What I've done is I created an account called Tim.
It's a domain user account, and that's going to be my Ansible service account.
Notice that I'm not naming it Ansible.
It would probably be a good idea,
but I tend to really want to obfuscate any account
that's going to have higher privileges.
I don't want it‑‑‑ If a bad actor were to enumerate accounts,
Ansible would be a juicy one.
So mine's called Tim.
I do have Tim as a member of domain admins.
But remember, as I mentioned in the lecture part of this course thus far,
I want you to think about things like LAPS,
the Local Administrator Password Solution in Windows, and think of other ways,
JEA, PowerShell just in time or just enough administration,
think of these techniques in addition to the Ansible techniques.
So what I've got here is I've created an Ansible
vault at the root of my home folder.
Here it is right here, vault.yml.
You can use the ansible‑playbook command to create, ansible‑playbook create,
ansible‑playbook edit.
And then I've got here on line 9 whether or not Ansible playbook
should automatically prompt for the vault password.
And I have ask_vault_pass set to true here, but it's commented out.
So I'm going to get rid of that comment.
And I also have pinned the path to my vault file here using
vault_password_file and then where my vault is.
To unlock the vault means to supply the appropriate password.
And in my vault, I just have two lines of text.
I have ansible_user:tim and ansible_password: and then the plain text password.
But I did put a strong password on the vault itself.
So at this point,
we should be able to get away with running Ansible Playbook
without having to do the separate ask‑vault‑pass.
So let me put in that password now. And it just bombs all over the place.
Well, isn't that fun?
Isn't that real world?
I'm not able to reach either one of my hosts here.
Okay, let's try that again.
I've run check with ‑v. And once again,
this is going to run through and flag any initial errors or what might happen.
Let's move this up a little bit here so we can see.
All right, so first, gathering initial facts passed for both hosts.
By the way, if you're wondering what all that ugly text was talking about,
what happened actually is that the Kerberos ticket for
my Ansible service account expired.
So on the control node,
what I did to fix this is that I just ran let me show you down at the bottom.
I just did a kinit tim@TIMW.INFO.
TIMW.INFO is my real name, of course.
And that just refreshes the Kerberos ticket for the service account.
And that's something you can do programmatically every however many
hours it is before Kerberos tickets time out.
But the good news here is that by using check,
you're able to test the behavior of a playbook,
including all this ugly stuff that I'm glad is showing up here.
We're not going to get quite so much ugly stuff if we back off on
that verbosity. Let me actually do a clear screen, and let's just
do a check without the verbose flag and see if that's a little
bit easier for us to see.
Now, in this particular playbook, we haven't done anything with elevation.