Automating Infrastructure with Cisco

Automating Infrastructure with Cisco

• Automation uses code to configure, deploy, and manage applications and their supporting infrastructure (compute, storage, and network)
• Cisco infrastructure platforms integrate with common tools like Ansible, Puppet, and Chef, or offer direct API access to programmable infrastructure.
• Several automation use cases exist, depending on the operational model to be followed. These include "walk" (read-only automation), "run" (activating policies and self-service), and "fly" (deploying applications and handling more complex scenarios via CI/CD)

Why Do We Need Automation?

• Speed and agility enable businesses to explore, experiment, and exploit market opportunities more quickly.
• Developers need to accelerate software building phases (coding, testing, staging).
• DevOps practices require developers to deploy and manage applications in production, so automation is necessary.
• Manual operations are costly, time consuming, prone to human error, and often incomplete or ambiguous.

Dependency Risks

• Today's software ecosystem is decentralized. Developers often build individual components according to their needs, mixing and matching components.
• Components need to work together with many other components.
• Component developers may abandon support for obsolete features. This disrupts processes.
• Dependency-ridden application setups often become locked into fragile and insecure deployment stacks.

Why do we need Full-Stack automation?

• Self-service: Automation offers self-service for infrastructure on-demand.
• Scalability on demand: Applications and platforms can scale up or down based on workload demands.
• Observability: Allows users to observe the internal state of complex systems from outputs.
• Automated problem mitigation: Enables applications and platforms to self-heal and decrease the effects of issues, preventing downtime.

Software-Defined Infrastructure: A Case for Automation

• Software-defined infrastructure (often cloud-based) allows developers and operators to use software to manage bare-metal and virtualized resources.
• Benefits of cloud paradigms include self-service, detailed specifications, consistency and repeatability, and platform abstraction.
• Challenges in cloud paradigms include ensuring secure developer access control and calculating precise costs.

Distributed and Dynamic Applications: Another Case for Automation

• Modern application architectures are increasingly distributed.
• They consist of small, light components (microservices).
• Components are isolated in containers, communicated via discovery and messaging services.
• They are backed by resilient, scalable databases.

Benefits of Microservices

• Scalability: Microservices can be scaled and load-balanced as needed across numerous servers or regions.
• Infrastructure automation: Tools automate on-demand scaling, self-healing, and more with microservice-based applications.

Challenges of Microservices

• Increased complexity: Management and deployment of numerous moving parts.
• Automation is a requirement: Manual methods are not effective for managing complex deployments.

Automating Infrastructure Summary

• Automation is necessary for managing all phases of application development (app building, configuration, deployment, and lifecycle management).
• Tools automate management of software-defined infrastructure on behalf of applications
• Automation code is treated as a single work product.

DevOps and SRE

• Full-stack automation requires organizational cultural shifts to eliminate historical divides between Development (Dev) and Operations (Ops).
• Traditionally, creating apps fell under the Dev remit while maintaining the apps was under Ops.
• Dev and Ops differences include resource management, responsibilities, and priorities.

Evolution of DevOps

• Key moments include the institutionalization of Site Reliability Engineering (SRE) at Google, Patrick Debois' work of automating virtual and physical resources using version control and agile methods, and John Allspaw and Paul Hammond's presentation of DevOps best practices.

Core Principles of DevOps

• Focus on automation
• The idea of failure as normal
• The reframing of availability - how much error/downtime can be tolerated

SLOs, SLIs and Error Budgets

• DevOps/SRE cultures demand deliverable, measurable, agreed upon business value.
• Defining metrics in terms of real Service Level Indicators (SLIs).
• SLOs help deliver business values more rapidly.
• Error budgets guide development- and operational tasks.

DevOps and SRE Summary

• DevOps/SRE is evolving alongside virtualization, containerization, and unified toolsets for application and infrastructure engineering.

Basic Automation Scripting

• Powerful automation tools simplify, ease, and increase predictability for DevOps tasks.
• Automation tools like Ansible, Puppet, and Chef wrap shell functionality, operating system utilities, and other control plane elements to achieve operational goals of simplicity, uniformity, and enrichment.
• Basic automation scripting is essential.

