Managing Containers with Ansible

# Managing Containers with Ansible
### Peter Schiffer, Tomáš Tomeček
#### [pschiffe/ansible-docker](https://github.com/pschiffe/ansible-docker)

???

whoami

---

# Agenda

* Ansible crash course (optional)
* Containers with Ansible
* But I have Docker Compose already
* Building images

---

# Why?

* Ansible is very powerful

* Like, very, very powerful

* Suitable for any scale

* For über-scale check out [Ansible Tower](https://www.ansible.com/tower)

* Content of this talk is for small to mid-scale

* If you are serious with containers -> [Kubernetes](https://kubernetes.io/) & [OpenShift](https://www.openshift.org/)

---

# Ansible

---

# First steps

## Installation on Fedora

```bash
$ sudo dnf install ansible python-docker-py docker docker-compose
```

## First command
```bash
$ ansible localhost -m ping
 [WARNING]: provided hosts list is empty, only localhost is available

localhost | SUCCESS => {
    "changed": false,
    "ping": "pong"
}
```

---

# Inventory

```yaml
[all]
localhost   ansible_connection=local  ansible_become=false
foo   ansible_host=foo.example.com   ansible_port=2222   ansible_user=centos

[webservers]
foo
www[01:50].example.com
```

## Dynamic Inventory

```bash
$ wget https://github.com/ansible/ansible/raw/devel/contrib/inventory/docker.py
$ chmod 755 docker.py
$ ansible -i docker.py all -m ping
```

???

Inventory directory, output of dynamic inventory scripts

---

# Task

```yaml
- name: install apache package
  yum: name=httpd state=present
```

```yaml
- name: install apache package
  yum:
    name: httpd
    state: present
```

---

# Task

```yaml
- name: install apache package
  yum: name=httpd state=present
* tags:
*   - installation
*   - web-server
```

```yaml
- name: install apache package
  yum:
    name: httpd
    state: present
* tags:
*   - installation
*   - web-server
```

---

# Available modules

1000+ modules: [docs.ansible.com/ansible/modules_by_category.html](https://docs.ansible.com/ansible/modules_by_category.html)

```yaml
yum, apt, package, pip, template, file, service, command, shell, nmcli..
```

## Categories

.columns-3-ul[
* Cloud
* Clustering
* Commands
* Crypto
* Database
* Files
* Identity
* Inventory
* Messaging
* Monitoring
* Network
* Notification
* Packaging
* Remote Management
* Source Control
* Storage
* System
* Utilities
* Web Infrastructure
* Windows
]

---

# Playbook

<pre><code class="yaml hljs remark-code"><div class="remark-code-line">- name: install and configure web servers
 hosts: webservers

tasks:
    - name: install apache package
      yum: name=httpd state=present
    - name: write the apache config file
      template: src=t/httpd.j2 dest=/etc/httpd.conf

- name: ensure apache is running (and enable it at boot)
      service: name=httpd state=started enabled=yes

</div></code></pre>

---

# Playbook

```yaml
- name: install and configure web servers
  hosts: webservers

tasks:
    - name: install apache package
      yum: name=httpd state=present
    - name: write the apache config file
      template: src=t/httpd.j2 dest=/etc/httpd.conf
*     notify:
*       - restart apache
    - name: ensure apache is running (and enable it at boot)
      service: name=httpd state=started enabled=yes
* handlers:
*   - name: restart apache
*     service: name=httpd state=restarted
```

---

# Playbook

```yaml
- name: install and configure web servers
  hosts: webservers
* vars:
*   http_port: 80
*   max_clients: 200
  tasks:
    - name: install apache package
      yum: name=httpd state=present
    - name: write the apache config file
      template: src=t/httpd.j2 dest=/etc/httpd.conf
      notify:
        - restart apache
    - name: ensure apache is running (and enable it at boot)
      service: name=httpd state=started enabled=yes
  handlers:
    - name: restart apache
      service: name=httpd state=restarted
```

