Don’t believe sites telling you it’s hard to install Dotnet core on a Raspberry Pi 4 – it isn’t and hopefully I haven’t tempted fate by showing how simple it is 🙂
pi@raspberrypi:~ $ lsb_release -a
No LSB modules are available.
Distributor ID: Raspbian
Description: Raspbian GNU/Linux 10.3 (buster)
Release: 10.3
Codename: buster
pi@raspberrypi:~ $ bash dotnet-install.sh
dotnet_install: Warning: Unable to locate zlib. Probable prerequisite missing; install zlib.
dotnet-install: Downloading link: https://dotnetcli.azureedge.net/dotnet/Sdk/3.1.201/dotnet-sdk-3.1.201-linux-arm.tar.gz
dotnet-install: Extracting zip from https://dotnetcli.azureedge.net/dotnet/Sdk/3.1.201/dotnet-sdk-3.1.201-linux-arm.tar.gz
dotnet-install: Adding to current process PATH: `/home/pi/.dotnet`. Note: This change will be visible only when sourcing script.
dotnet-install: Installation finished successfully.
Then it’s just a simple case of adding /home/pi/.dotnet to your system PATH variable.
pi@raspberrypi:~ $ dotnet --version
3.1.201
Wondering about the missing pre-requisite for zlib – so was I. The installer is looking for zlib via a ldconfig command. It seems package zlib1g-dev installs it as libz so the check fails. I’ll update this post if I run into any actual problems.
Always fun to strike problems in what should be the simplest things. I wanted to add Ansible Tower as a service into ManageIQ. Cloudforms would have a similar result.
So, what is a person to do? Hit the google. Eventually I came across this bugzilla item https://bugzilla.redhat.com/show_bug.cgi?id=1740860 and it gave a hint as to just specifying the /api/v2 in the URL I gave to ManageIQ rather than just the base hostname. eg. https://blah…./api/v2
Tried it, it worked! My credential validated and a provider refresh was automatically initiated and all my Ansible Tower templates and inventories were discovered correctly.
So yes, that is quite a specific title for a blog post. The path leading to it wasn’t as succinct, but it was an enjoyable journey.
Firstly, VMware provides a fine Powercli container built on top of Photon OS , but being me I thought Hey I wonder if I can get the same thing with a Red Hat Universal Base Image (UBI)? And so, my journey began.
I decided i’d use the VMware Dockerfile as the starting point, but I want to build it using buildah and run it using podman – because I’d like to know (you can see a pattern here) .
The original Dockerfile is accessible here, or here’s a local copy.
I’ve made a few changes, some cosmetic due to the way I like to layout my docker file, but the outcome is similar. My Dockerfile is below or you can find it over at my github account. Using the default RHEL7 UBI (sadly Microsoft don’t have powershell for RHEL8 as yet) I was able to build the image at around 567 Mb, whereas the Photon OS image is around 362 Mb. Not a bad result given how little effort (none) i’ve put into making it as small as possible.
As you can see in the Dockerfile, i’m simply installing powershell from the microsoft repository on top of the RHEL7 UBI image and then (via powershell) installed the PowerCLI, PowerNSX and PowervRA modules from the upstream powershell gallery.
Building it with buildah is trivial.
buildah build-using-dockerfile -t rcli .
And to run it via podman (trivial example)
[gocallag@orac8 rhel7]$ podman run -it rcli pwsh
PowerShell 6.2.3
Copyright (c) Microsoft Corporation. All rights reserved.
https://aka.ms/pscore6-docs
Type 'help' to get help.
