Dig deeper into Ansible and F5 integration

I tried to write a detailed comment earlier today, but it was flagged as spam for some reason. I'll try again and be more succinct.

unfortunately, I did not phrase my question well, but Payal your comment gave me something to think about. I'm trying to assign multiple irules to a single virtual server by using a var file. next, I want to modify multiple virtual servers to have multiple irules--again using a var file. it seems each time I use a list of items to assign multiple irules via Ansible, I get a list of exceptions thrown. however, if I manually assign multiple irules to a single VS if I don't use a var file. I can also statically assign two irules and then dynamically assign a third irule from a var file using a loop. When I change the irule variable to be a single member list, I get a runtime exception.

heres my varfile with a simple dictionary that works with a loop:

irule_data:
    - {irule: irule3, vs: vs_test01}

here is the same varfile that works because it uses a list with one element (I have to change the task code to signify I want to use item '0' of the embedded list):

irule_data:
    - {irule: [ 'irule3' ], vs: vs_test01}

here's the varfile that fails using the same loop (the dictionary contains a list with two elements): irule_data: - {irule: [ 'irule3', 'irule4' ], vs: vs_test01}

I have tried using with_subelements, with_nested, etc, but all of these do not build the irule list to mimic the following during execution:

irules:
    - irule1
    - irule2
    - irule3
    - irule4

instead I get two task runs that look like this:

irules:
    - irule1
    - irule2
    - irule3

irules:
    - irule1
    - irule2
    - irule4

my overall problem is that I cannot find a way to successfully build the list of irules that I want to apply to the VS using a var file because each type of loop I use causes the task to be run multiple times instead of just once.

I have learned a lot from this thread, and I appreciate the attention and support it receives.

Thanks

Try the following

Playbook:

- name: Rule mgmt BIG-IP
  hosts: localhost
  connection: local
  gather_facts: false

  vars_files:
   - irule_var.yml

  tasks:

  - name: Add iRule
    bigip_irule:
      server: "xx.xx.xxx.xxx"
      user: "admin"
      password: "****"
      module: "ltm"
      name: "{{item}}"
      content: "{{ lookup('file', '{{item}}') }}"
      state: present
      validate_certs: false
    with_items: "{{irules}}"

Variable file

irules:
- irule1
- irule2
- irule3

i am trying add a new virtual server, or change a configured virtual server, that has multiple irules attached. i want to dynamically assign the names of the irules via a variable file. while i dont have a problem looping through a task using external data, i do have a problem attaching multiple i rules in a single loop. as you may know each time you assign an irule via ansible (and the REST api), the operation is a replace, not append. if i run the task three times with one irule each time, the last irule i ran through the task is the one that is left configured.

im not the strongest with ansible, and i am having a hard time figuring the best way to assign multiple irules in one pass of a task using a list. any suggestions?

Hi Milko,

Ideally you can use any user, but each user role has different privileges assigned to them. Ansible does not have any limitation on which user, it will follow privileges assigned by the BIG-IP for that role: https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-user-account-administration-11-6-0/3.html

'Manager' role you should be able to view pool member information, what error are you encountering.

Thanks

Hello team, I'm working with the ansible and LTM V12, now we're using user admin by create, delete or change conf for vs, pool, node, etc. I want not use the user role "admin", I'd like use role "manager" but, with this user I can not work with "get stats" in the pool members. I should use the user admin always vía ansible?

Thanks advance!

I have created a simple HA pair deployment using xlsx spreadsheet. No ansible knowledge required. Just fill in the spreadsheet and execute the playbook

Please see: https://github.com/bwearp/simple-ha-pair

Recommended BIG-IP version is - 12+ Recommended Ansible version is - 2.4

On the Ansible host, the f5-sdk and bigsuds package will need to be installed - pip install f5-sdk - pip install bigsuds

More information on software dependency on a particular module that is under development, please check the specific module on our github repo: https://github.com/F5Networks/f5-ansible/tree/devel/library

What are the various software compatibility dependencies for getting ansible f5 to work?

Perfect - thanks very much!!!

So after editing /etc/ansible/hosts to include at the bottom:

[bigip] 10.XX.XX.XX [bigip:vars] username=admin password=admin

The second block of text is saved as var-onboard-network_file.yml, and the 3rd block of text is saved in the same folder as the var-onboard-network_file.yml file and is called whatever_you_like.yml

The playbook is then called by running: $ ansible-playbook whatever_you_like.yml

For other beginners, see: http://f5-ansible.readthedocs.io/en/devel/modules/list_of_all_modules.html for additional examples

So if we look at the bigip_selfip ansible command: http://f5-ansible.readthedocs.io/en/devel/modules/bigip_selfip_module.html

For this command there are some settings in the variables file, and some information in the playbook. The playbopok calls the items from the variables file.

bigip_selfip command in the playbook:

   - name: Configure SELF-IPs on the BIG-IP
     bigip_selfip:
      server: "{{ inventory_hostname }}"
      user: "{{ username }}"
      password: "{{ password }}"
      validate_certs: False
      name: "{{ item.name }}"  name item selected from variable file
      address: "{{ item.address }}"  address item selected from variable file
      netmask: "{{ item.netmask }}"  netmask item selected from variable file
      vlan: "{{ item.vlan }}"  vlan item selected from variable file
      allow_service: "{{item.allow_service}}"  allow_service item selected from variable file
     with_items: "{{ selfip_information }}"  variable file items heading selection = selfip_information
     delegate_to: localhost

items in the variables file:

selfip_information: - name: 'External-SelfIP' address: '10.128.10.101' netmask: '255.255.255.0' vlan: 'External' allow_service: 'none' - name: 'Internal-SelfIP' address: '10.128.20.101' netmask: '255.255.255.0' vlan: 'Internal' allow_service: 'none' - name: 'HA-SelfIP' address: '1.1.1.1' netmask: '255.255.255.252' vlan: 'HA' allow_service: 'default'