---

# Variables

```yaml
- name: configure web servers
  hosts: webservers
  vars:
    apache_listen_port: 80
    apache_vhosts:
      - servername: go.example.com
        documentroot: /var/www/html/go
      - servername: rust.example.com
        documentroot: /var/www/html/rust
        serveralias: default.example.com
  tasks:
    - name: write the apache config file
      template: src=t/httpd.j2 dest={{ apache_conf | default('/etc/httpd.conf') }}
```

http://docs.ansible.com/ansible/playbooks_variables.html

---

# Variables

```yaml
- name: configure web servers
  hosts: webservers
  vars:
*   apache_listen_port: 80
    apache_vhosts:
      - servername: go.example.com
        documentroot: /var/www/html/go
      - servername: rust.example.com
        documentroot: /var/www/html/rust
        serveralias: default.example.com
  tasks:
    - name: write the apache config file
      template: src=t/httpd.j2 dest={{ apache_conf | default('/etc/httpd.conf') }}
```

http://docs.ansible.com/ansible/playbooks_variables.html

---

# Variables

```yaml
- name: configure web servers
  hosts: webservers
  vars:
    apache_listen_port: 80
*   apache_vhosts:
*     - servername: go.example.com
*       documentroot: /var/www/html/go
*     - servername: rust.example.com
*       documentroot: /var/www/html/rust
*       serveralias: default.example.com
  tasks:
    - name: write the apache config file
      template: src=t/httpd.j2 dest={{ apache_conf | default('/etc/httpd.conf') }}
```

http://docs.ansible.com/ansible/playbooks_variables.html

---

# Variables

```yaml
- name: configure web servers
  hosts: webservers
  vars:
    apache_listen_port: 80
    apache_vhosts:
      - servername: go.example.com
        documentroot: /var/www/html/go
      - servername: rust.example.com
        documentroot: /var/www/html/rust
        serveralias: default.example.com
  tasks:
    - name: write the apache config file
*     template: src=t/httpd.j2 dest={{ apache_conf | default('/etc/httpd.conf') }}
```

Filters: [docs.ansible.com/ansible/playbooks_filters.html](https://docs.ansible.com/ansible/playbooks_filters.html)

---

# Templates (httpd.j2)

```django
{# Set up VirtualHosts #}
{% for vhost in apache_vhosts %}
<VirtualHost {{ apache_listen_ip | default('*') }}:{{ apache_listen_port }}>
 ServerName {{ vhost.servername }}
{% if vhost.serveralias is defined %}
 ServerAlias {{ vhost.serveralias }}
{% endif %}
{% if vhost.documentroot is defined %}
 DocumentRoot {{ vhost.documentroot }}
{% endif %}
</VirtualHost>
{% endfor %}
```

http://docs.ansible.com/ansible/playbooks_templating.html

---

# Control structures (when)

```yaml
- name: install apache package on Red Hat distro
  yum: name=httpd state=present
* when: ansible_os_family == 'RedHat'

- name: install apache package on Debian distro
  apt: name=apache2 state=present
* when: ansible_os_family == 'Debian'
```

http://docs.ansible.com/ansible/playbooks_conditionals.html

---

# Control structures (with_items)

```yaml
- name: install apache package on Red Hat distro
* yum: name={{ item }} state=present
  when: ansible_os_family == 'RedHat'
* with_items:
*   - httpd
*   - mod_ssl

- name: install apache package on Debian distro
* apt: name={{ item }} state=present
  when: ansible_os_family == 'Debian'
* with_items:
*   - apache2
*   - apache2-utils
```

http://docs.ansible.com/ansible/playbooks_loops.html

---

# Roles (directory structure)

```bash
site.yml
webservers.yml
fooservers.yml
roles/
  webserver/
    files/
    templates/
    tasks/
      main.yml
    handlers/
      main.yml
    vars/
    defaults/
      main.yml
    meta/
```

http://docs.ansible.com/ansible/playbooks_roles.html

---

# Roles (in playbook)

```yaml
- name: deploy webservers
  hosts: webservers
  roles:
    - common
    - webservers
```

Community roles available in [Ansible Galaxy](https://galaxy.ansible.com/).