PS /root> Get-VM # plus a couple of tabs to force auto-completion of the command
Get-VM Get-VmfsDatastoreInfo Get-VMHostPatch
Get-VMByToolsInfo Get-VMGuest Get-VMHostPciDevice
Get-VMCCommand Get-VMHost Get-VMHostProfile
Get-VMCEdge Get-VMHostAccount Get-VMHostProfileImageCacheConfiguration
Get-VMCEdgeNic Get-VMHostAdvancedConfiguration Get-VMHostProfileRequiredInput
Get-VMCEdgeNicStat Get-VMHostAttributes Get-VMHostProfileStorageDeviceConfiguration
Get-VMCEdgeStatus Get-VMHostAuthentication Get-VMHostProfileUserConfiguration
Get-VMCEdgeUplinkStat Get-VMHostAvailableTimeZone Get-VMHostProfileVmPortGroupConfiguration
Get-VMCFirewallRule Get-VMHostBirthday Get-VMHostRoute
Get-VMCLogicalNetwork Get-VMHostDiagnosticPartition Get-VMHostService
Get-VMCOrg Get-VMHostDisk Get-VMHostSnmp
Get-VMCPSettings Get-VMHostDiskPartition Get-VMHostStartPolicy
Get-VMCSDDC Get-VMHostFirewallDefaultPolicy Get-VMHostStorage
Get-VMCSDDCCluster Get-VMHostFirewallException Get-VMHostSysLogServer
Get-VMCSDDCDefaultCredential Get-VMHostFirmware Get-VMmaxIOPS
Get-VmcSddcNetworkService Get-VMHostFirmwareVersion Get-VMQuestion
Get-VMCSDDCPublicIP Get-VMHostHardware Get-VMResourceConfiguration
Get-VMCSDDCVersion Get-VMHostHba Get-VMStartPolicy
Get-VmcService Get-VMHostImageProfile Get-VMToolsGuestInfo
Get-VMCTask Get-VMHostMatchingRules Get-VMToolsInfo
Get-VMCVMHost Get-VMHostModule Get-VMToolsInstallLastError
Get-VMEncryptionInfo Get-VMHostNetwork Get-VMToolsUpgradePolicy
Get-VMEvcMode Get-VMHostNetworkAdapter
Get-VmfsDatastoreIncrease Get-VMHostNtpServer
You’re likely,possibly, most likely not wondering if I have anything planned for this container. The answer is yes, but it will be the subject of later posts. I’m a big fan of the ability to run Powercli via powershell on linux, and doing it via a container is a very neat packaging solution. Sure, i’ve could’ve used the VMware container (kudos to them for creating it), but I now know more than I did this morning and that’s the result I was aiming for.
The section ‘Authenticating with Azure‘ sounds like the right place, but you can’t use your AD username / password from Ansible because you turned on 2FA – You turned it on RIGHT? So the option left to you is to create a Service Principal (SP).
Note: having 2FA on your account is what you should be doing, so don’t turn it off.
It’s quite simple to create a credential for Ansible to use when connecting to Azure. Simply, fire up the Cloud Shell (awesome feature BTW Microsoft) and create a Service Principal (SP).
But Hang On, what is a Service Principal? The Ansible guide refers you to the Azure documentation over at https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal which you will read, and if you’re like me, you’ll wonder what you actually just read. Have no fear. As I mentioned above you can use a simple Azure CLI command (via the Cloud Shell you just started) and create the Service Principal. Think of the Service Principal as a credential an application (in this case Ansible) can use to access the Azure service(s).
geoff@Azure:~$ az ad sp create-for-rbac --name svc-ansible-azure # (optional if not specified one will be generated) --password 'ALovelyComplexPasswor@'
Changing "svc-ansible-azure" to a valid URI of "http://svc-ansible-azure", which is the required format used for service principal names
Creating a role assignment under the scope of "/subscriptions/88888888-4444-4444-4444-cccccccccccc"
Retrying role assignment creation: 1/36
Retrying role assignment creation: 2/36
{
"appId": "appid888-4444-4444-4444-cccccccccccc",
"displayName": "svc-ansible-azure",
"name": "http://svc-ansible-azure",
"password": "password-4444-4444-4444-cccccccccccc",
"tenant": "tenant88-4444-4444-4444-cccccccccccc"
}
geoff@Azure:~$
If you want to see what that command just did in the Azure portal, head over to the Azure Active Directory -> App registrations blade.
and then you can see the Service Principal you just created.
So what do you do with the new credential.
The Ansible Azure scenario guide has a section on what to do, however, it’s a bit too vague for me.
Using Environment Variables
To pass service principal credentials via the environment, define the following variables:
For your sanity, AZURE_CLIENT_ID ==> appId AZURE_SECRET ==> password AZURE_TENANT ==> tenant
The remaining item, AZURE_SUBSCRIPTION_ID is exactly that, you can also get from the Cloud Shell as follows
geoff@Azure:~$ az account list
[
{
"cloudName": "AzureCloud",
"id": "subscrip-4444-4444-4444-cccccccccccc
"isDefault": true,
.
