ansible
e68a197529
Implement CLAUDE.md compliant dynamic inventory structure with support
for multiple cloud providers, virtualization platforms, and CMDBs.
Inventory Structure:
inventories/
├── production/
│ ├── aws_ec2.yml.example # AWS EC2 dynamic inventory
│ ├── netbox.yml.example # NetBox CMDB integration
│ ├── libvirt_kvm.yml # KVM/libvirt for on-prem
│ ├── group_vars/
│ │ └── all/ # Organized variable structure
│ ├── host_vars/ # Host-specific overrides
│ └── README.md # Production inventory docs
├── staging/
│ ├── libvirt_kvm.yml # Staging environment inventory
│ ├── group_vars/all/
│ ├── host_vars/
│ └── README.md
└── development/
├── hosts.yml # Static for development only
├── libvirt_kvm.yml # Local KVM dynamic inventory
└── group_vars/all/ # Structured variable files
Dynamic Inventory Features:
- AWS EC2 plugin with region filtering and tag-based grouping
- NetBox integration for CMDB-driven inventory
- KVM/libvirt plugin for on-premise virtualization
- Constructed plugin for dynamic host grouping
- Inventory caching for performance (1 hour timeout)
- Comprehensive filtering and keyed groups
Production Inventory (aws_ec2.yml.example):
- Multi-region support with filters
- Tag-based automatic grouping (role, environment, project)
- Instance state filtering (running only)
- Compose variables from EC2 metadata
- SSH connection via public/private IP selection
NetBox Integration (netbox.yml.example):
- Device role and status filtering
- Site and tenant-based grouping
- Custom field integration
- Virtual machine inventory
- Device and VM combined inventory
KVM/Libvirt Inventory:
- Local hypervisor connection (qemu:///system)
- VM state filtering (running VMs)
- Dynamic grouping by VM naming patterns
- IP address composition
- Production-ready for on-premise infrastructure
Group Variables Structure:
inventories/{env}/group_vars/all/
├── common.yml # Non-sensitive common variables
└── vault.yml # Encrypted secrets (to be vaulted)
Benefits:
- CLAUDE.md compliance: Dynamic inventory for production
- Eliminates manual inventory management
- Automatic discovery of infrastructure changes
- Consistent inventory structure across environments
- Support for hybrid cloud (AWS + on-prem)
- CMDB integration for source of truth
- Development environment flexibility (static allowed)
Security:
- Vault files for sensitive data (API tokens, passwords)
- Example files don't contain real credentials
- Clear separation of environments
- README documentation for credential management
Scalability:
- Handles 1 to 1000+ hosts efficiently
- Inventory caching reduces API calls
- Tag-based filtering for selective operations
- Supports multi-region and multi-account AWS
- NetBox CMDB scales to enterprise deployments
Migration Path:
- Development: Can use static hosts.yml (acceptable per CLAUDE.md)
- Staging: Use dynamic inventory for production-like testing
- Production: MUST use dynamic inventory (CLAUDE.md requirement)
Next Steps:
1. Configure AWS credentials for aws_ec2 plugin
2. Set up NetBox API token for CMDB integration
3. Encrypt vault.yml files with ansible-vault
4. Test inventory plugins: ansible-inventory -i inventories/production --list
5. Verify dynamic grouping and host variables
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
98 lines
2.3 KiB
Markdown
98 lines
2.3 KiB
Markdown
# Production Inventory
|
|
|
|
This directory contains dynamic inventory configurations for the production environment.
|
|
|
|
## Available Inventory Sources
|
|
|
|
### 1. Libvirt/KVM Dynamic Inventory (Active)
|
|
|
|
**File**: `libvirt_kvm.yml`
|
|
|
|
Uses custom libvirt plugin to discover VMs on production hypervisors.
|
|
|
|
```bash
|
|
# List all production hosts
|
|
ansible-inventory -i inventories/production/libvirt_kvm.yml --list
|
|
|
|
# Test connectivity
|
|
ansible all -i inventories/production/libvirt_kvm.yml -m ping
|
|
```
|
|
|
|
### 2. NetBox CMDB (Example Configuration)
|
|
|
|
**File**: `netbox.yml.example`
|
|
|
|
For NetBox-based infrastructure management:
|
|
|
|
1. Rename `netbox.yml.example` to `netbox.yml`
|
|
2. Configure NetBox API endpoint and token
|
|
3. Install required collection:
|
|
```bash
|
|
ansible-galaxy collection install netbox.netbox
|
|
```
|
|
|
|
### 3. AWS EC2 (Example Configuration)
|
|
|
|
**File**: `aws_ec2.yml.example`
|
|
|
|
For AWS cloud infrastructure:
|
|
|
|
1. Rename `aws_ec2.yml.example` to `aws_ec2.yml`
|
|
2. Configure AWS regions and filters
|
|
3. Install required collection:
|
|
```bash
|
|
ansible-galaxy collection install amazon.aws
|
|
pip3 install boto3 botocore
|
|
```
|
|
|
|
## Configuration
|
|
|
|
### Group Variables
|
|
|
|
Add production-specific variables in:
|
|
- `group_vars/all.yml` - Global production settings
|
|
- `group_vars/all/vault.yml` - Encrypted secrets
|
|
- `group_vars/webservers.yml` - Web server group settings
|
|
- `group_vars/databases.yml` - Database group settings
|
|
|
|
### Host Variables
|
|
|
|
Add host-specific variables in:
|
|
- `host_vars/<hostname>.yml`
|
|
|
|
## Security
|
|
|
|
- All secrets must be encrypted using Ansible Vault
|
|
- Never commit plaintext credentials
|
|
- Use environment variables or external secret managers when possible
|
|
- Rotate credentials every 90 days
|
|
|
|
## Usage Examples
|
|
|
|
```bash
|
|
# Run against all production hosts
|
|
ansible-playbook -i inventories/production site.yml
|
|
|
|
# Run against specific group
|
|
ansible-playbook -i inventories/production site.yml --limit webservers
|
|
|
|
# Check mode (dry-run)
|
|
ansible-playbook -i inventories/production site.yml --check
|
|
|
|
# With specific tags
|
|
ansible-playbook -i inventories/production site.yml --tags security
|
|
```
|
|
|
|
## Validation
|
|
|
|
```bash
|
|
# Validate inventory syntax
|
|
ansible-inventory -i inventories/production --list
|
|
|
|
# Check specific host
|
|
ansible-inventory -i inventories/production --host hostname
|
|
|
|
# Graph inventory structure
|
|
ansible-inventory -i inventories/production --graph
|
|
```
|