Especially check out the [geerlingguy](https://galaxy.ansible.com/geerlingguy/) author, who also wrote the [Ansible for DevOps](https://www.ansiblefordevops.com/) book.

http://docs.ansible.com/ansible/playbooks_roles.html

---

# Vault

For encrypting passwords

```bash
$ ansible-vault create secret.yml
Vault password:

$ ansible-vault edit secret.yml
Vault password:
```

```bash
$ cat secret.yml
$ANSIBLE_VAULT;1.1;AES256
6332313036326361653438653861666161396130616564373439656264663334666330303334623
3033663036646231343364306132643736363162336335340a64313530363465373130346434663
6564323833663762633664396334663337306462366637633537623661303238336561326565306
3530333333313138350a35663936646265613961373061353463623161346530653766303839306
38353136653566643831643430646638383765326236323738663665323132323362
```

---

# Vault

```yaml
- name: deploy webservers
  hosts: webservers
  vars_files:
    - secret.yml
  roles:
    - common
    - webservers
```

```bash
$ ansible-playbook site.yml --ask-vault-pass
$ ansible-playbook site.yml --vault-password-file ~/.vault_pass.txt
$ ansible-playbook site.yml --vault-password-file ~/.vault_pass.py
```

http://docs.ansible.com/ansible/playbooks_vault.html

---

# Ansible Containers

---

# Docker modules

* [docker_container](http://docs.ansible.com/ansible/docker_container_module.html) - manage Docker containers
* [docker_network](http://docs.ansible.com/ansible/docker_network_module.html) - manage Docker networks
* [docker_image](http://docs.ansible.com/ansible/docker_image_module.html) - manage Docker images
* [docker_service](http://docs.ansible.com/ansible/docker_service_module.html) - utilize Docker Compose

Documentation: [docs.ansible.com/ansible/list_of_cloud_modules.html#docker](https://docs.ansible.com/ansible/list_of_cloud_modules.html#docker)

---

# Simple container: gitea (gogs fork)

```yaml
---
- name: create gitea container
  hosts: localhost
  tasks:
    - name: create gitea container
      docker_container:
        name: my-gitea
        image: gitea/gitea:1.1.2
        state: started    # absent, present, stopped
        published_ports:
          - '10022:22'
          - '3000:3000'
        volumes:
          - my-gitea-data:/data:z
```
```bash
$ ansible-playbook gitea/gitea.yml
```

---

# Simple container: gitea (gogs fork)

```yaml
- name: create gitea container
  hosts: localhost
* vars:
*   c_state: started
  tasks:
    - name: create gitea container
      docker_container:
        name: my-gitea
        image: gitea/gitea:1.1.2
*       pull: true
*       state: '{{ c_state }}'
*       restart_policy: always
        published_ports:
          - '10022:22'
          - '3000:3000'
        volumes:
*         - /etc/localtime:/etc/localtime:ro
          - my-gitea-data:/data:z
```
```bash
$ ansible-playbook gitea/gitea.yml -e c_state=absent
```

---

# Simple container: gitea (gogs fork)

```yaml
- name: create gitea container
  hosts: localhost
  vars:
*   wipe: false
*   c_state: '{{ "absent" if wipe | bool else "started" }}'
*   c_name: my-gitea
  tasks:
    - name: create gitea container
      docker_container:
*       name: '{{ c_name }}'
        image: gitea/gitea:1.1.2
        state: '{{ c_state }}'
        volumes:
*         - '{{ c_name }}-data:/data:z'
*   - name: remove docker volume
*     command: docker volume rm {{ c_name }}-data
*     ignore_errors: true
*     when: wipe | bool
```
```bash
$ ansible-playbook gitea/gitea.yml -e wipe=true
```

