Dynamic Inventory #

# Install dependency
ansible-galaxy collection install amazon.aws
pip install boto3

# inventory/aws_ec2.yml
# Nama file HARUS diakhiri dengan aws_ec2.yml atau aws_ec2.yaml

plugin: amazon.aws.aws_ec2

# Region yang akan di-scan
regions:
  - ap-southeast-1      # Singapura
  - ap-southeast-3      # Jakarta
  - us-east-1           # Virginia

# Filter instance yang akan diambil
filters:
  instance-state-name: running
  "tag:Environment": production

# Field yang digunakan sebagai hostname Ansible
hostnames:
  - private-ip-address

# Group otomatis berdasarkan tag
keyed_groups:
  - prefix: role
    key: tags.Role          # Group: role_webserver, role_database, dll.
  - prefix: env
    key: tags.Environment   # Group: env_production, env_staging
  - prefix: az
    key: placement.availability_zone

# Group berdasarkan kondisi custom
groups:
  singapore: "'ap-southeast-1' in placement.region"
  jakarta: "'ap-southeast-3' in placement.region"
  high_memory: "instance_type.startswith('r5') or instance_type.startswith('r6')"

# Map field AWS ke variabel Ansible
compose:
  ansible_host: private_ip_address
  ansible_user: "'ec2-user' if 'Windows' not in image_id else 'Administrator'"
  instance_type: instance_type
  availability_zone: placement.availability_zone
  vpc_id: vpc_id

# Variable untuk semua host
groups:
  aws_production:
    vars:
      ansible_ssh_private_key_file: /opt/keys/aws-prod.pem

# Test inventory sebelum digunakan
ansible-inventory -i inventory/aws_ec2.yml --list
ansible-inventory -i inventory/aws_ec2.yml --graph

# Output --graph:
# @all:
#   |--@aws_production:
#   |   |--@env_production:
#   |   |   |--@ap_southeast_1:
#   |   |   |   |--ip-10-0-1-10.ap-southeast-1.compute.internal
#   |   |   |   |--ip-10-0-1-11.ap-southeast-1.compute.internal
#   |   |   |--@ap_southeast_3:
#   |   |   |   |--ip-10-0-2-5.ap-southeast-3.compute.internal
#   |   |--@role_webserver:
#   |   |   |--ip-10-0-1-10.ap-southeast-1.compute.internal

# Gunakan dalam playbook
ansible-playbook -i inventory/aws_ec2.yml site.yml

# inventory/gcp_compute.yml
plugin: google.cloud.gcp_compute

projects:
  - my-production-project
  - my-shared-services-project

zones:
  - asia-southeast2-a    # Jakarta
  - asia-southeast2-b
  - asia-southeast2-c

# Filter instance — pakai sintaks JMESPath GCP
filters:
  - status = RUNNING
  - labels.environment = production
  - labels.managed_by = ansible

# Group otomatis
keyed_groups:
  - prefix: role
    key: labels.role
  - prefix: zone
    key: zone
  - prefix: env
    key: labels.environment

# Map field GCP ke variabel Ansible
compose:
  ansible_host: networkInterfaces[0].networkIP
  ansible_user: "'ubuntu' if 'debian' in labels.base_os else 'centos'"
  machine_type: machineType
  project: project

# inventory/azure_rm.yml
plugin: azure.azcollection.azure_rm

include_vm_resource_groups:
  - production-rg
  - staging-rg

# Filter
filters:
  - power_state == 'running'
  - tags.environment == 'production'

# Group
keyed_groups:
  - prefix: role
    key: tags.role
  - prefix: env
    key: tags.environment

# Compose
compose:
  ansible_host: properties.networkProfile.networkInterfaces[0].properties.ipConfigurations[0].properties.privateIPAddress

# ansible.cfg
[inventory]
cache = true
cache_plugin = jsonfile
cache_connection = /tmp/ansible_inventory_cache
cache_timeout = 300   # Cache berlaku 5 menit

#!/usr/bin/env python3
# inventory/cmdb_inventory.py
# Ambil inventory dari CMDB internal perusahaan

import json
import sys
import argparse
import os

try:
    import requests
except ImportError:
    print(json.dumps({"_meta": {"hostvars": {}}}))
    sys.exit(0)

