Ansible Execution Environments

This video will cover how what are execution environments, why they exist, how they make ansible development easier, the pieces involved in building them, and how I leverage Ansible to streamline the entire build process for me.
The presenter is Alex Dworjan
GitHub:
github.com/shadowman-lab/Ansible-PAH
Blogs:
www.ansible.com/blog/the-anatomy-of-automation-execution-environments
www.ansible.com/blog/automating-execution-environment-image-builds-with-github-actions

[@ericames-xs4fh]

Thanks for the video!!

[@ThomasMcManus-eh7cq]

Very helpful, thank you

[@joshuaduplaa9033]

I love you for this

[@NagaratnaSReddy]

Thanks for the demo!! How do we pass multiple environment variables to the execution environment before the playbook is executed on the target m/c??

[@alexdworjan]

www.techbeatly.com/how-to-pass-environment-variables-to-ansible-navigator/ This is the easiest way to describe it if you are using ansible-navigator. If you are using automation controller, you can set environment variables as credentials which would then be passed into the EE if you assign it as a credential for the Job Template.

[@happyuk06]

As an absolute beginner I would rather see the build etc done through command line as well through ansible. Still wrestling with some of the terminologies, etc.

[@alexdworjan]

I would highly recommend looking at the newer Ansible Builder capability since this one is a bit old: ansible.readthedocs.io/projects/builder/en/latest/. Ansible Builder Version 3 allows for more customization and everything can be written in a single file. In the example, I still manually created all those files, and then I would have run ansible-builder build -t MYIMAGE:TAG. That would have completed my build process. If you want a hands on walkthrough of Ansible-Builder version 3, we have a self-paced lab called "Get started with ansible-builder" that you can do here: www.redhat.com/en/interactive-labs/ansible. It's all command line driven, so it will absolutely give you all of the steps

[@happyuk06]

@@alexdworjan Many Thanks. What I'm specifically interested in is creating a custom execution environment, probably through a private (and not public) Automation Hub if I understand the terminologies correctly. Unfortunately Red Hat do not seem to particularise much when describing the step to add an Execution Environment to an Automation Hub.

[@alexdworjan]

@@happyuk06 Private Automation Hub is the one created in your environment. Public Automation Hub is the one Red Hat provides through console.redhat.com. The ansible.cfg is where you define where collections can be installed from. This is a template that has an example: github.com/shadowman-lab/Ansible-PAH/blob/main/roles/build_shadowmanee/templates/ansible.cfg.j2. You would use the full https URL and then the token that you get from your private automation hub. For example, url=YOURURL.com/api/galaxy/content/rh-certified/ Then in your execution-environment.yml you'd use the additional_build files section to place your ansible.cfg into the context folder that builder uses additional_build_files: - src: /ansible.cfg dest: configs And then you need a prepend_galaxy step to actually place that ansible.cfg into your EE prepend_galaxy: - COPY _build/configs/ansible.cfg /etc/ansible/ansible.cfg This will ensure that collections will only be pulled from your private automation hub when building. Then you just use podman to push to your Hub. Easiest way to do that is to name your EE with your hub URL first. So if your PAH server is test.example.com. You should build the EE to be test.example.com/testee:latest And then when you do podman push test.example.com/testee:latest it will push your EE to your PAH server

[@chinvannak1076]

Thanks for the demo. Can we add the collection to the existing Execution Environment?

[@alexdworjan]

I would recommend re-building the execution environment if the collection you are using has any dependencies associated with it. If you just want to add collections at runtime in automation controller, you can add a collections/requirements.yml to your repository with the additional collections you want to add

[@chinvannak1076]

@@alexdworjan Appreciate your answer. I have the requirements.yml in my ansible role directory. But the collections are not found as my execution environment doesn't include those collections.

[@alexdworjan]

@@chinvannak1076 This only applies if I'm using Automation Controller / Ansible Tower during a project sync. And it also is specifically looking for the folder "collections/requirements.yml" to input existing collections at runtime. It can't be in a role directory, it must be from the project root.

[@chinvannak1076]

@@alexdworjan Thanks, that was helpful. Just another small issue, I got a certificate that failed while trying to install collections from the private hub. Appreciate your advice.

[@alexdworjan]

@@chinvannak1076 If that's while you are installing collections in Controller during a project sync, my guess is that you are using self-signed certificates. If that's the case, you'll need to go into Settings, Jobs, and toggle the switch for "Ignore Ansible Galaxy SSL Certificate Verification" Otherwise you'll want to have your corporate certs on both Controller and Private Automation Hub

[@rastyraheem3566]

thank you sir for such information , but please where we can get those files? because i could not find that main.yml file in the repo , thank you

[@alexdworjan]

There are 3 different examples in the Ansible-PAH repo, build_creationee, build_shadowmandevspaces, build_shadowmanee

[@rastyraheem3566]

thank you@@alexdworjan

[@SV-lw8jo]

One aspect I do not see is the process of installing an RPM file into the environment. Do you have any info on that?

[@alexdworjan]

That's what I show at 9:58 in the bindep.txt. This is where you define any system dependencies which are RPM for RHEL based systems.

[@SV-lw8jo]

Thanks, I missed it. @@alexdworjan

[@cemery50]

Why not dockers and/or virtual machine images...., and does it integrate with online dependencies ? and how does it integrate with universal security and depug (?eclipse).... can it boot from bare metal, hybrid cloud, k-clouds, ceph stores....

[@alexdworjan]

The execution environment can use podman or docker as the container engine, but it isn't designed to be a stand-alone system that you are running or booting. The purpose of an execution environment is to be a portable way to easily run Ansible playbooks without needing to install system packages and python libraries on the VM itself. All of the necessary dependencies are contained in the EE so it makes standing up a new Ansible server extremely fast. It can integrate with some IDE like VS Code for easier editing.

[@12dodo37]

​@@alexdworjanWe can install vscode inside the EE? How can i edit file with vscode inside the container? Or you said completly another thing...?

[@alexdworjan]

@@12dodo37 No, VSCode with the Ansible extension can leverage the EE that you create. This means VSCode would be using Ansible+Ansible-Lint+all of the collections I have installed. So VSCode would be installed on your laptop (or use Code Server). I walk through all the different options in this playlist: kzbin.info/www/bejne/eWmcYWuBiM-hbZo&pp=gAQBiAQB

[@12dodo37]

​@@alexdworjan Thank you for the rapid response! Im going to check that now!

[@raginibhayana]

how do u use a base image present in the vm? i dont want to access the internet for it.

[@alexdworjan]

With Ansible Builder Version 3, you can use any base image kzbin.info/www/bejne/j4XXc4pop6mBe5Y

[@ThomasMcManus-eh7cq]

Very helpful, thank you