---

# Multiple containers of one kind - mailpile

```yaml
$ cat container.yml
- name: create mailpile container
  docker_container:
    name: '{{ c_name }}'
    image: rroemhild/mailpile
    pull: true
    state: '{{ c_state }}'
    restart_policy: always
    published_ports:
*     - '{{ c_port }}:33411'
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - '{{ c_name }}-data:/root/.local/share/Mailpile:z'

- name: remove docker volume
  command: docker volume rm {{ c_name }}-data
  ignore_errors: true
  when: wipe | bool
```

---

# Multiple containers of one kind - mailpile

```yaml
- name: create mailpile containers
  hosts: localhost
  vars:
    wipe: false
    c_state: '{{ "absent" if wipe | bool else "started" }}'
*   containers:
*     - name: john
*       port: '21111'
*     - name: pete
*       port: '21112'
*     - name: jake
*       port: '21113'
  tasks:
    - name: create mailpile containers
      include: container.yml
      vars:
        c_name: 'mailpile-{{ item.name }}'
        c_port: '{{ item.port }}'
      with_items: '{{ containers }}'
```

---

# Multiple containers of one kind - mailpile

```yaml
- name: create mailpile containers
  hosts: localhost
  vars:
    wipe: false
    c_state: '{{ "absent" if wipe | bool else "started" }}'
    containers:
      - name: john
        port: '21111'
      - name: pete
        port: '21112'
      - name: jake
        port: '21113'
  tasks:
    - name: create mailpile containers
*     include: container.yml
*     vars:
*       c_name: 'mailpile-{{ item.name }}'
*       c_port: '{{ item.port }}'
*     with_items: '{{ containers }}'
```

---

# Networking and connection: docker - Rocket.Chat

```yaml
- name: create mongodb container for rocketchat
  hosts: localhost
  tasks:
    - name: create network for rocketchat
*     docker_network:
        name: '{{ c_name }}'
        state: present

- name: create mongodb for rocketchat container
      docker_container:
        name: '{{ c_name }}-mongo'
        image: pschiffe/mongo-ansible
        state: '{{ c_state }}'
*       purge_networks: true
*       networks:
*         - name: '{{ c_name }}'
*           aliases:
*             - db
*             - mongo

*   - meta: refresh_inventory
```

---

# Networking and connection: docker - Rocket.Chat

```yaml
- name: create db users in mongodb container
* hosts: '{{ c_name }}-mongo'
* connection: docker
  vars:
    mongo_admin: admin
    rocket_user: rocket
  vars_files:
    - passwords.yml
  tasks:
    - name: create rocket user
*     mongodb_user:
        login_user: '{{ mongo_admin }}'
        login_password: '{{ mongo_admin_pass }}'
        database: '{{ rocket_user }}'
        name: '{{ rocket_user }}'
        password: '{{ rocket_password }}'
        roles:
          - db: '{{ rocket_user }}'
            role: readWrite
        state: present
```

---

# Networking and connection: docker - Rocket.Chat

```yaml
FROM mongo:3.4
MAINTAINER "Peter Schiffer" <pschiffe@redhat.com>

COPY 99defaultrelease /etc/apt/apt.conf.d/
COPY stable.list testing.list /etc/apt/sources.list.d/

RUN apt-get update \
* && apt-get install -y --no-install-recommends python-minimal \
* && apt-get install -t testing -y --no-install-recommends python-pymongo \
  && rm -rf /var/lib/apt/lists/*
```

---

# Networking and connection: docker - Rocket.Chat

```yaml
- name: create rocketchat container
  hosts: localhost
  tasks:
    - name: create rocketchat container
      docker_container:
        name: '{{ c_name }}'
        image: rocket.chat
        state: '{{ c_state }}'
        purge_networks: true
        networks:
          - name: '{{ c_name }}'
*       env:
*         MONGO_URL: 'mongodb://{{ rocket_user }}:{{ rocket_password }}@db:27017/{{ rocket_user }}'
        volumes:
          - '{{ c_name }}-data:/app/uploads:z'

*   - name: remove network
      docker_network:
        name: '{{ c_name }}'
        state: absent
      ignore_errors: true
      when: wipe | bool
```