CMDB_URL = os.environ.get(
    'CMDB_URL', 'https://cmdb.company.internal/api'
)
CMDB_TOKEN = os.environ.get('CMDB_API_TOKEN', '')


def get_inventory():
    """Ambil semua server dari CMDB dan kelompokkan."""
    if not CMDB_TOKEN:
        sys.stderr.write(
            "ERROR: Environment variable CMDB_API_TOKEN belum di-set.\n"
        )
        return {"_meta": {"hostvars": {}}}

    headers = {"Authorization": f"Bearer {CMDB_TOKEN}"}

    try:
        response = requests.get(
            f"{CMDB_URL}/servers",
            params={"status": "active"},
            headers=headers,
            timeout=15
        )
        response.raise_for_status()
        servers = response.json()
    except requests.exceptions.RequestException as e:
        sys.stderr.write(f"Error mengambil inventory dari CMDB: {e}\n")
        return {"_meta": {"hostvars": {}}}

    inventory = {
        "_meta": {"hostvars": {}},
        "all": {"children": []},
    }

    for server in servers:
        hostname = server["hostname"]
        env = server.get("environment", "unknown")
        role = server.get("role", "unknown")
        datacenter = server.get("datacenter", "unknown")

        # Host variables
        inventory["_meta"]["hostvars"][hostname] = {
            "ansible_host": server.get("ip_address", hostname),
            "server_id": server.get("id"),
            "datacenter": datacenter,
            "os": server.get("os"),
            "ansible_user": "ubuntu" if "ubuntu" in server.get("os", "") else "centos",
        }

        # Group by environment
        env_group = f"env_{env}"
        if env_group not in inventory:
            inventory[env_group] = {
                "hosts": [],
                "vars": {"env": env},
            }
            inventory["all"]["children"].append(env_group)
        inventory[env_group]["hosts"].append(hostname)

        # Group by role
        role_group = f"role_{role}"
        if role_group not in inventory:
            inventory[role_group] = {"hosts": []}
            inventory["all"]["children"].append(role_group)
        inventory[role_group]["hosts"].append(hostname)

        # Group by datacenter
        dc_group = f"dc_{datacenter}"
        if dc_group not in inventory:
            inventory[dc_group] = {"hosts": []}
            inventory["all"]["children"].append(dc_group)
        inventory[dc_group]["hosts"].append(hostname)

    return inventory


def get_host(hostname):
    """Ambil variabel untuk satu host."""
    headers = {"Authorization": f"Bearer {CMDB_TOKEN}"}
    try:
        response = requests.get(
            f"{CMDB_URL}/servers/{hostname}",
            headers=headers,
            timeout=10
        )
        response.raise_for_status()
        server = response.json()
        return {
            "ansible_host": server.get("ip_address", hostname),
            "server_id": server.get("id"),
            "datacenter": server.get("datacenter"),
            "os": server.get("os"),
        }
    except requests.exceptions.RequestException:
        return {}


def main():
    parser = argparse.ArgumentParser(description='CMDB Inventory Script')
    parser.add_argument('--list', action='store_true',
                        help='Tampilkan semua inventory')
    parser.add_argument('--host', type=str,
                        help='Tampilkan variabel untuk host tertentu')
    args = parser.parse_args()

    if args.list:
        print(json.dumps(get_inventory(), indent=2))
    elif args.host:
        print(json.dumps(get_host(args.host), indent=2))
    else:
        print(json.dumps({}))


if __name__ == '__main__':
    main()

# Beri permission executable
chmod +x inventory/cmdb_inventory.py

# Test manual
./inventory/cmdb_inventory.py --list
./inventory/cmdb_inventory.py --host web-01.company.com

# Gunakan dalam playbook
ansible-playbook -i inventory/cmdb_inventory.py site.yml

# ANTI-PATTERN: ambil semua host, biarkan playbook filter
def get_inventory():
    response = requests.get(f"{CMDB_URL}/servers")  # 5000 host!
    servers = response.json()
    inventory = {"_meta": {"hostvars": {}}, "all": {"hosts": []}}
    for s in servers:
        inventory["all"]["hosts"].append(s["hostname"])
    return inventory

# BENAR: filter di source, expose hanya host yang relevan
def get_inventory():
    params = {"status": "active", "managed_by": "ansible"}
    response = requests.get(f"{CMDB_URL}/servers", params=params)
    servers = response.json()
    # ... build inventory dengan group yang bermakna
    return inventory

# Pemakaian: gunakan --limit untuk filter tambahan
ansible-playbook -i inventory/cmdb_inventory.py site.yml --limit env_production

# ANTI-PATTERN: hard-code host di playbook
- name: "Deploy web app"
  hosts: web-01.company.com,web-02.company.com,web-03.company.com
  tasks: [...]