Basic Tools for Automation Scripting

• Shells (e.g., Bash) are ubiquitous and the foundation for much automation.
  • Commands are similar to command lines, useful to script AWS CLI access.
  • High-level languages make scripting more complex, parallel operations, and error handling easier.
• Programming languages beyond Bash handle complexity and scale requirements well.
  • Useful for controlling actions in virtualized cloud environments.

Procedural Automation

• An ordered sequence of commands to achieve a goal.
• Instructions may include flow control, conditions, functions, classes.
• To improve efficiency, standardize ordering with parameters, flags, and errors.
• Dividing tasks creates modular, reusable, configurable code in scripts.
• Separating deployment-specific data from code makes code generic and reusable.

Executing Scripts Locally and Remotely

• Automate with shell utilities or copy/transmit scripts.
• Pipe commands to remote machines for execution.

Cloud Automation

• Cloud providers often offer specialized tools for managing cloud resources.
• Popular deployment tools extract resource inventories from cloud frameworks during automation.

Cloud CLIs and SDKs

• Cloud Infrastructure as a Service (IaaS) and other infrastructure clouds often provide CLIs and SDKs for easy connectivity.
• REST-based interfaces are common. (Cisco UCS - a bare metal cloud, VMware, and OpenStack each have toolkits/APIs of their own.)

Ansible

• Ansible is an open-source automation tool.
• Ansible is commonly managed via the Bash command line with automation code from standard text editors.
• Ansible's architecture is simple and lightweight.
  • Control node runs Python (2 or 3).
  • SSH-based connection.
  • Executes shell and python commands/scripts on remote hosts.
  • Enables installing Python on target machines.

Ansible (Contd.)

• Ansible code structures use YAML files (with code) describing task sequences run in (top-down order).
• Playbooks and roles enable modular organization for tasks into maintainable units.

Ansible (Contd.)

• Ansible projects are organized in a nested directory structure for version control or GitOps-style infrastructure as code.
• Scaling challenges for larger organizations can be addressed by centralized solutions (Red Hat Ansible Tower; AWX project)
• Ansible Vault enables encryption of sensitive information.

Cisco Ansible Resources

• Extensive libraries of Ansible modules for automating many different Cisco products.
• Automate configurations on Cisco Application-Centric Infrastructure (ACI) enabled devices (using APIC).
• Automate device configurations with IOS-XR and NETCONF/REST interface support.
• Automate Cisco UCS configurations via Intersight REST interface.

Ansible Example

• Ansible uses SSH to connect and execute commands (on remote hosts).

Ansible Example (Setup)

• Preparing project directory and files.
  • Create folders for roles, and create a site.yaml inventory file, and main.yaml playbook.

Ansible Example (running)

• Run commands using Ansible.
• Check for success and failures of deployment.

Ansible Example (Contd.)

• Create an index.html file with a basic website, save the changes.
• Execute Ansible playbook and note the changes on the remote target.

Ansible Example (CI/CD)

• Simulating CI/CD pipeline: a step for developers, tests, and moving changes to Production (ansible-playbook -vv).

Lab — Use Ansible to Backup and Configure a Device

• Instructions to launch VMs, configure Ansible, back up configurations, and configure devices.

Lab — Use Ansible to Automate Installing a Web Server

• Instructions to automate web server installations.

Puppet

• Puppet was introduced in 2005 as open source and later commercialized.
• Puppet uses a server and clients.
• Components include a server to hold main components, a secure client(Puppet Agent), and modules that support connections and hardware.
• A proxy agent offloads connection tasks (to handle large-scale deployments).

Puppet (Installing the Server)

• Puppet server needs powerful hardware (or a Virtual Machine.)
• It requires network time protocol (NTP).
• The Puppet puppet.conf file configures communication.
• The client will receive a signed certificate.

Puppet Code Structure

• Puppet components are structured into a tree folder.
• Additional resources can be downloaded/installed from Puppet Forge (by using a command).

Puppet at Scale

• A monolithic installation is recommended.
• Additional compile masters provide compilation for larger numbers of client agents and place them behind a load balancer to distribute work.
• Enterprise customers use PE-PostgreSQL for a stand-alone instance of PuppetDB to further improve capacity.

Cisco Puppet Resources

• Extensive libraries of Puppet modules for automating Cisco compute and network hardware, including modules for IOS infrastructure, and UCS management via Cisco UCS Manager.

