ansible/infra-automation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
eba1a05e7d7e03076eeb54f6790dc5f663c7f2bf
infra-automation/roles/deploy_linux_vm/defaults/main.yml
ansible eba1a05e7d Implement critical role improvements per ROLE_ANALYSIS_AND_IMPROVEMENTS.md 
This commit addresses the critical issues identified in the role analysis:

## Security Improvements

### Remove Hardcoded Secrets (deploy_linux_vm)
- Replaced hardcoded SSH key in defaults/main.yml with vault variable reference
- Replaced hardcoded root password with vault variable reference
- Created vault.yml.example to document secret structure
- Updated README.md with comprehensive security best practices section
- Added documentation for Ansible Vault, external secret managers, and environment variables
- Included SSH key generation and password generation best practices

## Role Documentation & Planning

### CHANGELOG.md Files
- Created comprehensive CHANGELOG.md for deploy_linux_vm role
  - Documented v1.0.0 initial release features
  - Tracked v1.0.1 security improvements
- Created comprehensive CHANGELOG.md for system_info role
  - Documented v1.0.0 initial release
  - Tracked v1.0.1 critical bug fixes (block-level failed_when, Jinja2 templates, OS variables)

### ROADMAP.md Files
- Created detailed ROADMAP.md for deploy_linux_vm role
  - Version 1.1.0: Security & compliance hardening (Q1 2026)
  - Version 1.2.0: Multi-distribution support (Q2 2026)
  - Version 1.3.0: Advanced features (Q3 2026)
  - Version 2.0.0: Enterprise features (Q4 2026)
- Created detailed ROADMAP.md for system_info role
  - Version 1.1.0: Enhanced monitoring & metrics (Q1 2026)
  - Version 1.2.0: Cloud & container support (Q2 2026)
  - Version 1.3.0: Hardware & firmware deep dive (Q3 2026)
  - Version 2.0.0: Visualization & reporting (Q4 2026)

## Error Handling Enhancements

### deploy_linux_vm Role - Block/Rescue/Always Pattern
- Wrapped deployment tasks in comprehensive error handling block
- Block section:
  - Pre-deployment VM name collision check
  - Enhanced IP address acquisition with better error messages
  - Descriptive failure messages for troubleshooting
- Rescue section (automatic rollback):
  - Diagnostic information gathering
  - VM status checking
  - Attempted console log capture
  - Automatic VM destruction and cleanup
  - Disk image removal (primary, LVM, cloud-init ISO)
  - Detailed troubleshooting guidance
- Always section:
  - Deployment logging to /var/log/ansible-vm-deployments.log
  - Success/failure tracking
- Improved task FQCNs (ansible.builtin.*)

## Handlers Implementation

### deploy_linux_vm Role - Complete Handler Suite
- VM Lifecycle Handlers:
  - restart vm, shutdown vm, destroy vm
- Cloud-Init Handlers:
  - regenerate cloud-init iso (full rebuild and reattach)
- Storage Handlers:
  - refresh libvirt storage pool
  - resize vm disk (with safe shutdown/start)
- Network Handlers:
  - refresh network configuration
  - restart libvirt network
- Libvirt Daemon Handlers:
  - restart libvirtd, reload libvirtd
- Cleanup Handlers:
  - cleanup temporary files
  - remove cloud-init iso
- Validation Handlers:
  - validate vm status
  - check connectivity

## Impact

### Security
- Eliminates hardcoded secrets from version control
- Implements industry best practices for secret management
- Provides clear guidance for secure deployment

### Maintainability
- CHANGELOGs enable version tracking and change auditing
- ROADMAPs provide clear development direction and prioritization
- Comprehensive error handling reduces debugging time
- Handlers enable modular, reusable state management

### Reliability
- Automatic rollback prevents partial deployments
- Comprehensive error messages reduce MTTR
- Handlers ensure consistent state management
- Better separation of concerns

### Compliance
- Aligns with CLAUDE.md security requirements
- Implements proper secrets management per organizational policy
- Provides audit trail through changelogs

## References

- ROLE_ANALYSIS_AND_IMPROVEMENTS.md: Initial analysis document
- CLAUDE.md: Organizational infrastructure standards

