Ansible : rolling upgrades or updates.

Making a change to live servers in production is something which has to be done with extreme care and planning. Several deployment types such as blue/green, canary, rolling update are in use today to minimize user impact. Ansible can be used to orchestrate a zero-downtime rolling change to a service.

A typical upgrade of an application, such as patching, might go like this –

  1. disable monitoring alerts for a node
  2. disable or pull out from load balancer
  3. make changes to server
  4. Reboot node
  5. wait for node to be UP and do sanity check
  6. put node back to load balancer
  7. turn on monitoring of node

Rinse and repeat.

Ansible would be a great choice in orchestrating above steps. Let us start with an inventory of web servers, a load balancer and a monitoring node with nagios –




The web servers are running apache2, and we will patch apache and the kernel. For the patch to take effect, the servers need to be recycled. We will perform the patching one node at a time, wait for the node to be healthy and go to the next. The first portion of our playbook would be something like this –

- hosts: webservers
  serial: 1

  - name: Stop apache service
    service: name=httpd state=stopped

  - name: update apache
    yum: name=httpd state=latest
  - name: Update Kernel
    yum: name=kernel state=latest
  - name: Reboot server
    shell: /sbin/reboot -r +1

  - name: Wait for webserver to come up
    wait_for: host={{ inventory_hostname }} port=80 state=started delay=65 timeout=300

I haven’t included the playbook tasks for disabling/enabling monitoring as well as removing/adding node to the load balancer. The procedures might differ depending on what type of monitoring system or load balancer technology you are using. In addition to this, the sanity check show is a simple port 80 probing, in reality a much more sophisticated validation can be done.

References –

Getting started with Google Cloud Platform(GCP)

Google provides the same cloud services as other cloud providers such as Amazon Web Services(AWS) and Microsoft (Azure). It refers it as Google Cloud Platform or GCP. You can easily get started by signing up for free –

List of all products provided in GCP –

Google provides several ways to interact with its services-

1. GCP console (web ui)
GCP console is a web user interface which lets you interact with GCP resources. You can view, create, update and delete cloud resources from this page.

How to create a Linux vm(instance) using the console –

2. Command Line Interface (gcloud cli toolset)
Install gcloud :

The gcloud toolkit is a command line interface tool to interact with GCP resources. Very useful in automating cloud tasks, with its command completion and help pages, it is almost a necessity to familiarize yourself with this tool.

How to create an instance using gcloud cli –

3. Cloud deployment manager
GCP deployment manager allows you to create, delete and update GCP resources in parallel by declaring a set of templates written in jinja2 or python. Templates can be shared with other teams and can be re-used with little modification.

What deployment manager is and how it works –

How to deploy an a GCP instance using deployment manager –

4. APIs
Google provides application programming interface(APIs) to interact with its GCP services. Google recommends using the client libraries over directly calling the RESTful apis.

a. Client libraries

List of client libraries for different programming languages –

How to interact with Google Compute Engine(GCE) using the Python client library –

b. RESTful or raw APIs

API Reference –

Method for creating an instance –

References –
Google Cloud Platform Services overview

Ansible – How to run a portion of a playbook using tags.

If you have a large playbook it may become useful to be able to run a specific part of it or only a single task without running the whole playbook. Both plays and tasks support a “tags:” attribute for this reason.

In this specific scenario, I have a playbook which configures all productions servers from the moment the servers boot till they start taking traffic. While testing the plays in dev environment, I was debugging an issue on the parts which does dns configuration. This is where the “tags” attributes comes handy –

1. Tag the task –

- name: Configure resolv.conf
  template: src=resolv.conf.j2 dest=/etc/resolv.conf
  when: ansible_hostname != "ns1"
    - dnsconfig

2. Run only the tasks tagged with a specific name –

root@linubuvma:/etc/ansible# ansible-playbook -i dc1/hosts dc1/site.yml --tags "dnsconfig" --check

PLAY [Setup data center 1 servers] *****************************************************

TASK: [common | Configure resolv.conf] ****************************************
skipping: [ns1]
changed: [docker]
ok: [ns2]
ok: [whitehat]
ok: [mail]
ok: [www]
ok: [ftp]

PLAY RECAP ********************************************************************
whitehat                   : ok=1    changed=0    unreachable=0    failed=0
docker                     : ok=1    changed=1    unreachable=0    failed=0
ns1                        : ok=0    changed=0    unreachable=0    failed=0
ns2                        : ok=1    changed=0    unreachable=0    failed=0
mail                        : ok=1    changed=0    unreachable=0    failed=0
www                   : ok=1    changed=0    unreachable=0    failed=0
ftp                   : ok=1    changed=0    unreachable=0    failed=0

Ansible playbook will run only the task with the specified tag, it will skip the rest of the tasks in the playbook. Use the ‘–list-tags’ flag to view all the tags.

