000


Cyber News related to How to Use Ansible with CML

How to Use Ansible with CML - Similar to Terraform, Ansible is a common, open-source automation tool often used in Continuous Integration/Continuous Deployment DevOps methodologies. Although overlaps exist in the capabilities of Terraform and Ansible, they are very complementary. ...
9 months ago Feedpress.me
Deploy Keycloak Single Sign-On With Ansible - In this article, you'll use Ansible to simplify and automate the installation of Keycloak, a popular open-source tool to implement single sign-on for Web applications. The tutorial in this article builds on an Ansible Collection named middleware ...
10 months ago Feeds.dzone.com
5 Tips for Pi Day Savings at the Cisco Learning Network Store - Save 25% on select training products from the Cisco Learning Network Store for 24 hours only. Two new multicloud training courses are now available in the Cisco Learning Network Store-and they're included in the Pi Day Sale. If you are an active ...
7 months ago Feedpress.me
Automate Your SSO With Ansible and Keycloak - The article Deploy Keycloak single sign-on with Ansible discussed how to automate the deployment of Keycloak. In this follow-up article, we'll use that as a baseline and explore how to automate the configuration of the Keycloak single sign-on server, ...
10 months ago Feeds.dzone.com
CVE-2016-9587 - Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back ...
3 years ago
CVE-2019-14846 - In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the ...
2 years ago
CVE-2020-10709 - A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication. This flaw allows an attacker to obtain a refresh token that does not expire. The original ...
2 years ago
CVE-2017-7466 - Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could ...
3 years ago
CVE-2016-8628 - Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user ...
5 years ago
CVE-2021-3681 - A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the ``build_ignore`` list in "galaxy.yml" include files in the ``.tar.gz`` file. ...
2 years ago
CVE-2020-10698 - A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, ...
2 years ago
CVE-2020-1753 - A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters ...
2 years ago
CVE-2020-10697 - A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage of writing a playbook polluting this cache, causing a denial of service attack. This attack would not ...
2 years ago
CVE-2021-3702 - A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next ...
2 years ago
CVE-2020-10685 - A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts ...
1 year ago
CVE-2020-1746 - A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ...
3 years ago
CVE-2019-14858 - A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the ...
5 years ago
CVE-2020-14365 - A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to ...
2 years ago
CVE-2021-3447 - A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters ...
3 years ago
CVE-2018-10855 - Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible ...
3 years ago
CVE-2020-1740 - A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with ...
2 years ago
CVE-2022-1662 - In convert2rhel, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password via the CLI to convert2rhel. This could allow unauthorized local users to view the password via the ...
2 years ago
CVE-2020-10744 - An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE ...
2 years ago
CVE-2020-1734 - A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shellTrue, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could ...
1 year ago
CVE-2021-3620 - A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to ...
1 year ago

Latest Cyber News


Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)