# Introduction to Ansible Tower

## What You Will Learn

Red Hat® Ansible® Tower helps you scale IT automation, manage complex deployments and speed productivity. Centralize and control your IT infrastructure with a visual dashboard, role-based access control, job scheduling and graphical inventory management.

- What is Ansible Tower
- How Ansible Tower Works
- Installing Ansible Tower
- Key Features

This deck was designed to provide students with a general overview of how Ansible core knowledge can be transitioned into Ansible Tower.

This deck supports lecture and hands-on forms of presenting this material.

Allow 2 hours to deliver the lecture-based form and 4 hours for stopping to do the workshop assignments. To access the additional slides for delivering the workshops, navigate down when available.

See the Ansible Lightbulb facilitator’s guide for more details on using this deck and it’s associated material.

## What is Ansible Tower?

Ansible Tower is an enterprise framework for controlling, securing and managing your Ansible automation – with a UI and RESTful API

- Role-based access control keeps environments secure, and teams efficient
- Non-privileged users can safely deploy entire applications with push-button deployment access
- All Ansible automations are centrally logged, ensuring complete auditability and compliance

Red Hat Ansible Tower offers the control around Ansible automations in the form of RBAC, Job Scheduling, security abstraction from the user and API integrations with other systems.

In Ansible Tower, all Ansible job launches are tracked and logged centrally. What was changed and when it was changed can be viewed, exported to other logging capabilities and controlled within allowances of a user's access based on role.

</aisde>

Ansible Core brought you simple and powerful automation, Ansible Tower provides a visual interface to scale out that power. Run jobs against multiple inventories at the same time and schedule jobs to run when you want them too.

With Core, everyone has their own playbooks stored locally or in their own SCM tool. With Ansible Tower, everyone's playbooks can be centralized to one location. Control what teams can see what with RBAC to resources and projects.

Launch playbooks with the click of a button and see the expected results for that same job to compare and confirm the desired outcome.

## Platform Overview

## Installing Ansible Tower

    # the most common and preferred way of
    # installation for RHEL (Preferred) or Ubuntu
    $ wget https://bit.ly/ansibletower

    # bundled installer can be downloaded for
    # RHEL (and select derivatives) at
    $ wget https://bit.ly/ansibletowerbundle

    # looking for a specific version? navigate to http://releases.ansible.com/ansible-tower
    # to see all the versions available for download

Installation methods listed here are the most common used. Please note: Do not install Ansible Core via pip before installing Ansible Tower. Ansible Tower expects Ansible Core to be installed via package manager - and it will do this for you.

The standard installer can be used with normal internet access but if you are in a restricted network environment, the bundled installer will be your best choice. Please note that there the bundled installer currently only supports RHEL Based systems.

There are also Vagrant Images and AWS AMIs available. To find out more, visit ansible.com/tower-trial

## Server Requirements

- Red Hat Enterprise Linux (RHEL) 7 (and select derivatives), Ubuntu 14.04 64-bit, and Ubuntu 16.04 LTS 64-bit support required (kernel and runtime).
- A currently supported version of Mozilla Firefox or Google Chrome.
- 2 GB RAM minimum (4+ GB RAM highly recommended)
- 20 GB of dedicated hard disk space

Unlike Ansible Core, Ansible Tower cannot be installed locally on your laptop, it must be installed in a server environment.

Other HTML5 compliant web browsers may work but are not fully tested or supported.

10 GB of the 20 GB requirement must be dedicated to /var/, where Ansible Tower stores its files and working directories (dedicating less space will cause the installation to fail)

# Demo Time:
Installing Ansible Tower

Installing Ansible Tower is simple and quick. Go ahead and open up a terminal and connect to VM with an OS of your choice.

Start by downloading the latest bundled tower installer from https://bit.ly/ansibletowerbundle and unpack the tarball once it is done downloading.

Now that the package is unzipped, move into the directory and look for the inventory file. Here you will set all the necessary passwords needed for the install to take place.

You will need to set:

- admin_password
- pg_password
- rabbitmq_password

You are setting the admin password because the admin user account will be the only account at the beginning that can access your Ansible Tower instance.

You are setting the postgres password so that tower will have access to the database that is created

And you are setting rabbitmq password so that rabbitmq will be able to

# Workshop:
Installing Ansible Tower

See

    workshops/tower_install

in the Ansible Lightbulb repo.

It's solution and addition details can be found in `facilitator/solutions/tower_install.md`.

## Key Features of Ansible Tower

- Dashboard and User Interface
- User Base -- Organizations, Teams & Users
- Credentials
- Inventories
- Projects
- Job Templates & Jobs
- Role Based Access Control (RBAC)

We now have Ansible Tower installed on a VM, but before we can get started with automating in Ansible Tower, we need to learn how some of the key features of it work.

Listed are some of the key features that we are going to be discussing in the coming slides.

## Dashboard and User Interface

The Ansible Tower dashboard provides a heads-up NOC-style display and a friendly graphical framework for your IT orchestration needs. Across the top-left side of the Ansible Tower Dashboard, administrators can quickly navigate to their Projects, Inventories, Job Templates, and Jobs.