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-11 02:21:38 +01:00

168 lines
6.0 KiB
YAML
Raw Blame History

---
# =============================================================================
# Deploy Linux VM Role - Default Variables
# =============================================================================
# -----------------------------------------------------------------------------
# VM Configuration
# -----------------------------------------------------------------------------
deploy_linux_vm_name: "linux-guest"
deploy_linux_vm_hostname: "linux-vm"
deploy_linux_vm_domain: "localdomain"
deploy_linux_vm_vcpus: 2
deploy_linux_vm_memory_mb: 2048
deploy_linux_vm_disk_size_gb: 30
# -----------------------------------------------------------------------------
# Distribution Selection (REQUIRED)
# -----------------------------------------------------------------------------
# Format: "distro-version" or "distro-major.minor"
# Examples: debian-12, ubuntu-22.04, rhel-9, centos-stream-9, almalinux-9
deploy_linux_vm_os_distribution: "debian-12"
# -----------------------------------------------------------------------------
# Network Configuration
# -----------------------------------------------------------------------------
deploy_linux_vm_network: "default"
deploy_linux_vm_bridge: "virbr0"
# -----------------------------------------------------------------------------
# Storage Configuration
# -----------------------------------------------------------------------------
deploy_linux_vm_disk_path: "/var/lib/libvirt/images/{{ deploy_linux_vm_name }}.qcow2"
deploy_linux_vm_cloud_init_iso_path: "/var/lib/libvirt/images/{{ deploy_linux_vm_name }}-cloud-init.iso"
deploy_linux_vm_images_dir: "/var/lib/libvirt/images"
# -----------------------------------------------------------------------------
# LVM Configuration (CLAUDE.md Compliance)
# -----------------------------------------------------------------------------
deploy_linux_vm_use_lvm: true
deploy_linux_vm_lvm_vg_name: "vg_system"
deploy_linux_vm_lvm_pv_device: "/dev/vdb"
# LVM Logical Volumes - Per CLAUDE.md Requirements
deploy_linux_vm_lvm_volumes:
- name: lv_opt
size: 3G
mount: /opt
fstype: ext4
mount_options: defaults
- name: lv_tmp
size: 1G
mount: /tmp
fstype: ext4
mount_options: noexec,nosuid,nodev
- name: lv_home
size: 2G
mount: /home
fstype: ext4
mount_options: defaults
- name: lv_var
size: 5G
mount: /var
fstype: ext4
mount_options: defaults
- name: lv_var_log
size: 2G
mount: /var/log
fstype: ext4
mount_options: defaults
- name: lv_var_tmp
size: 5G
mount: /var/tmp
fstype: ext4
mount_options: noexec,nosuid,nodev
- name: lv_var_audit
size: 1G
mount: /var/log/audit
fstype: ext4
mount_options: defaults
- name: lv_swap
size: 2G
mount: none
fstype: swap
mount_options: sw
# -----------------------------------------------------------------------------
# Ansible User Configuration
# -----------------------------------------------------------------------------
deploy_linux_vm_ansible_user: "ansible"
# SECURITY: SSH key should be defined in vault file or group_vars
# Example: vault_deploy_linux_vm_ansible_user_ssh_key
deploy_linux_vm_ansible_user_ssh_key: "{{ vault_deploy_linux_vm_ansible_user_ssh_key | default('') }}"
deploy_linux_vm_ansible_user_shell: "/bin/bash"
# SECURITY: Root password should be defined in vault file
# Example: vault_deploy_linux_vm_root_password
# This is for emergency console access only
deploy_linux_vm_root_password: "{{ vault_deploy_linux_vm_root_password | default('ChangeMe123!') }}"
# -----------------------------------------------------------------------------
# SSH Configuration
# -----------------------------------------------------------------------------
deploy_linux_vm_ssh_permit_root_login: "no"
deploy_linux_vm_ssh_password_authentication: "no"
deploy_linux_vm_ssh_pubkey_authentication: "yes"
deploy_linux_vm_ssh_max_auth_tries: 3
deploy_linux_vm_ssh_max_sessions: 10
deploy_linux_vm_ssh_client_alive_interval: 300
deploy_linux_vm_ssh_client_alive_count_max: 2
deploy_linux_vm_ssh_gssapi_authentication: "no" # Disable GSSAPI
deploy_linux_vm_ssh_gssapi_cleanup_credentials: "no"
# -----------------------------------------------------------------------------
# Security Configuration
# -----------------------------------------------------------------------------
deploy_linux_vm_enable_firewall: true
deploy_linux_vm_enable_selinux: true # RHEL family only
deploy_linux_vm_enable_apparmor: true # Debian family only
deploy_linux_vm_enable_auditd: true
deploy_linux_vm_enable_automatic_updates: true
deploy_linux_vm_automatic_reboot: false
# -----------------------------------------------------------------------------
# Essential Packages (Per CLAUDE.md)
# -----------------------------------------------------------------------------
deploy_linux_vm_essential_packages:
- vim
- htop
- tmux
- jq
- bc
- curl
- wget
- rsync
- git
- python3
- python3-pip
deploy_linux_vm_security_packages:
- aide
- chrony
# -----------------------------------------------------------------------------
# System Configuration
# -----------------------------------------------------------------------------
deploy_linux_vm_timezone: "UTC"
deploy_linux_vm_locale: "en_US.UTF-8"
# -----------------------------------------------------------------------------
# Cloud-Init Configuration
# -----------------------------------------------------------------------------
deploy_linux_vm_package_update: true
deploy_linux_vm_package_upgrade: true
deploy_linux_vm_package_reboot_if_required: false
# -----------------------------------------------------------------------------
# Validation and Deployment Options
# -----------------------------------------------------------------------------
deploy_linux_vm_wait_for_boot_seconds: 90
deploy_linux_vm_ssh_wait_timeout: 300
deploy_linux_vm_skip_validation: false
# -----------------------------------------------------------------------------
# Cleanup Options
# -----------------------------------------------------------------------------
deploy_linux_vm_cleanup_temp_files: true
deploy_linux_vm_remove_cloud_init_iso_after_boot: false
Reference in New Issue View Git Blame Copy Permalink