Puppet Example

• Describes how to install Puppet and configure Apache2 remotely on a target device.
• Includes how to install the Puppet agent, run commands and establish the certificate (needed for the agent to communicate).

Puppet Example (Config)

• Configuring puppet.conf to define the Server, authentication certificates, the locations of code.

Puppet Example (Client Installation)

• Installing Puppet agent (a client) on the target machine.

Puppet Example (Starting Puppet Service)

• This will initiate Puppet's service on the target machine.

Puppet Example (Certificate)

• This stage will verify that the certificate has been signed and that communication is possible between the server and the target machine.

Puppet Example (Creating Configuration)

• This stage describes how to create the necessary files to configure the target machine.

Puppet Example (Deploying Configuration)

• This stage describes how to apply the configuration to the target machine via the server.
  • systemctl restart puppetserver.service (used for deploying the configuration.)

Chef

• Chef is a complete system for treating infrastructure as code.
• Features include infra-as-code creation, testing, organization, and repository storage.
• Execution on remote targets from a stand-alone Chef Workstation or a central server.

Chef Architecture Components

• Chef Workstation (a host agent).
• Chef Infra Client.
• Chef Infra Server.

Chef Installation on a Workstation

• Install Chef Workstation on a Linux based VM or Ubuntu.

Chef Example to Install and Use Chef

• Install necessary software. (NTP and OpenSSH)
• Use commands such as chef-run to deploy configurations.

Chef Infra Server Prerequisites

• Install openssh-server and enable keywise access.
• Install NTP for time synchronization.

Chef Example: Installing Chef Server

• Install via commands, obtain the .deb package and install it using dpkg -i.
• Initialize and configure the server sudo chef-server-ctl reconfigure

Chef Example: Starting and Enabling Chef-Manage

• Run sudo chef-server-ctl install chef-manage command.

Chef Example: Configuring a Workstation

• Retrieve keys, put them in a folder, like /home/username/.chef (using the scp command).

Chef Example: Prepare to use Knife

• Create a config.rb file in the .chef folder.

Chef Example: Bootstrap a target node

• Using Knife to bootstrap a target node with parameters such as <name-for-your-node>

Chef Example: Verify Knife Success

• Verify successful installation.

Chef Example: Putting It All Together

• Example to demonstrate an end to end setup including creating a cookbook, configuring files, deploying the configuration using Chef.

Network Simulation and VIRL

• VIRL is a powerful tool for network simulation.
• It allows users to test configuration, troubleshoot bugs in configuration code.
• It supports various topologies, including a two router IOS network.

VIRL Files

• The virl files describe a simulation's components (routers, configurations, connections) in a YAML format.
• These files can be used for managing and configuring simulations in various software platforms.

Infrastructure as Code

• The approach to maintain systems by treating configuration as code.
• GitOps is a workflow for using Git to manage and automate deployments.
• Blue/Green deployment is a strategy to reduce downtime in production environments by swapping environments between operational use.

Canary Testing

• Canary testing provides a method of implementing new code or deployments in a controlled way on a subset of users.

Automating Testing

• Automated testing is beneficial to identify bugs and failures in applications quicker.
• PyATS enables code review and testing with unit tests, providing a means to validate and improve network configurations by checking code behavior based on developer commits, or pull requests, in a QA or Production environments.

PyATS Tools

• Python Automated Test System (pyATS).
  • Provides automated testing and validation capabilities.
• Genie - a higher-level library in pyATS;
  • Facilitates interaction with various devices using APIs.

pyATS Example

• Describes how to install pyATS, configure, and use virtual machine environments for testing.
• It involves creating Virtual Environments, install the python3-venv package.

Lab — Automated Testing using pyATS

• Describes steps for setting up automated tests.
  • Launch virtual machines (VMs).
  • Setting up the Python Virtual Environment.
  • Using the pyATS Testing Library.
  • Using Genie to compare configurations.

Network Simulation

• Using VIRL tools to simulate network environments is useful in validating configurations before implementing changes, troubleshooting configurations/code bugs, or just experimenting with different configurations safely.
• VIRL supports a CLI for managing systems locally, a REST interface for automation integration, and a UI for configuration.