Across the top-right side of this interface, administrators can access the tools they need to configure organizations, users, groups, and permissions as well as view related documentation, access portal mode, and log out.

## User Base

A user is an account to access Ansible Tower and its services given the permissions granted to it.

An organization is a logical collection of users, teams, projects, inventories and more. All entities belong to an organization with the exception of users.

Teams provide a means to implement role-based access control schemes and delegate responsibilities across organizations.

Users are individuals and can be added to teams and or organizations. There are 3 types of users: Normal User, System Auditor and System Administrator.

A normal user has read write access limited to the resources they are able to access.

A system auditor implicitly inherit the read-only capability for all objects within the Ansible Tower environment.

A system administrator (also known as Superuser) has admin, read, and write privileges over the entire Ansible Tower installation. A System Administrator is typically responsible for managing all aspects of Ansible Tower and delegating responsibilities for day-to-day work to various Users.

An organization is is a logical collection of Users, Teams, Projects, and Inventories, and is the highest level in the Ansible Tower object hierarchy.

A Team is a subdivision of an organization with associated users, projects, credentials, and permissions. Teams provide a means to implement role-based access control schemes and delegate responsibilities across organizations.

The user-base plays an important part in implementing role-based access control schemes across your organization.

## Credentials

Credentials are utilized by Ansible Tower for authentication with various external resources:

- Connecting to remote machines to run jobs
- Syncing with inventory sources
- Importing project content from version control systems
- Connecting to and managing networking devices

Centralized management of various credentials allows end users to leverage a secret without ever exposing that secret to them.

Credentials are utilized by Ansible Tower for authentication when launching Jobs against machines, synchronizing with inventory sources, and importing project content from a version control system.

Ansible Tower credentials are imported and stored encrypted in Ansible Tower, and are not retrievable in plain text on the command line by any user.

You can grant users and teams the ability to use these credentials, without actually exposing the credential to the user.

If you have a user move to a different team or leave the organization, you don’t have to re-key all of your systems just because that credential was available in Ansible Tower.

## Inventory

Inventory is a collection of hosts (nodes) with associated data and groupings that Ansible Tower can connect to and manage.

- Hosts (nodes)
- Groups
- Inventory-specific data (variables)
- Static or dynamic sources

Inventory is a collection of the hosts (nodes) with associated metadata and groupings that Ansible can connect and manage. An inventory source can be static files or dynamically retrieved from an external system.

In Ansible Tower, there are many features that you can take advantage of in regards to inventory. Groups, all be them not new in the Ansible space, are now more easily manipulated and created. Groups can be nested and this allows for you to copy or move the group to a different group.

You also have the ability in Ansible Tower to setup a dynamic inventory within Ansible Tower. We will talk more in depth about dynamic inventories here in a few minutes.

## Projects

A Project is a logical collection of Ansible Playbooks, represented in Ansible Tower.

You can manage Playbooks and Playbook directories by placing them in a source code management system supported by Ansible Tower, including Git, Subversion, and Mercurial.

As a refresher from the core presentation, a Project is a logical collection of Ansible playbooks.

In Ansible Tower, you can manage playbooks and playbook directories by either placing them manually under the Project Base Path on your Ansible Tower server, or by placing your playbooks into a source code management (SCM) system supported by Ansible Tower, including Git, Subversion, and Mercurial.

Managing your projects with a SCM is recommended to ensure that only those with assigned access to the repository can change the playbook before execution, and for the extra layer of accountability and change control it provides.

Within Ansible Tower, there are a few new things that you can do with your projects.

- Update: If configured for a particular project, you can invoke an immediate update to source control.
- Schedule: If configured for a particular project , you can schedule an update from source control.
- Permissions: Any project can have permissions added to it so only a specific set of users or teams can access it.

## Job Templates

A job template is a definition and set of parameters for running an Ansible Playbook.
Job templates are useful to execute the same job many times and encourage the reuse of Ansible Playbook content and collaboration between teams.

While the REST API allows for the execution of jobs directly, Ansible Tower requires that you first create a job template.

To create a job template, there are some things that are required. You will need to have:

- Name
- Job Type
- Inventory
- Project
- Playbook
- Credentials (a machine credential is always required but depending on what you are running against, other credentials might be needed)
- Verbosity Level (A level 0 is always selected by default but depending on the kind of output that is needed, you can select a level all the way up to 5)

Those are required for a job template but their other options for you to cater each job template to your exact needs.

Due to time, we won't go to far into the weeds on some of the advanced configurations that you can do with Job Templates but there are some options that you can select to make life a little easier when running job templates.

Options such as Enable privilege escalation, enable provisioning callbacks and enable concurrent jobs.

- Enable Privilege Escalation: If enabled, run this playbook as an administrator. This is the equivalent of passing the --become option to the ansible-playbook command.
- Allow Provisioning Callbacks: Enable a host to call back to Ansible Tower via the Ansible Tower API and invoke the launch of a job from this job template.
- Allow Provisioning Callbacks: Enable a host to call back to Ansible Tower via the Ansible Tower API and invoke the launch of a job from this job template.

