Ansible Integration

Overview

Ansible integrates with NxtSight through two complementary mechanisms: the openstack.cloud collection for infrastructure automation, and SSH/WinRM-based playbooks for instance configuration. Ansible operates agentlessly — no software is installed on your managed instances beyond a working SSH daemon and Python interpreter. The NxtSight dynamic inventory plugin sources instance metadata directly from the compute API, automatically organizing hosts by project, availability zone, image, and custom metadata tags.

Prerequisites

Ansible 2.12 or later installed
openstack.cloud collection: ansible-galaxy collection install openstack.cloud
NxtSight application credentials or openrc file sourced in the shell
openstacksdk Python library: pip install openstacksdk

Dynamic Inventory

The openstack.cloud.openstack inventory plugin generates a live host list from the NxtSight compute API. Hosts are grouped by instance metadata, eliminating the need to maintain static inventory files.

inventory/openstack.yml

plugin: openstack.cloud.openstack
auth:
  auth_url: "https://api.<your-domain>:5000/v3"
  username: "{{ lookup('env', 'OS_USERNAME') }}"
  password: "{{ lookup('env', 'OS_PASSWORD') }}"
  project_name: "{{ lookup('env', 'OS_PROJECT_NAME') }}"
  user_domain_name: Default
  project_domain_name: Default
expand_hostvars: true
fail_on_errors: false
groups:
  web_servers: "'web' in name"
  app_servers: "'app' in name"
  db_servers: "'db' in name"
compose:
  ansible_host: access_ipv4

Test inventory resolution:

List dynamic inventory hosts

ansible-inventory -i inventory/openstack.yml --list

Playbook Examples

OS Bootstrap

Bootstrap a newly provisioned instance with required packages, users, and firewall rules:

playbooks/bootstrap.yml

---
- name: Bootstrap new instances
  hosts: all
  become: true
  vars:
    admin_users:
      - name: deploy
        groups: sudo
        ssh_key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"

  tasks:
    - name: Update package cache and upgrade
      apt:
        update_cache: true
        upgrade: dist
        cache_valid_time: 3600

    - name: Install required packages
      apt:
        name:
          - curl
          - vim
          - htop
          - unattended-upgrades
          - ufw
        state: present

    - name: Create admin users
      user:
        name: "{{ item.name }}"
        groups: "{{ item.groups }}"
        shell: /bin/bash
        create_home: true
      loop: "{{ admin_users }}"

    - name: Add SSH authorized keys
      authorized_key:
        user: "{{ item.name }}"
        key: "{{ item.ssh_key }}"
        state: present
      loop: "{{ admin_users }}"

    - name: Configure UFW default deny
      ufw:
        state: enabled
        direction: incoming
        policy: deny

    - name: Allow SSH
      ufw:
        rule: allow
        port: "22"
        proto: tcp

Patch Management

Apply security patches across all instances in a project:

playbooks/patch.yml

---
- name: Apply security patches
  hosts: all
  become: true
  serial: "25%"

  tasks:
    - name: Update package cache
      apt:
        update_cache: true
        cache_valid_time: 0

    - name: Apply security updates only
      apt:
        upgrade: safe
        update_cache: false

    - name: Check if reboot is required
      stat:
        path: /var/run/reboot-required
      register: reboot_required

    - name: Reboot if kernel was updated
      reboot:
        reboot_timeout: 300
        msg: "Rebooting after kernel patch"
      when: reboot_required.stat.exists

    - name: Verify instance is responsive after reboot
      wait_for_connection:
        delay: 10
        timeout: 120

CIS Compliance Enforcement

Apply CIS baseline hardening to Linux instances:

playbooks/cis-harden.yml

---
- name: Apply CIS Level 1 baseline
  hosts: all
  become: true

  tasks:
    - name: Disable unused filesystems
      lineinfile:
        path: /etc/modprobe.d/disable-filesystems.conf
        line: "install {{ item }} /bin/true"
        create: true
        mode: "0644"
      loop:
        - cramfs
        - freevxfs
        - jffs2
        - hfs
        - hfsplus
        - udf

    - name: Set password minimum length
      lineinfile:
        path: /etc/security/pwquality.conf
        regexp: "^minlen"
        line: "minlen = 14"

