Ansible: How to manage Windows servers using winrm

[Music] hello and in today's demo we're going to manage windows servers using ansible so we're going to set up a windows 2016 server so that ansible can manage it over https we're going to set up centos my centos 8 server so that it can manage windows using winram we're going to create an inventory file we're going to prove we can get a connection with winping then we're going to create a basic playbook we're going to do some stuff like files directories and checksums and then we're going to use ansiblevault to hide the password in the inventory file that's the very important last step for security so these are my credentials today at the bottom of the screen this server will be destroyed afterwards so they're just junk at the moment okay so the first step is to set up the windows server so the first thing you can do is go to the windows setup guide on ansible docs and it has a whole lot of really useful information here on how to do it and this is what we're going to follow today now windows 2016 yes so make your way to the winrm setup section when and all these links every link i have will be included in the comments at the bottom um in the youtube video so start a powershell session and before we can actually run it we need to set the protocol for tls 1.2 so by default in 2016 it's tls1 and if that won't let's connect to the remote website so we just need to update that before we can run the powershell commands so simply run that again i'll paste all this in to the youtube video comments and this the section underneath the video so now we just take those commands run them in powershell obviously administrator access and then that will be done and then we're just going to do a double check to make sure it's actually listening properly and we can see that we have both there so we're going to use https okay so the next step is to set up our inventory file so i won't call it inventory i'll call it um i'll call it host.ini which is more of the standard convention okay so i've already got one that's pre-prepared so i'll copy that in and as you can see it's got like a lot of extra stuff there in the variable section including the password now we're going to leave that in for now but in a bit in a short time we're going to take that out and i'll show you how to use ansible vault to hide that password so that it's not not visible okay so now we've got our inventory file let's create our first playbook in fact let's try and do the win ping first and then that just proves before we begin that we've got connectivity ah okay so this is normal i haven't set my server up for when rm yet so we now need to go to the next url which is the remote windows windows remote management and as you scroll down you can see there's a command there the pip install now because i'm on center state i need to use pip3 and i'm going to do it as my local user so i'm going to make a few changes to this command but i'll make sure this is available in the comments so pip3 and then hyphen hyphen user okay so that installs it and sets it up so now if we try winping again we should get a pong and we do excellent right so now we've got connectivity we can start by writing our playbook and carry on so let's go okay so my playbook is just gonna be called windows.yaml now this is all obviously very basic steps you can create roles and collections and all sorts but i'm just gonna do a very basic template and a playbook that just show you how to use it now that you've got connectivity so we always set it up the same we give it a name we'll tell you which host we're going to run on and that host is the the group name in the inventory file which is win and we're going to use that again later on when we set up some variables so i'm going to set up i'm going to use the win file module so i'll just pop that up here standard module every module for windows generally starts win underscore something so we're going to create a directory we're going to cut and paste it straight out i'm going to make a couple of adjustments and then we're going to run that and make sure it gets created so we actually can see ansible doing things on windows you'll see just how simple it is okay so save that let's run it so slightly different command now we're going to use ansible hyphen playbook and then we're going to reference the host file and our play and our playbook windows.camel that's running this is good and let's go over to the server and see if it's created that directory okay so let's go to the c drive and temp which wasn't there but it is there and then folder which wasn't there and is there brilliant so we know it's worked so let's go back now let's add a let's just touch a file let's just create a temporary file well touch a food.txt file into that directory okay just literally we're going to just cut it in adjust it its position that's it because it never comes in in the right in the right spacing okay i'll just change this to be the folded directory as well yeah food.txt we want okay so now let's run that and see if it creates the file for us okay it looks like it worked so let's go and have another look get that back and we can see the file there now it's an empty file but it's created it and it's food.txt that's what we asked it to do okay now let's create a little template and push that to food.txt on the windows server so food.text.j2 for ginger2 and ginge2 means that we can expand ansible facts and variables into it so i'll just cut this in it's just a silly message that has that refers to the ansible host name and the ansible hostname is taken from the fax gathered by ansible when it runs on the server so that ansible hostname will be