## Jobs

A job is an instance of Ansible Tower launching an Ansible Playbook against an inventory of hosts.

- Job results can be easily viewed
- View the standard out for a more in-depth look

The Jobs link displays a list of jobs and their status, shown as completed successfully or failed, or as an active (running) job.

Actions you can take against jobs include viewing the details and standard output of a particular job, relaunch jobs, or remove jobs.

Clicking on any type of job takes you to the Job Details View for that job, which consists of two sections:

- Details: provides information and status about the job
- Standard Out: displays the job processes and output

## Role Based Access Control (RBAC)

Role-Based Access Controls (RBAC) are built into Ansible Tower and allow administrators to delegate access to server inventories, organizations, and more. These controls allow Ansible Tower to help you increase security and streamline management of your Ansible automation.

RBAC is at the core of how Ansible Tower scales organizations while increasing the security of automating.

By delegating access to resources within tower, you are removing an element of human error. Users can only view what they are permitted to see and can only run jobs against inventories that they are permitted to act against.

(increase security)

Streamline management

## Role Based Access Control (RBAC)

Roles can be granted to individual users, teams and as well as to organizations.

Roles control access to projects, inventories and job templates in the form of permissions.

Tower security centers around role based access for users and teams.

Security can be applied granularly to Credentials, Inventories, Projects, Job Templates and API Access based on the user or team role.

# Demo Time:
Ansible Tower Basic Setup
& Job Run

Installing Ansible Tower is simple and quick. Go ahead and open up a terminal and connect to VM with an OS of your choice..

# Workshop:
Ansible Tower Basic Setup
& Your First Job Run

See

    workshops/tower_basic_setup

in the Ansible Lightbulb repo.

## Dynamic Inventory in Ansible Tower

Dynamic inventory is a script that queries a service, like a cloud provider API or a management application. This data is formatted in an Ansible-specific JSON data structure and is used in lieu of static inventory files.

- Groups are generated based on host metadata
- Single source of truth saves time, avoids duplication and reduces human error
- Dynamic and static inventory sources can be used together

Ansible can take inventory from a wide variety of sources on-the-fly. It can draw from many different systems such as VMWare, Openstack, Amazon EC2, Digital Ocean, and other provisioning systems like Cobbler. You can also create your own inventory module to interface with any proprietary or in-house CMDB systems.

Ideally, the source of data for our dynamic inventory scripts is 100% correct, and is automatically updated as infrastructure changes. This is especially useful in environments where machines are coming on and offline all the time, like a cloud or virtual environment.

# Demo:
Ansible Tower Dynamic Inventory

Setup a cloud credential in Ansible Tower to (presumably) AWS EC2 and then manually trigger an inventory update. Show the inventory in the Ansible Tower UI. Note how it generated groups and job templates can be setup to run inventory updates before executing.

Alternatively you can open a terminal window and use Ansible core to demonstrate dynamic inventory at work. Assuming you have your local credentials setup, run the inventory script and pipe it to less. Then run an ad-hoc ping command using `-i` switch to call your dynamic inventory.

## More with Ansible Tower

- Job Status Updates
- Activity Stream
- Integrated Notifications
- Schedule Jobs
- Manage and Track Your Inventory
- Self Service IT (User Surveys)
- Remote Command Execution
- External Logging
- Multi-Playbook Workflows

What we've shown you so far are only the basics of what Ansible Tower can do to scale the automation activity in your organization. Here are some other features that have been added to Tower.

You can navigate down into slides with more detail on each or return to these at a later date when you the time.

## Job Status Update

Heads-up NOC-style automation dashboard displays everything going on in your Ansible environment.

## Activity Stream

Securely stores every Job that runs, and enables you to view them later, or export details through Ansible Tower’s API.

## Integrated Notifications

Stay informed of your automation status via integrated notifications. Connect Slack, Hipchat, SMS, email and more.

## Schedule Jobs

Enables you to any Job now, later, or forever.

## Manage and Track Your Inventory

Ansible Tower’s inventory syncing and provisioning callbacks allow nodes to request configuration on demand, enabling auto-scaling.

## Self Service IT

Ansible Tower lets you launch Playbooks with just a single click. It can prompt you for variables, let you choose from available secure credentials and monitor the resulting deployments.

## Remote Command Execution

Run simple tasks on any hosts with Ansible Tower's remote command execution. Add users or groups, reset passwords, restart a malfunctioning service or patch a critical security issue, quickly.

## External Logging

Connect Ansible Tower to your external logging and analytics provider to perform analysis of automation and event correlation across your entire environment.

## Multi-Playbook Workflows

Ansible Tower’s multi-Playbook workflows chains any number of Playbooks together to create a single workflow. Different Jobs can be run depending on success or failure of the prior Playbook.

## Next Steps

- It’s easy to get started
  ansible.com/get-started
- Try Ansible Tower for free:
  ansible.com/tower-trial
- Would you like to learn a lot more?
  redhat.com/en/services/training/do409-automation-ansible-ii-ansible-tower