serverplus uchun Ansible: infratuzilma va serverlarni sozlash

serverplus uchun Ansible

serverplus'da Ansible bilan ikki darajada ishlanadi. Birinchidan, openstack.cloud kolleksiyasi infratuzilmaning o'zini (serverlar, kalitlar, tarmoqlar) deklarativ yaratadi va o'chiradi. Ikkinchidan, oddiy playbook'lar SSH orqali ishga tushirilgan serverlarni sozlaydi. Dinamik inventory esa serverlar ro'yxatini to'g'ridan-to'g'ri OpenStack'dan oladi — hostlarni qo'lda yozib yurish shart emas.

O'rnatish

pip install "ansible>=9" openstacksdk
ansible-galaxy collection install openstack.cloud

ansible --version

Kirish CLI/Terraform uchun bo'lgani kabi ~/.config/openstack/clouds.yaml'dan olinadi. Modullar uni bulut nomi bo'yicha o'qiydi (OS_CLOUD o'zgaruvchisi).

Server yaratish

create.yml playbook'i — lokal ishga tushiriladi, serverplus API'siga murojaat qiladi:

- hosts: localhost
  gather_facts: false
  environment:
    OS_CLOUD: serverplus
  tasks:
    - name: SSH key
      openstack.cloud.keypair:
        name: ansible-key
        public_key_file: ~/.ssh/id_rsa.pub

    - name: Server
      openstack.cloud.server:
        name: web-1
        image: "Ubuntu 22.04"
        flavor: m1.small
        key_name: ansible-key
        network: private
        security_groups: [default]
        auto_ip: true
      register: srv

    - debug:
        var: srv.server.access_ipv4

Tarmoq haqida. Har doimgidek: server tarmog'ida tashqi shlyuzli router bo'lishi kerak, aks holda internet bo'lmaydi.

Dinamik inventory

inventory.openstack.yml fayli — Ansible serverlaringizni OpenStack'dan o'zi tortib oladi:

plugin: openstack.cloud.openstack
expand_hostvars: true
all_projects: false

export OS_CLOUD=serverplus
ansible-inventory -i inventory.openstack.yml --list
ansible -i inventory.openstack.yml all -m ping

Serverlarni SSH orqali sozlash

Keyin — oddiy Ansible. site.yml namunasi: nginx o'rnatish va ishga tushirish:

- hosts: all
  become: true
  tasks:
    - name: nginx
      apt:
        name: nginx
        state: present
        update_cache: true

    - name: start and enable
      service:
        name: nginx
        state: started
        enabled: true

Ulanish parametrlarini ansible.cfg'da berish qulay:

[defaults]
remote_user = ubuntu
private_key_file = ~/.ssh/id_rsa
host_key_checking = False

Xavfsizlik

• clouds.yaml — himoyada: chmod 600, git'dan tashqarida; akkaunt paroli emas, application credentials'dan foydalaning.
• Sirlar — ansible-vault'da (ansible-vault encrypt), ochiq holda emas.
• Avtomatlashtirish uchun alohida SSH-kalitlar va ularni vaqti-vaqti bilan yangilash.

Ko'p beriladigan savollar

«openstacksdk is required» xatosi. openstacksdk'ni Ansible o'rnatilgan Python muhitiga o'rnating.

Inventory bo'sh. OS_CLOUD=serverplus'ni va serverlar mavjudligini tekshiring (openstack server list).

SSH orqali ulanmayapti. Floating IP, ochiq 22-port va to'g'ri foydalanuvchi/kalit kerak (Ubuntu uchun — ubuntu).