replaced by the hostname of the server so let's update the playbook to cater for the ginger2 template okay so we actually there is a wind template module so if you scroll down uh you get a good good couple of examples there that you can use so i've already got one prepared so i'm just going to cut paste that in for my notes but it's almost identical okay now let's run that so this time our empty file will become a template file and it'll be full of that it'll be have that messaging that we just added into the into the template file and you'll see it'll expand the variable into the actual hostname so refresh and then open that and there we go so we've actually got that should have been called not caller but we can see the server name there so we know it's picking up variables from the local server which is great okay now i'm just going to add a couple more in we're going to do a check sum of that file and then just get a number back so we can compare it make sure it hasn't been tampered with and then we're going to do a windows update for some security updates so i'm just going to cut and paste them off my notes pop them straight in you know feel free to pause the video and write all this stuff out there it is so winstat is just going to look at that file and do a checksum on it and then we register to checksum and then the debug variable outputs that checksum value so we can see what it is to the screen when we run ansible and then we're going to use windows updates we're going to do security updates but it's a new server i only built it a few minutes ago so chances are there won't be any all right we got to check some out that's good so if we were checking a particular checksum just to prove that file was the one we wanted we could then check that against something else um we don't we're not going to do that in this case but it's good to know you can and the security updates yeah it's it's green okay so it didn't actually do anything i wasn't expecting it to okay now the next section we need to cover security if we look in the host.only file we can see that the password is in plain text and that's generally not a good idea under any circumstances so what we're going to do now is we're going to create a default variable location called group underscore files and then i'll just quickly create the win.yaml file and then just save it and the win.yaml is reference is it's a direct reference to the group name in the host or any file so you can see the window.yaml and if we cut the host file you can see that win is the name of the group so any any variables in win dot yaml will be picked up when ansible runs so if you know that it's really it's very handy so what we need to do now is encrypt our string now the string is the password from the host.any file and the name is going to be ansible underscore password and it's going to output in a particular format and we take that format straight out and cut it straight into a variable into the win.yaml file so we have to give it a full password in this case i'm going to give it password123 right so take that output and we're going to put it straight into the win.yaml file that's it and save that and quickly yep i'll have another link in the in the um description um there is like an inventory actually let's just put it up there we go so i'll put this link in this gives you some hints and tips on how to do how to hide secret values and what you can do to pick them up so i'll leave that in there as well for you to have a look at um so now we can rerun it and we have to add in ask for pass at the end not faulty vault pass there we go and then we give it the pass password or password punchy free which is what we use to encrypt the file and that's running so we know that we've got the password right it's picked up the ansible password variable and it's now running that's good right i'll cancel that and what i'll do is we'll create a vault file yes oh actually yeah i didn't forgot to delete it let's delete it out there now we can run the vault file well we'll run it again once this is finished we'll create a vault file that takes it away yep so it's still working just to make sure that it wasn't actually the password in the host file yeah that's okay right so now what we're going to do we're going to create an openvault.txt file we're going to put the password in here and then we're going to reference this password in the ansible cfg file so that we don't have to type it in every time so again don't ever keep this file in the same place that you put your code because if you put your code in github it means you're going to have a plain text password that's visible to anybody that's got access to your github repo make sure you don't do that so use vault underscore password underscore file and the file was open text and then we take that off the command and we can kick it off and then that'll just pick up the file at the variable and just carry on working as normal so we're now managing our windows servers with ansible um if you've enjoyed this session get in touch let me know what else you want to see subscribe and have a great time thank you very much

Channel: London IAC

Views: 5,978

Keywords: ansible, devops, ansible tutorial, ansible playbook, playbook, ansible-playbook, ansible-vault, ansible docs, ansible loop, red hat, ansible vault, ansible for windows, ansible windows, winrm, inventory, ansible tutorial for beginners, linux, windows, windows 2016, windows 2019, manage windows using ansible, what is ansible, ansible for windows admins, ansible for windows server, winrm ansible, ansible winrm, ansible windows tutorial

Id: aPN18jLRkJI

Length: 13min 45sec (825 seconds)

Published: Wed May 05 2021