.
.
In this case AZURE_SUBSCRIPTION_ID ==> id , whichever id in your account that is valid for your use case.
If you want to add these credentials into Ansible Tower, simply create a Credential of type Microsoft Azure Resource Manager and use the values you’ve deduced above. Ansible Tower will automatically translate them into Environment Variables for your Tower template execution.
vmware_tools is a relatively new addition to the ansible family and allows you to execute commands, transfer files to vSphere based systems without using the VM network.
Most Ansible developers will have also used connection type local in many of their playbooks, probably without realizing that it was a different connection type.
Ansible is also extensible. If you need to connect to something weird and wacky (but of great importance to you) then you can develop your own modules and connection plugin (or other sorts of plugins) – see https://docs.ansible.com/ansible/latest/plugins/plugins.html
Ansible versatility doesn’t end there though and many newcomers to ansible don’t realise that you can also manage multiple clouds, container platforms and virtualisation platforms – it’s the Swiss Army knife of IT automation.
It’s been one of those weeks and I needed to get some more experience with the ansible ServiceNOW modules, specifically within Ansible Tower. It looked pretty simple and in fact it really was quite simple.
Ansible Tower neatly stores credentials within it – or externally if that fills you with joy. There isn’t a ServiceNow credential type in Ansible Tower. Undeterred, I thought I would use machine credentials, but tower has an annoying behavior of only allowing 1 instance of each credential type attached to a tower template and I am already using machine credentials in my template.
Fortunately on the left hand side of the tower ui there’s an entry labelled credential types
When creating the credential type you need to supply two (2) pieces of information. The first piece is called the Input configuration – or what the fields look like on the web ui when you create a credential of this type and secondly, the Injector configuration which details what do do with thew credentials.
In my case, the new credential type is called SNOW and i’m providing the instance name, username and password as part of the structure for this credential – via the Input configuration and then I detail that I want to store this data in environment variables that will be accessible from my playbook when run in tower.
I was rebuilding some Lab ESXi physical hosts, but also thought i’d upgrade my ‘builder’ system to Centos 8. My builder system uses a bunch of Ansible playbooks to create the necessary DHCP, TFTP etc configuration to support PXE booting multiple OS types – including ESXi 6.5/6.7.
I started with test builds of Centos 7/8 using my now Centos 8 build server and it was all fine.
However….. when I tried to build ESXi 6.5+ the TFTP delivered the ESXi mboot.c32 file to the host (via syslinux 6.04 which is new to Centos 8) but it couldn’t be loaded. After several hours of frustration I tried downgrading to the syslinux 3.86 version mentioned in https://www.vmware.com/techpapers/2015/installing-vmware-esxi-6.0-using-pxe-10508.html . Sadly you can’t install that version on Centos 8 without considerable grief.
I was able to install syslinux 4.05 on Centos 8 and lo and behold the build process works. Clearly something in syslinux 6 doesn’t like PXE booting ESXi. I’m not sure what yet, but hopefully this blog post at least gives people a workaround to a frustrating problem.
There are many times when you run an Ansible playbook through Ansible Tower and you have to become a privileged user on the target system. This is business as usual for Ansible and Ansible Tower.
This is normally achieved by specifying become as part of your playbook, such as this snippet.
---
- name: Patch Linux
hosts: all
gather_facts: true
become: true
Typically, as part of a patching playbook, you would reboot the system and wait for the reboot to finish using a code fragment like this :
- name: Wait for server to restart
local_action:
module: wait_for
host={{ ansible_ssh_host }}
port=22
delay=60
timeout=300
This local_action inherits the become: true from the parent definition and this is where Tower starts to complain. Remember, with Ansible Tower, it’s the tower server itself where the local_action will run. You can expect to see something like this :
"module_stderr": "sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?\n",
No, you SHOULD NOT enable the awx user to use sudo on the Tower system as the AWX service user is intentionally restricted from sudo operations. The best approach is to de-privilege the local_action. Fortunately, local_action has it’s own become capability so you can turn off the request for privileged access as you don’t need it.
The above code block is now :
- name: Wait for server to restart
become: false
local_action:
module: wait_for
host={{ ansible_ssh_host }}
port=22
delay=60
timeout=300
and the tower job template will execute without any errors.