# BENAR: pakai group dari dynamic inventory
- name: "Deploy web app"
  hosts: role_webserver
  tasks: [...]

# Ansible otomatis gabungkan semua sumber
ansible-playbook -i inventory/ site.yml

# Lihat inventory gabungan
ansible-inventory -i inventory/ --graph

# Output:
# @all:
#   |--@env_production:
#   |   |--@role_database:
#   |   |   |--db-01.aws.internal
#   |   |   |--db-gcp-01.c.internal
#   |   |   |--db-onprem.cmp.internal
#   |   |--@role_webserver:
#   |   |   |--web-01.aws.internal
#   |   |   |--web-02.aws.internal

# ansible.cfg
[inventory]
cache = true
cache_plugin = jsonfile
cache_connection = /tmp/ansible_inventory_cache
cache_timeout = 300   # Cache berlaku 5 menit

# Optional: cache hanya untuk plugin tertentu
cache_plugin_omit = ['hostfile']  # Skip caching untuk static file

# Refresh cache manual saat diperlukan
ansible-inventory -i inventory/ --list --flush-cache

# Lihat isi cache
ls -la /tmp/ansible_inventory_cache/
cat /tmp/ansible_inventory_cache/aws_ec2_*.json | python -m json.tool | head -30

# inventory/aws_production.yml
plugin: amazon.aws.aws_ec2
regions:
  - ap-southeast-1
  - ap-southeast-3
  - us-east-1
filters:
  instance-state-name: running
  "tag:Environment": production
  "tag:ManagedBy": ansible
keyed_groups:
  - prefix: role
    key: tags.Role
  - prefix: env
    key: tags.Environment
  - prefix: account
    key: tags.Account
compose:
  ansible_host: private_ip_address
  aws_account_id: tags.Account

# inventory/aws_staging.yml
plugin: amazon.aws.aws_ec2
regions:
  - ap-southeast-1
filters:
  instance-state-name: running
  "tag:Environment": staging
keyed_groups:
  - prefix: role
    key: tags.Role
groups:
  staging: true

# Pilih environment dengan -i
ansible-playbook -i inventory/aws_production.yml site.yml   # Production
ansible-playbook -i inventory/aws_staging.yml site.yml      # Staging

ansible-playbook -i inventory/ site.yml --limit env_production
ansible-playbook -i inventory/ site.yml --limit env_staging

# inventory/k8s.yml
plugin: kubernetes.core.k8s

connections:
  - kubeconfig: ~/.kube/config
    name: production-cluster

# Ambil node dari cluster
# Filter berdasarkan label

# Lihat inventory sebagai JSON
ansible-inventory -i inventory/aws_ec2.yml --list | jq 'keys'

# Lihat host di group tertentu
ansible-inventory -i inventory/aws_ec2.yml --list | \
  jq '._meta.hostvars | keys'

# Lihat host di group env_production
ansible-inventory -i inventory/aws_ec2.yml --list | \
  jq '.env_production.hosts'

# Lihat variable untuk satu host
ansible-inventory -i inventory/aws_ec2.yml --host web-01.internal

# Test koneksi ke semua host di group
ansible all -i inventory/aws_ec2.yml -m ping --limit env_production

# Dry-run playbook (--check) untuk validasi tanpa eksekusi
ansible-playbook -i inventory/aws_ec2.yml site.yml --check --diff

# Simpan inventory ke file untuk inspeksi offline
ansible-inventory -i inventory/aws_ec2.yml --list > /tmp/inv_dump.json

# Bandingkan inventory antara dua waktu
diff <(jq -S . /tmp/inv_dump.json) <(ansible-inventory -i inventory/aws_ec2.yml --list | jq -S .)