http://localhost:8080/ansible_f5/index.html Description In this workshop you will execute Ansible playbooks from a Gitlab CI/CD pipeline to configure a virtual F5 appliance. You will load content and container images into Gitlab repositories that will be used to create a custom Ansible container image. That container image will then be used to configure the F5. Gitlab will utilize a RHEL 9 VM configured with Podman for the Gitlab runner. The runner will execute all jobs in the pipeline using containers. Hugo en-us Wed, 27 Mar 2024 10:40:21 -0400 http://localhost:8080/ansible_f5/0.env/index.html Wed, 27 Mar 2024 10:40:21 -0400 http://localhost:8080/ansible_f5/0.env/index.html Following is a diagram of the workshop environment: http://localhost:8080/ansible_f5/1.setup/index.html Wed, 27 Mar 2024 10:40:21 -0400 http://localhost:8080/ansible_f5/1.setup/index.html In this lab we’ll get connected to the lab environment and walk through the premise for the workshop. This is typically the hardest part of the workshop, if we can make it through this then it’s all smooth sailing! How it works The lab is in a private enclave which is not directly accessible over the internet. Workshop attendees can connect to specific services using a secure proxy with access controlled by Azure Active Directory. http://localhost:8080/ansible_f5/2.populate/index.html Wed, 27 Mar 2024 10:40:21 -0400 http://localhost:8080/ansible_f5/2.populate/index.html In this section we will user a Gitlab CI/CD pipeline to add content to the Gitlab container registry and package registry. Browse back to the repository. Select Code then Repository. Select the .gitlab-ci.yml file to view the contents. Select Code and Branches. Select New branch. Enter registry in the Branch name field and select the Create branch button. This branch name matches the value of the $CI_COMMIT_BRANCH variable in the CI/CD pipeline. http://localhost:8080/ansible_f5/3.container/index.html Wed, 27 Mar 2024 10:40:21 -0400 http://localhost:8080/ansible_f5/3.container/index.html In this section we are going to build a custom ansible container image using a Dockerfile and store the image in our container registry so that the CI/CD pipeline can use it for future runs as we expand our pipeline. Select Code then Repository. Select the .gitlab-ci.yml file. Select the blue Edit selection list and then choose Edit single file. In the stages section, add a new stage called container so that it looks like the following: http://localhost:8080/ansible_f5/4.test/index.html Wed, 27 Mar 2024 10:40:21 -0400 http://localhost:8080/ansible_f5/4.test/index.html Head back to the .gitlab-ci.yml file and edit the file again. This time add two new stages, one called info and one called test so that the stages section looks like the following: stages: - registry - container - info - test Immediately following the stages section add the following to include some pre-built Gitlab testing tools: include: - template: Security/SAST.gitlab-ci.yml - template: Jobs/SAST-IaC.gitlab-ci.yml - template: Security/Secret-Detection.gitlab-ci.yml sast: tags: - ansible_f5 kics-iac-sast: tags: - ansible_f5 secret_detection: tags: - ansible_f5 http://localhost:8080/ansible_f5/5.security/index.html Wed, 27 Mar 2024 10:40:21 -0400 http://localhost:8080/ansible_f5/5.security/index.html Select Build and Pipelines to see the running pipeline. Select the latest pipeline to view the new stages. Select the different jobs in the test stage to view the results. After the jobs complete you can see the results by selecting Secure and then Vulnerability report. You can drill into the different items to see the vulnerabilities. http://localhost:8080/ansible_f5/6.inventory/index.html Wed, 27 Mar 2024 10:40:21 -0400 http://localhost:8080/ansible_f5/6.inventory/index.html Navigate back in the repo by selecting Code and then Repositories. Drill down into the inventories and then staging directory an select the hosts file to view the ansible inventory file. Next drill into the group_vars and then f5 directory. Select secrets.yml to view the encrypted ansible vault file. Next, select all.yml to view the desired F5 configuration. Edit the file. Uncomment the #user line at the top of the file and change the USER value to your username. http://localhost:8080/ansible_f5/7.staging/index.html Wed, 27 Mar 2024 10:40:21 -0400 http://localhost:8080/ansible_f5/7.staging/index.html The following playbooks are used as part of this exercise Playbook Purpose bigip-node.yml Creates a Big-IP nodes bigip-pool.yml Creates a Big-IP pools bigip-pool-members.yml Adds members to pools bigip-irule.yml Creates an irule bigip-virtual-server.yml Creates a virtual server bigip-config.yml Saves the BIG-IP configuration The values in the inventories/staging/group_vars/f5/all.yml are used to define the configuration of each element. Prior to the playbooks being run, the ANSIBLE_VAULT_PASSWORD environmental variable is injected as a file into the container with the following command: http://localhost:8080/ansible_f5/8.cleanup/index.html Wed, 27 Mar 2024 10:40:21 -0400 http://localhost:8080/ansible_f5/8.cleanup/index.html Head back to the .gitlab-ci.yml file and add a final stage of delete, so that the section looks as follows: stages: - registry - container - info - test - staging - delete Add the following details for the staging block to the end of the file: delete_config: stage: delete rules: - if: '$CI_COMMIT_BRANCH == "delete"' when: manual tags: - ansible_f5 image: ${CI_REGISTRY}/${CI_PROJECT_PATH}/ansible:latest script: - echo $ANSIBLE_VAULT_PASSWORD > vault_passwd - ansible-playbook -i inventories/staging/ --vault-password-file vault_passwd bigip-delete-configuration.yml Commit the changes. This will trigger another pipeline run, but we can ignore it. http://localhost:8080/ansible_f5/9.theend/index.html Wed, 27 Mar 2024 10:40:21 -0400 http://localhost:8080/ansible_f5/9.theend/index.html That concludes the Ansible F5 workshop. Questions/Feedback?