    - name: Set SSH MaxAuthTries
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "^MaxAuthTries"
        line: "MaxAuthTries 4"
      notify: Restart SSH

    - name: Disable root SSH login
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "^PermitRootLogin"
        line: "PermitRootLogin no"
      notify: Restart SSH

    - name: Enable auditd
      service:
        name: auditd
        state: started
        enabled: true

  handlers:
    - name: Restart SSH
      service:
        name: sshd
        state: restarted

Infrastructure Management via NxtSight Modules

Create and manage NxtSight resources directly from playbooks:

playbooks/provision.yml

---
- name: Provision application tier
  hosts: localhost
  gather_facts: false

  tasks:
    - name: Create application network
      openstack.cloud.network:
        state: present
        name: app-network
        external: false

    - name: Create subnet
      openstack.cloud.subnet:
        state: present
        network_name: app-network
        name: app-subnet
        cidr: 10.200.0.0/24
        dns_nameservers:
          - 8.8.8.8

    - name: Launch application instances
      openstack.cloud.server:
        state: present
        name: "app-{{ item }}"
        image: Ubuntu-22.04
        flavor: m1.medium
        key_name: deployer-key
        network: app-network
        security_groups:
          - default
          - app-sg
        wait: true
      loop: "{{ range(1, 4) | list }}"
      register: created_servers

    - name: Add new instances to in-memory inventory
      add_host:
        hostname: "{{ item.server.access_ipv4 }}"
        groups: new_instances
      loop: "{{ created_servers.results }}"

Credential Management

Store secrets used in playbooks in NxtSight Key Manager (Barbican) or HashiCorp Vault. Retrieve them at runtime using the community.general.hashi_vault or openstack.cloud.identity_user lookup plugins rather than hardcoding in vars files.

group_vars/all/vault.yml

# Encrypted with ansible-vault
db_password: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  ...encrypted blob...

Run playbook with vault password

ansible-playbook -i inventory/openstack.yml playbooks/bootstrap.yml \
  --vault-password-file ~/.vault-pass

Running Playbooks

Source credentials

Load NxtSight credentials

source admin-openrc.sh

Test connectivity

Ping all dynamic inventory hosts

ansible -i inventory/openstack.yml all -m ping

All targeted instances return a pong response.

Run a playbook

Run bootstrap playbook

ansible-playbook -i inventory/openstack.yml playbooks/bootstrap.yml \
  --limit web_servers \
  --diff \
  --check

Remove --check to apply changes. --diff shows what would change on each host.

Verify results

Check instance facts

ansible -i inventory/openstack.yml web_servers -m setup \
  -a "filter=ansible_distribution*"

Playbook completes with no failed tasks. Verify changes on instances via SSH or the Dashboard console.

Next Steps

Terraform Integration

Use Terraform for provisioning and Ansible for post-provision configuration

Wazuh Integration

Deploy Wazuh agents using Ansible playbooks for SIEM and compliance monitoring

Key Manager

Store playbook secrets in NxtSight Key Manager for secure credential retrieval

Auto-Scaling

Bootstrap auto-scaled instances using Ansible cloud-init integration

Core Services

Other Services

Ansible Integration

Overview

Dynamic Inventory

Playbook Examples

OS Bootstrap

Patch Management

CIS Compliance Enforcement

Infrastructure Management via NxtSight Modules

Credential Management

Running Playbooks

Source credentials

Test connectivity

Run a playbook

Verify results

Next Steps

Terraform Integration

Wazuh Integration

Key Manager

Auto-Scaling

​Overview

​Dynamic Inventory

​Playbook Examples

​OS Bootstrap

​Patch Management

​CIS Compliance Enforcement

​Infrastructure Management via NxtSight Modules

​Credential Management

​Running Playbooks

Source credentials

Test connectivity

Run a playbook

Verify results

​Next Steps

Terraform Integration

Wazuh Integration

Key Manager

Auto-Scaling

Overview

Dynamic Inventory

Playbook Examples

OS Bootstrap

Patch Management

CIS Compliance Enforcement

Infrastructure Management via NxtSight Modules

Credential Management

Running Playbooks

Next Steps