So the ansible command bigip_selfip has multiple switches such as name, address, netmask. The values for these are called from the variables file by the playbook by using {{ item.XXX }} as the value. The values are under selfip_information heading in the var file. So taking a selction from the above config

Playbook: name: "{{ item.name }}" address: "{{ item.address }}" with_items: "{{ selfip_information }}"

Var file items: selfip_information: - name: 'External-SelfIP' equal to {{ item.name }} when called by the playbook address: '10.128.10.101' equal to {{ item.address }} when called by the playbook

And for some other of payal's awesome example playbooks and their associated var files

You also need an updated ansible and f5 and other python modules installed for it to work

1. Ubuntu - Install ansible $ sudo apt-get update $ sudo apt-get install software-properties-common $ sudo apt-add-repository ppa:ansible/ansible $ sudo apt-get update $ sudo apt-get install ansible

2. Install pip $ sudo apt-get install pip then install the below $ pip install f5-sdk bigsuds netaddr deepdiff

Alright let's give this another try. Let's keep it real simple. Let's look at the three files to get this to work

1) The host file, which is be default placed at /etc/ansible/hosts (this file will have the IP Address of your bigip)

[bigip] 
10.XX.XX.XX  

2) The variable file is the same directory as your playbook, the values from this variable file will be substituted when the playbook is run

username: admin
password: admin

banner_text: "--------Welcome to Onboarding BIGIP----------"

hostname: 'ansibleManaged-bigip.local'

ntp_servers:
 - '172.27.1.1'
 - '172.27.1.2'

dns_servers:
 - '8.8.8.8'
 - '4.4.4.4'

dns_search_domains:
 - 'local'
 - 'localhost'

ip_version: 4

bind_servers:
 - '192.168.2.1'
 - '192.168.2.2'

vlan_information:
 - name: 'External'
   tag: '10'
   interface: '1.1'
 - name: 'Internal'
   tag: '11'
   interface: '1.2'

selfip_information:
 - name: 'External-SelfIP'
   address: '10.168.68.5'
   netmask: '255.255.255.0'
   vlan: 'External'
   allow_service: 'default'
 - name: 'Internal-SelfIP'
   address: '192.168.68.5'
   netmask: '255.255.255.0'
   vlan: 'Internal'
   allow_service: 'default'

module_provisioning:
 - name: 'asm'
   level: 'nominal'

3) The playbook

- name: Onboarding BIG-IP
  hosts: bigip
  gather_facts: false
  vars_files:
    - var-onboard-network_file.yml

  tasks:

  - name: Configure NTP server on BIG-IP
    bigip_device_ntp:
      server: "{{ inventory_hostname }}"
      user: "{{ username }}"
      password: "{{ password }}"
      ntp_servers: "{{ ntp_servers }}"
      validate_certs: False
    delegate_to: localhost

  - name: Configure BIG-IP hostname
    bigip_hostname:
      server: "{{ inventory_hostname }}"
      user: "{{ username }}"
      password: "{{ password }}"
      validate_certs: False
      hostname: "{{ hostname }}"
    delegate_to: localhost

  - name: Manage SSHD setting on BIG-IP
    bigip_device_sshd:
      server: "{{ inventory_hostname }}"
      user: "{{ username }}"
      password: "{{ password }}"
      banner: "enabled"
      banner_text: " {{ banner_text }}"
      validate_certs: False
    delegate_to: localhost

  - name: Manage BIG-IP DNS settings
    bigip_device_dns:
     server: "{{ inventory_hostname }}"
     user: "{{ username }}"
     password: "{{ password }}"
     name_servers: "{{ dns_servers }}"
     search: "{{ dns_search_domains }}"
     forwarders: "{{ bind_servers }}"
     ip_version: "{{ ip_version }}"
     validate_certs: False
    delegate_to: localhost

  - name: Provision BIG-IP with appropriate modules
    bigip_provision:
      server: "{{ inventory_hostname }}"
      user: "{{ username }}"
      password: "{{ password }}"
      validate_certs: False
      module: "{{ item.name }}"
      level: "{{ item.level }}"
    with_items: "{{ module_provisioning }}"
    tags: provision
    delegate_to: localhost

  - name: Configure VLANs on the BIG-IP
    bigip_vlan:
     server: "{{ inventory_hostname }}"
     user: "{{ username }}"
     password: "{{ password }}"
     validate_certs: False
     name: "{{ item.name }}"
     tag: "{{ item.tag }}"
     tagged_interface: "{{ item.interface }}"
    with_items: "{{ vlan_information }}"
    delegate_to: localhost

  - name: Configure SELF-IPs on the BIG-IP
    bigip_selfip:
     server: "{{ inventory_hostname }}"
     user: "{{ username }}"
     password: "{{ password }}"
     validate_certs: False
     name: "{{ item.name }}"
     address: "{{ item.address }}"
     netmask: "{{ item.netmask }}"
     vlan: "{{ item.vlan }}"
     allow_service: "{{item.allow_service}}"
    with_items: "{{ selfip_information }}"
    delegate_to: localhost