References –

Ansible – enable logging

Ansible – Enable logging

By default, Ansible logs the output of playbooks to the standard output only. In order to enable logging to a file for later review or auditing, it can be turned on by setting log_path to a path location where Ansible has a write access.

In my case, i have added the “log_path” setting in the ansible configuration file “/etc/ansible/ansible.cfg”

# grep log_path /etc/ansible/ansible.cfg
log_path = /var/log/ansible.log

Now I can view the log file to all the details on ansible runs –

root@linubuvma:/etc/ansible# ansible-playbook tasks/groupby.yml --check
PLAY [all:!swarm:!docker1] ****************************************************

TASK: [group_by key=os_{{ ansible_os_family }}] *******************************
changed: [ns2]

root@linubuvma:/etc/ansible# ls -al /var/log/ansible.log
-rw-r--r-- 1 root root 4255 May 16 21:21 /var/log/ansible.log
root@linubuvma:/etc/ansible# head  /var/log/ansible.log
2015-05-16 21:21:43,732 p=22946 u=root |
2015-05-16 21:21:43,732 p=22946 u=root |  /usr/local/bin/ansible-playbook tasks/groupby.yml --check
2015-05-16 21:21:43,732 p=22946 u=root |
2015-05-16 21:21:43,734 p=22946 u=root |  ERROR: the playbook: tasks/groupby.yml could not be found
2015-05-16 21:21:48,575 p=22954 u=root |
2015-05-16 21:21:48,576 p=22954 u=root |  /usr/local/bin/ansible-playbook tasks/groupby.yml --check
2015-05-16 21:21:48,576 p=22954 u=root |
2015-05-16 21:21:48,594 p=22954 u=root |  PLAY [all:!swarm:!docker1] ****************************************************
2015-05-16 21:21:48,609 p=22954 u=root |  TASK: [group_by key=os_{{ ansible_os_family }}] *******************************
2015-05-16 21:21:48,641 p=22954 u=root |  changed: [ns2]

It logs dry-runs (–check) as well and it is smart enough not to log Password arguments.

References –

Say no to Net Neutrality repeal

Protect open Internet for all.

On Wednesday Nov 22nd 2017, the FCC has published a new proposal to undo the existing net neutrality rules meant to prevent ISPs from creating a multi-tiered Internet, where they can freely charge extra fees for faster access to some websites. This new proposal if passed, will basically make the cable companies the gate keepers. They will be able to pick and choose winners and losers, whoever pays them a big check will have their content delivered faster to users, while small businesses and individuals will have a big barrier erected against them to enter the market and deliver innovative products to the public.

This is against the philosophy which created the Internet in the first place, an open and innovative Internet, which provides a level playing field for all.

Act now, say no to the new proposal –

Do not repeal net neutrality

Battle for the net


Exit from unresponsive ssh session

How to terminate or cancel an unresponsive ssh session.

While connected to a remote host through an ssh connection using Putty or other ssh clients, your client might freeze and not respond to any keyboard activity. In order to force an exit, there is a “secret” keyboard shortcut – Enter~. [ Enter followed by ~ followed by .(dot) ]

[daniel@kauai ~]$ ssh

Uptime............: 21:25:34 up 14654 days, 15:00,  2 users,  load average: 0.09, 0.19, 0.17
Server IP.........:
Operating System..: Ubuntu 10.04.4 LTS
Username..........: daniel

daniel@svm1010:~$ uname

***Press*** Enter~.  {Enter key, followed by '~', followed by '.'}

daniel@svm1010:~$ Connection to closed.

[daniel@kauai ~]$ 

After you press the Enter~. the connection will be aborted and your session will return to the connection originating client shell.

Alternatively, you can background the ssh session with Enter~Ctrl+Z and then foreground it with fg command.

References –