Mark your calendars – August 3rd, 2017 – Ansible Automated Minneapolis

How can I execute an Ansible task on the local Ansible controller server?

The key is to use the “delegate_to” or “local_action” key words on your task.

So lets say we want to use Ansible to monitor an end point and perform some action if the response is not equal to 200.

1. Create task to check URL using the URI module and “delegate_to” or do step #2
   • —
     – name: Endpoint Validator
     uri:
     url: “{{ url }}”
     delegate_to: 127.0.0.1
     register: response
2. Create task to check URL using the URI module and “local_action”
   • —
     – name: Endpoint Validator
     uri:
     local_action: url “{{ url }}”
     register: response
3. Create task to perform action (e.g. fail) if response it not 200
   • —
     – name: Endpoint Error Action
     fail:
     when: response.status != 200

Here are a couple of useful Ansible playbook CLI switches I tend to use frequently.

Dry-run mode – Add this switch if you want to see what Ansible will do, without actually doing it.

• –check

Limit target hosts – Add this switch to specify what host(s) you want to run the playbook against.

• –limit
• –limit “host1, host2, host3”
• –limit “myGroup”

Is it possible to create an IIS Application Pool that uses a custom identity with Ansible?

I asked the question on the Ansible forums and got the following response.

1. Create the Application Pool first using “win_iis_webapppool“
2. Then switch the pools Identity using module “win_command” and the “appcmd.exe” command.

Here are the results and notes from my implementation.

1. Create playbook that creates pool and then updates (Example below)
   • —
     – hosts: windows
     remote_user: buildadmin
     tasks:
     – name: Create new application pool
     win_iis_webapppool:
     name: “{{ apppool }}”
     state: started
     attributes: ‘managedRuntimeVersion:v4.0|autoStart:false’
     – name: Update application pool identity
     win_command: ‘C:\Windows\System32\inetsrv\appcmd set config /section:applicationPools /[name=”{{ apppool }}”].processModel.identityType:SpecificUser /[name=”{{ apppool }}”].processModel.userName:buildadmin /[name=”{{ apppool }}”].processModel.password:myPassword’
2. Run the playbook against my windows machines with a command line variable
   • ansible-playbook -v installWebsiteApplication.yml -i hosts –extra-vars “apppool=devopsWebsite_1_1_2017”

Using Ansible to manage Windows hosts gives sys admins the ability to use the same tool-set between Linux and Windows hosts.

Below are some notes, issues, and resolutions, you may find useful during your Windows setup.

1. On the Ansible controller instance, you will want to install the Python library for Windows Remote Management (WinRM).
   • sudo pip install pywinrm
2. Configure Ansible to work with Windows hosts.  Follow the links below for configuring Ansible to work with your Windows host.
   • http://darrylcauldwell.com/how-to-setup-an-ansible-test-lab-for-windows-managed-nodes-custom-windows-modules/
   • http://docs.ansible.com/ansible/intro_windows.html
3. On the Windows host, you will want to execute the bootstrap WinRM powershell script.  This script will setup WinRM on the Windows host(s)
   • https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1
   • powershell.exe -ExecutionPolicy Bypass -File “ConfigureRemotingForAnsible.ps1”
   • Run from cmd windows with Admin privileges
4. On your Windows host, you will want to configure a new user with Admin privileges.  This username and password will be added to your windows.yml file.
   • If you chose to not grant this user Admin rights, then see the following ULR for details on granting users access to Win RM
   • https://msdn.microsoft.com/en-us/library/aa384295(v=vs.85).aspx
5. If you encounter the following error, you will want to set “ansible_winrm_server_cert_validation: ignore” in the windows.yml file.
   • msg”: “ssl: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)”
6. Finish your testing with a quick win ping test.
   • ansible windows -i hosts -m win_ping
7. If you encounter issues pinging your Windows host, you can manually try to access the Windows host WinRM endpoint with curl.
   • curl -vk -d “” -u ‘<username>:<password>’ https://host:5986/wsman
     • “…the default ports used for WS-Management and PowerShell remoting have been changed to 5985 an 5986 for connections over HTTP and HTTPS, respectively.” Source
   • You can also verify your WinRM configuration on the host as needed using this command.
     • winrm g winrm/config

If all goes well, you should get the following output back from your ping command.

[myUser@myServer]$ ansible windows -i hosts -m win_ping
1.1.1.1 | SUCCESS => {
“changed”: false,
“ping”: “pong”
}