balanced-ops/ansible-base

aybabtu

ansible-base's Issues

ansible-base *must* support CentOS as well

We use ansible-base on EB (which is using Amazon Linux AMI / CentOS 6.4) and we use ansible-base to install the basic necessities like keys to SSH into a machine, etc.

We need to remove the ubuntu-isms and move that to another role instead.

postfix

https://github.com/jdauphant/ansible-role-postfix/blob/master/defaults/main.yml

can clone settings from https://github.com/balanced-cookbooks/role-base/commit/c9dac54224226bd2ed7763cc1b7fbe9aa42f4233

This ansible role does too much.

For swap, use https://github.com/jyunderwood/ansible-swapfile
For utils, use https://github.com/Oefenweb/ansible-apt

No need to for aws/dns just to use this module.

Apt credentials must be escaped

s3://username:[password]@... will fix this

Why are we creating a route53 in an ansible playbook?

This is going around cloudformation, which reduces the value and entire point of using cloudformation. When I delete a stack, this route should be cleaned up.

https://github.com/balanced-ops/ansible-base/blob/master/tasks/dns.yml#L22-L29

Travis build is broken

ERROR: cannot find role in /Users/marshall/code/balanced/ops/ansible-base/roles/apt-transport-s3 or /Users/marshall/code/balanced/ops/ansible-base/apt-transport-s3 or /Users/marshall/code/balanced/ops/apt-transport-s3

GPG Key unavailable

failed: [default] => {"cmd": "apt-key adv --keyserver hkp://pgp.mit.edu --recv 277E7787", "failed": true, "rc": 2}
stderr: gpg: requesting key 277E7787 from hkp server pgp.mit.edu
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0

stdout: Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /tmp/tmp.eOxPq6sMcM --trustdb-name /etc/apt/trustdb.gpg --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyserver hkp�
://pgp.mit.edu --recv 277E7787
gpgkeys: key 277E7787 not found on keyserver

msg: gpg: requesting key 277E7787 from hkp server pgp.mit.edu
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0

FATAL: all hosts have already failed -- aborting

I continue to see this error both on my local vagrant box and prod nodes occasionally.

The key is there, the mit keyserver occasionally refuses to return it.

DNS not overwriting

TASK: [base | route53 command=create zone={{ root_dns_zone }} record={{ ansible_hostname }}.{{ domain }} type=A ttl=60 value={{ ansible_eth0.ipv4.address }}
] ***
failed: [10.3.105.119] => {"failed": true}
msg: Record already exists with different value. Set 'overwrite' to replace it

FATAL: all hosts have already failed -- aborting

- route53: >
    command=create
    zone={{ root_dns_zone }}
    record={{ ansible_hostname }}.{{ domain }}
    type=A
    ttl=60
    value={{ ansible_eth0.ipv4.address }}
    overwrite=true
  tags: aws
  when: ansible_ec2_instance_id is defined

works as expected. (note overwrite attr)

Failing to add route53 DNS entries

This is indicative of an outdated version of boto being used. ping @mahmoudimus

failed: [10.3.104.221] => {"failed": true, "parsed": false}
SUDO-SUCCESS-enehuqqvtvhotdxwhfskphdlwbmwnohj
Traceback (most recent call last):
  File "/home/ubuntu/.ansible/tmp/ansible-tmp-1414542649.4-157077341704335/route53", line 1997, in <module>
    main()
  File "/home/ubuntu/.ansible/tmp/ansible-tmp-1414542649.4-157077341704335/route53", line 210, in main
    conn = boto.route53.connection.Route53Connection(aws_access_key, aws_secret_key)
  File "/usr/lib/python2.7/dist-packages/boto/route53/connection.py", line 62, in __init__
    True, port, proxy, proxy_port, debug=debug)
  File "/usr/lib/python2.7/dist-packages/boto/connection.py", line 486, in __init__
    host, config, self.provider, self._required_auth_capability())
  File "/usr/lib/python2.7/dist-packages/boto/auth.py", line 406, in get_auth_handler
    'Check your credentials' % (len(names), str(names)))
boto.exception.NoAuthHandlerFound: No handler was ready to authenticate. 1 handlers were checked. ['HmacAuthV3Handler'] Check your credentials

failed: [10.3.105.84] => {"failed": true, "parsed": false}
SUDO-SUCCESS-dnhdmrivrcxqgtgmzkqsakgsmyvpzstq
Traceback (most recent call last):
  File "/home/ubuntu/.ansible/tmp/ansible-tmp-1414542649.4-252716704119717/route53", line 1997, in <module>
    main()
  File "/home/ubuntu/.ansible/tmp/ansible-tmp-1414542649.4-252716704119717/route53", line 210, in main
    conn = boto.route53.connection.Route53Connection(aws_access_key, aws_secret_key)
  File "/usr/lib/python2.7/dist-packages/boto/route53/connection.py", line 62, in __init__
    True, port, proxy, proxy_port, debug=debug)
  File "/usr/lib/python2.7/dist-packages/boto/connection.py", line 486, in __init__
    host, config, self.provider, self._required_auth_capability())
  File "/usr/lib/python2.7/dist-packages/boto/auth.py", line 406, in get_auth_handler
    'Check your credentials' % (len(names), str(names)))
boto.exception.NoAuthHandlerFound: No handler was ready to authenticate. 1 handlers were checked. ['HmacAuthV3Handler'] Check your credentials

Route53 occasionally hangs when creating entries with boto

Not sure why but creating the route53 record hangs about 20% of the time.

If we could check for its existence and skip the task that would be good. this could also let us remove the overwrite attribute and tighten up the IAM perms