---

# So what about Docker Compose?

---

# Docker Compose

```yaml
haproxy:
  image: eeacms/haproxy:1.7-3.0
  links:
    - first_webapp
    - second_webapp
    - third_app
  ports:
    - "5000:5000"
    - "1936:1936"
  environment:
    - SERVICE_NAMES=webapp

first_webapp:
  image: eeacms/hello

second_webapp:
  image: eeacms/hello

third_app:
  image: eeacms/hello
```

---

# Ansible Playbook

```yaml
---
- name: example ansible docker service
  hosts: localhost
  vars:
    wipe: false
    c_state: '{{ "absent" if wipe | bool else "present" }}'
  tasks:
    - name: create containers from docker compose
*     docker_service:
*       project_src: .
        state: '{{ c_state }}'
```

---

# Building Images

---

# Building Images - ghost

```yaml
- name: run ghost blogging platform deployed as containers
  hosts: localhost
  vars:
    wipe: false
    c_state: '{{ "absent" if wipe | bool else "started" }}'
*   i_state: '{{ "absent" if wipe | bool else "present" }}'
    c_name: my-ghost
    nginx_container: '{{ c_name }}-nginx'
    db_container: '{{ c_name }}-db'
    db_database_name: ghost
    db_user: ghost
    db_password: casper
```

---

# Building Images - ghost

```yaml
tasks:
  - name: build ghost image
*   docker_image:
      path: ghost
      name: '{{ c_name }}'
      tag: latest
      state: '{{ i_state }}'
*     force: true

- name: overlay custom configuration on top of nginx image
*   docker_image:
      path: nginx
      name: '{{ nginx_container }}'
      tag: latest
      state: '{{ i_state }}'
*     force: true
```

---

# Building Images - ghost

```yaml
- name: create ghost docker network
  docker_network:
    name: '{{ c_name }}'
    state: present

- name: run mariadb
  docker_container:
    name: '{{ db_container }}'
    image: mariadb:10.1
    state: '{{ c_state }}'
    purge_networks: true
    networks:
      - name: '{{ c_name }}'
    env:
      MYSQL_ROOT_PASSWORD: root-password
      MYSQL_DATABASE: '{{ db_database_name }}'
      MYSQL_USER: '{{ db_user }}'
      MYSQL_PASSWORD: '{{ db_password }}'
    volumes:
      - '{{ db_container }}-data:/var/lib/mysql:z'
```

---

# Building Images - ghost

```yaml
- meta: refresh_inventory

- name: wait for mariadb to become ready
* wait_for:
*   host: '{{ hostvars[db_container]["docker_networksettings"]["Networks"][c_name]["IPAddress"] }}'
    port: 3306
    state: started
    connect_timeout: 15
    timeout: 30
  register: mariadb_running
  until: mariadb_running | success
  retries: 10
  delay: 5
  when: not wipe | bool
```

---

# Building Images - ghost

```yaml
- name: run ghost web service
  docker_container:
    name: '{{ c_name }}'
    image: '{{ c_name }}'
    state: '{{ c_state }}'
*   env:
      DB_CONTAINER: '{{ db_container }}'
      DB_USER: '{{ db_user }}'
      DB_PASSWORD: '{{ db_password }}'
      DB_DATABASE: '{{ db_database_name }}'

- name: run nginx proxy
  docker_container:
    name: '{{ nginx_container }}'
    image: '{{ nginx_container }}'
    state: '{{ c_state }}'
    published_ports:
      - '8080:80'
*   env:
      GHOST_CONTAINER: '{{ c_name }}'
      GHOST_PORT: 2368
```

---

# Building Images - ghost

```yaml
- name: test if ghost is running
* uri:
    url: "http://localhost:8080/"
    method: GET
    status_code: 200
  register: ghost_running
  until: ghost_running | success
  retries: 10
  delay: 10
  when: not wipe | bool
```

---

# Q & A?
#### [pschiffe/ansible-docker](https://github.com/pschiffe/ansible-docker)
#### [Peter Schiffer](https://www.linkedin.com/in/peterschiffer/)
#### [Tomáš Tomeček](https://twitter.com/TomasTomec)