003 Audit iocage host

Use case 

Use the role vbotka.freebsd.iocage to audit the iocage configuration.

Tree 

shell> tree
.
├── ansible.cfg
├── host_vars
│   ├── iocage_02
│   │   └── iocage.yml
│   ├── iocage_04
│   │   └── iocage.yml
│   └── iocage_06
│       └── iocage.yml
├── iocage.ini
└── pb-iocage.yml

Synopsis 

On a managed node, use the playbook pb-iocage.yml and the role vbotka.freebsd.iocage to:
- Audit the iocage configuration

Requirements 

Role vbotka.freebsd.iocage
Root privileges on the managed nodes
The iocage binary

Notes 

Pass -l iocage_0X on the command line to run the play on the managed node iocage_0X.
Remove the limit -l iocage_0* to run the play on all managed nodes.
By default, sanity testing is enabled: freebsd_iocage_sanity: true.

ansible.cfg 

[defaults]
callback_result_format = yaml
deprecation_warnings = False
display_skipped_hosts = False
gathering = explicit
interpreter_python = auto_silent
log_path = /var/log/ansible.log

[connection]
pipelining = true

Inventory iocage.ini 

iocage_02 ansible_host=10.1.0.73
iocage_04 ansible_host=10.1.0.29
iocage_06

[iocage]
iocage_02
iocage_04
iocage_06

[iocage:vars]
ansible_user=admin
ansible_become=true
ansible_python_interpreter=auto_silent

host_vars 

host_vars/iocage_02/iocage.yml

freebsd_iocage_pool: zroot
freebsd_iocage_pool_mount: /zroot

freebsd_iocage_sanity_zfs_pool_active: true

host_vars/iocage_04/iocage.yml

freebsd_iocage_pool: iocage
freebsd_iocage_pool_mount: /iocage

freebsd_iocage_sanity_zfs_pool_active: true

host_vars/iocage_06/iocage.yml

freebsd_iocage_pool: zroot
freebsd_iocage_pool_mount: /zroot

freebsd_iocage_sanity_zfs_pool_active: true

Note

By default, activation testing is disabled:

freebsd_iocage_sanity_zfs_pool_active: false

Playbook pb-iocage.yml 

- hosts: iocage
  gather_facts: true

  roles:
    - vbotka.freebsd.iocage

Playbook output - Test sanity 

(env) > ansible-playbook -i iocage.ini -l iocage_06 \
                         -t freebsd_iocage_sanity \
                         pb-iocage.yml

PLAY [iocage] ******************************************************************

TASK [Gathering Facts] *********************************************************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: Service start, restart, and stop are mutually exclusive] ***
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: Get environment.] ************************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: Environment LANG = en_US.UTF-8] **********
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: Environment LC_COLLATE = C] **************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: Get mounts] ******************************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: /dev/fd mounted to fdescfs] **************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: Get sysctl kern.conftxt] *****************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: Mandatory kernel options VIMAGE, RACCT, and RCTL.] ***
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: Read /boot/loader.conf] ******************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: kern.racct.enable = 1] *******************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: Get sysctl security.jail.jailed] *********
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: Not in jail.] ****************************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: Get ZFS pools.] **************************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: ZFS pool exists.] ************************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: Get ZFS datasets.] ***********************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage : Sanity: ZFS pool activated.] *********************
ok: [iocage_06]

PLAY RECAP *********************************************************************
iocage_06                  : ok=17   changed=0    unreachable=0    failed=0    skipped=9    rescued=0    ignored=0   

Playbook output - Test sanity quietly 

(env) > ANSIBLE_DISPLAY_OK_HOSTS=false \
        ANSIBLE_DISPLAY_SKIPPED_HOSTS=false \
        ansible-playbook -i iocage.ini -l iocage_06 \
                         -t freebsd_iocage_sanity \
                         pb-iocage.yml

PLAY [iocage] ******************************************************************

PLAY RECAP *********************************************************************
iocage_06                  : ok=17   changed=0    unreachable=0    failed=0    skipped=9    rescued=0    ignored=0   