Automatizare infrastructura cu Ansible

Manual server administration nu mai scaleaza dupa 10-20 servere. Ansible elimina erori, asigura consistency si reduce timpul operational cu 80%+.

Filosofia "Infrastructure as Code"

Toate schimbarile pe infrastructura trec prin playbook-uri Ansible versionate in Git. Niciodata SSH manual pentru schimbari de productie. Zero "drift" intre servere.

Componente

Playbooks structurate — roles per serviciu, variabile per environment
Inventory dinamic — sursa din vCenter, AWS, Proxmox API
Ansible Vault — secrete encrypted in repository
AWX / Tower — UI pentru executie, scheduling, RBAC, audit log
Collections custom — module pentru tehnologii proprietare (FortiGate API, RouterOS)

Use cases tipice

Bootstrap server nou — ISO la productie in 30 min (hardening + monitoring + backup)
Patching coordonat — kernel update pe 200 servere cu rolling restart
Configurare uniforma — toate serverele identice prin definitie
Compliance enforcement — verificare zilnica ca nimeni n-a facut schimbari manuale
Disaster recovery — rebuild complet din playbook in <1 ora

Ce livram

Repo Git cu playbook-uri complete, AWX server cu RBAC, integrare CI/CD, training echipa interna, documentatie onboarding.

Exemplu: playbook Ansible

Structura tipica a unui playbook cu roles, aplicat pe un grup de servere:

# site.yml — hardening de baza pe un grup de servere
- hosts: webservers
  become: true
  roles:
    - common       # useri, ssh keys, timezone
    - hardening    # sshd, fail2ban, unattended-upgrades
    - nginx
# rulare:  ansible-playbook -i inventory site.yml

Inventory + comenzi ad-hoc

Un inventory simplu si comenzi rapide fara playbook:

# inventory.ini
[web]
10.0.0.11
10.0.0.12
[db]
10.0.0.20

# comenzi ad-hoc
ansible all -i inventory.ini -m ping
ansible web -i inventory.ini -m apt -a 'name=nginx state=latest' --become
ansible all -i inventory.ini -m shell -a 'uptime'

Secrete cu Ansible Vault

Tii parolele criptate in repository, decriptate doar la rulare:

ansible-vault create group_vars/all/vault.yml     # editezi criptat
ansible-vault edit group_vars/all/vault.yml
# rulare cu parola vault
ansible-playbook site.yml --ask-vault-pass
# sau cu fisier de parola in CI
ansible-playbook site.yml --vault-password-file ~/.vault_pass

Structura unui role

Un role reutilizabil, cu tasks, handlers si templates:

ansible-galaxy init roles/nginx
# roles/nginx/tasks/main.yml
- apt: { name: nginx, state: present }
- template: { src: site.conf.j2, dest: /etc/nginx/sites-enabled/site.conf }
  notify: reload nginx
# roles/nginx/handlers/main.yml
- name: reload nginx
  service: { name: nginx, state: reloaded }

Rulare sigura: check, diff, tags

Vezi ce s-ar schimba INAINTE si rulezi doar o parte:

ansible-playbook site.yml --check --diff        # dry-run + ce se schimba
ansible-playbook site.yml --tags nginx --limit web
ansible-playbook site.yml --start-at-task 'Configure TLS'
ansible-lint site.yml                            # best practices