Utilize ansible-runner to execute playbooks from jobs/api/...

[jifox]

I would like to start a discussion about how to implement a Nautobot plugin that will allow to execute ansible-playbooks from within Nautobot.

I think many network engineers are already using Ansible for (network)-automation. I personally have a lot of playbooks and templates to manage my production network. But currently this is done by executing it from cli commands either manually or via cron.

To be able using Ansible from within Nautobot will allow me to delegate some routine tasks to our first level support by providing a Web GUI and using the authentication/authorization functionality form Nautobot.

As Ansible is already capable of using Nautobot as an inventory source and to query Nautobot for information, it should be possible without much effort to implement a plugin that is triggering ansible to execute specific playbooks.

PoC

I followed the NTC Blog - ansible-builder-runner-ee and managed to get all running.

After that I’ve tested the remote execution as described in section Remote job execution in ansible-runner documentation.

Ansible Runner supports the concept that a job run may be requested on one host but executed on another. This capability is primarily intended to be used by Receptor.

Support for this in Runner involves a three-phase process.

• Transmit: Convert the job to a binary format that can be sent to the worker node.
• Worker: Actually execute the job.
• Process: Receive job results and process them.

admin@swarm-services:~/ansible-ee$
 ansible-runner transmit \
>         --container-image jifox01/nautobot-ee \
>         --container-volume-mount /home/ansible/.ssh:/home/runner/.ssh \
>         -p test.yml example/ \
>     | ssh ansible@swarm1 \
>         /home/ansible/.cache/pypoetry/virtualenvs/ansible-ee-3EOe-rOM-py3.9/bin/ansible-runner worker \
>     | ansible-runner process ./example/


PLAY [all] *********************************************************************

TASK [Gathering Facts] *********************************************************

ok: [localhost]

TASK [shell] *******************************************************************

changed: [localhost]

TASK [debug] *******************************************************************

ok: [localhost] => {
    "msg": "Simple Test Debug for EE"
}

PLAY RECAP *********************************************************************
localhost                  : ok=4    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

Ideas

• Basically, the ansible-runner should be a Nautobot Job.
  • That will provide the git datasource to fetch the Runner Input Hierarchy.
• The settings for sensitive information should utilize Nautobot Secrets if possible
  • Is there new functionality needed?
    ./env/passwords
    ./env/ssh_key
• Provide a docker-compose.ansible.yml that adds a ansible-runner worker Container
  • Use a named volume that is mounted on this container and also on all celery-worker containers.
  • this volume should provide two named-pipes representing the input and output of ansible-runner worker. This would replace the ssh command in the PoC

Links

• introduction-to-ansible-builder
• ansible-builder.readthedocs.io
• ansible-runner.readthedocs.io

[erjac77]

Ansible and Terraform runners #996